Privacy Policy

01Who we are and our role

For personal data collected through our website and in our own business operations — enquiries, recruitment, vendor management and marketing — AptenTech is the Data Fiduciary (equivalent to a "controller").

Where we process personal data on behalf of a client while delivering a project — for example, data held inside an application we build or maintain — the client is the Data Fiduciary and AptenTech acts as a Data Processor, processing that data only on the client's documented instructions. Section 13 explains this in more detail.

02Personal data we collect

Information you give us

• Contact and enquiry data — name, email address, phone number and country code, company name, budget range, and the details you write in an enquiry or requirement form.
• Attachments — files you choose to upload with an enquiry, such as a brief, specification or wireframe.
• Recruitment data — CV, work history, education, portfolio links and any information you include in an application.
• Communication records — emails, call notes, meeting records and messages exchanged with us.
• Contract and billing data — billing address, GSTIN or tax identifiers, purchase orders and payment references (we do not store full card details; payments are handled by certified payment providers).

Information collected automatically

• Technical data — IP address, browser type and version, device type, operating system, screen size and language settings.
• Usage data — pages viewed, time on page, referring URL, links clicked and general navigation patterns.
• Cookie data — as described in Section 6.

Information from third parties

• Publicly available business information and professional networking profiles, where relevant to a business enquiry.
• Referral information, where an existing client or partner introduces you.
• Analytics and advertising platforms, in aggregated or pseudonymised form.

We do not intentionally collect sensitive personal data such as financial account details, health information, biometric data or government identifiers through our website forms. Please do not submit such information in a free-text field or attachment.

03How we use your data

• To respond to your enquiry, prepare proposals and estimates, and answer technical questions.
• To negotiate, enter into and perform contracts, including delivering the services agreed.
• To invoice, collect payment and maintain financial and statutory records.
• To communicate about projects, changes, support and service notices.
• To assess job applications and manage recruitment.
• To operate, secure, maintain and improve our website and services.
• To detect, prevent and investigate fraud, spam, abuse and security incidents.
• To send marketing communications where you have consented, or where permitted by law in a business context — you may opt out at any time.
• To comply with legal, regulatory, tax and accounting obligations, and to establish or defend legal claims.

04Lawful basis for processing

Under the DPDP Act we process personal data on the basis of your consent, or for certain legitimate uses recognised by the Act — such as where you have voluntarily provided data for a specified purpose, for employment purposes, or to comply with a legal obligation.

Where the GDPR applies, our lawful bases are: performance of a contract or steps taken at your request before entering into one; our legitimate interests in operating and growing our business, provided those interests are not overridden by your rights; compliance with a legal obligation; and consent, where required.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide certain services.

05Sharing and disclosure

We do not sell personal data. We share it only in the circumstances below:

• Service providers and sub-processors — cloud hosting, email, CRM, analytics, communication, payment and IT support providers who process data on our instructions under contractual confidentiality and security obligations.
• Professional advisers — lawyers, auditors, accountants and insurers, where necessary and under a duty of confidentiality.
• Group companies and subcontractors — where they are involved in delivering the services, bound by equivalent obligations.
• Legal and regulatory disclosure — where required by law, court order, or a lawful request from a government or regulatory authority.
• Business transfers — in connection with a merger, acquisition, restructuring or sale of assets, subject to this Policy continuing to apply.

A current list of our material sub-processors is available on request from the contact address in Section 16.

06Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember preferences, measure performance and understand how the site is used. We group them as follows:

• Strictly necessary — required for the site to function, including security and form handling. These cannot be switched off.
• Analytics — help us understand traffic and content performance in aggregate.
• Functional — remember choices such as language or previously entered form details.
• Marketing — used to measure campaign performance and, where applicable, show relevant advertising.

Non-essential cookies are set only where you have given consent through our cookie banner. You can change or withdraw your preferences at any time through the cookie settings link, and you can block or delete cookies in your browser settings — though doing so may affect how the site works.

Some third-party embeds, such as maps or video players, may set cookies when loaded. Where that is the case, we load them only after consent.

07Data retention

We keep personal data only for as long as necessary for the purpose it was collected for, and to meet legal, tax, accounting or contractual requirements.

• Enquiries that do not become projects — up to — months from last contact.
• Client contract and project records — for the duration of the engagement and — years thereafter.
• Financial and tax records — for the period required under Indian tax and companies law.
• Recruitment data — up to — months after a decision, unless you consent to us keeping it longer for future roles.
• Website analytics — typically — months in identifiable form.

When data is no longer needed, we delete it or irreversibly anonymise it.

08Data security

We apply reasonable security safeguards appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest for systems that support it.
• Role-based access control and the principle of least privilege.
• Multi-factor authentication on business-critical systems.
• Secrets management, dependency scanning and code review in our development process.
• Logging, monitoring and a documented incident response procedure.
• Confidentiality obligations and security awareness training for personnel.
• Due diligence on vendors and sub-processors.

No method of transmission or storage is completely secure. In the event of a personal data breach, we will notify the Data Protection Board of India, affected data principals and, where we act as a processor, the relevant client, in accordance with applicable law and within the prescribed timelines.

09International data transfers

We are based in India and may use service providers whose infrastructure is located outside India. Where personal data is transferred across borders, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government, and — where the GDPR applies — under an appropriate transfer mechanism such as Standard Contractual Clauses.

Where a client requires data residency in a particular jurisdiction, we can scope that as part of the engagement.

10Your rights

Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities undertaken.
• Correction and completion — have inaccurate or incomplete data corrected or updated.
• Erasure — request deletion of your personal data where it is no longer needed for the purpose it was collected for and no legal obligation requires us to retain it.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Grievance redressal — raise a complaint with our Grievance Officer (Section 16) and receive a response within the prescribed timeline.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.

Where the GDPR applies, you may additionally have rights to restrict processing, to data portability, and to object to processing based on legitimate interests or direct marketing.

To exercise any right, contact us at the address in Section 16. We may need to verify your identity before acting. We will respond within the timeline prescribed by applicable law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or your local supervisory authority.

11Marketing communications

We may send you information about our services, insights and events where you have consented or where you are an existing business contact and the communication relates to similar services. Every marketing email includes an unsubscribe link, and you can opt out at any time by contacting us. Opting out of marketing does not stop service or project-related communications.

12Children's data

Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data of any individual under the age of 18. Where we become aware that we have collected such data without verifiable parental or lawful guardian consent, we will delete it promptly. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

13Data processed on behalf of clients

When we build, host or maintain an application for a client, we may have access to personal data belonging to that client's users. In that context:

• The client determines the purpose and means of processing and remains the Data Fiduciary.
• We process such data only on the client's documented instructions and for the duration of the engagement.
• We apply the security measures described in Section 8, and assist the client with data principal requests and breach obligations to the extent reasonably practicable.
• We return or delete such data on termination, subject to any legal retention requirement.

If you are an end user of an application we built for a client, please contact that client directly to exercise your rights — they are the Data Fiduciary for your data.

14Automated decision-making and AI

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

Where we use AI tools internally — for example, to draft or summarise content — we take care not to input client Confidential Information or personal data into third-party AI services unless the client has approved it and appropriate contractual protections are in place.

15Third-party links

Our website may link to third-party sites, platforms and social media. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing personal data to them.

16Grievance Officer and contact

In accordance with the DPDP Act and the Information Technology Act, 2000 and rules made thereunder, we have appointed a Grievance Officer to address questions and complaints about the handling of personal data. We aim to acknowledge every grievance promptly and resolve it within the timeline prescribed under applicable law.

For general privacy queries you can also write to sales@aptentech.com.

17Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices, technology, services or legal obligations. The revised version will be posted on this page with an updated "Last updated" date. Where changes are material, we will provide a more prominent notice or contact you directly. We encourage you to review this page periodically.