Privacy Notice

Cyphrna Private Limited is an India-based cybersecurity and governance, risk and compliance (“GRC”) company providing cybersecurity, information security, privacy, risk management, compliance and related professional services.

For privacy-related questions or requests, you may contact us using the details provided in the Contact Us section of this Notice.

Depending on how you interact with our website and services, we may collect the following categories of personal data:

A. Information you provide directly

This may include:

• Name
• Business email address
• Personal email address, where voluntarily provided
• Mobile or telephone number
• Company or organisation name
• Job title or designation
• Country, city or business location
• Information contained in your enquiry or message
• Information relating to services you are interested in
• Information provided when requesting a consultation or proposal
• Information provided when submitting a CV or employment application
• Any other information that you voluntarily provide to us

B. Technical and website information

When you visit our website, certain technical information may be collected automatically, depending on the website configuration and technologies we use.

This may include:

• IP address
• Browser type and version
• Operating system
• Device type
• Date and time of access
• Pages visited
• Referring website or source
• Approximate geographic information derived from technical data
• Website interaction and usage information
• Security and diagnostic information

C. Cookies and similar technologies

Our website may use cookies and similar technologies to:

• Operate and secure the website
• Remember preferences
• Understand website usage
• Improve website functionality
• Measure website performance
• Support analytics or marketing activities, where applicable

You may be able to control cookies through your browser or through any cookie-management mechanism provided on our website.

We may process personal data for purposes including:

• Responding to enquiries and requests
• Providing information about our services
• Scheduling consultations or meetings
• Preparing proposals, statements of work or service-related documentation
• Communicating with customers, prospective customers and business contacts
• Delivering and managing our services
• Managing contractual and business relationships
• Processing employment or recruitment applications
• Improving our website, services and user experience
• Conducting internal administration and business operations
• Maintaining information security and preventing fraud, abuse or unauthorised activity
• Detecting, investigating and responding to cybersecurity incidents
• Meeting applicable legal, regulatory and contractual requirements
• Establishing, exercising or defending legal rights
• Sending service-related communications
• Sending marketing communications where permitted and, where required, based on your consent

We will seek to process personal data for specified and legitimate purposes and will avoid using personal data for purposes that are incompatible with the purposes communicated to you, subject to applicable law.

Where applicable, Cyphrna may process personal data based on:

• Your consent;
• Certain legitimate uses permitted under applicable law;
• Performance of a contract or steps taken at your request;
• Compliance with applicable legal or regulatory obligations; or
• Other lawful grounds available under applicable law.

Where processing is based on consent, you may withdraw your consent in accordance with applicable law.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Where the DPDP Act requires consent, we will seek consent in a manner that is appropriately informed, specific and clear. The DPDP framework also provides for withdrawal of consent and exercise of data principal rights.

If you submit information through a contact, enquiry, consultation or other website form, Cyphrna may use the information to:

• Respond to your enquiry;
• Understand your requirements;
• Contact you regarding the requested service;
• Prepare or provide relevant information, proposals or quotations; and
• Maintain appropriate business records.

Please do not submit passwords, confidential credentials, payment card information, security keys, production system credentials, or highly sensitive information through general website contact forms.

Where you engage Cyphrna for professional services, additional information may be processed as necessary to establish and manage the business relationship.

This may include information relating to:

• Customer representatives;
• Project stakeholders;
• Authorised users;
• Business contacts;
• Project requirements;
• Contractual information;
• Service delivery information; and
• Information necessary for cybersecurity, GRC, risk or compliance engagements.

Where Cyphrna processes personal data on behalf of a customer as part of a professional engagement, the relevant customer may determine the purposes and means of processing. In such circumstances, Cyphrna may act as a service provider or processor under the applicable contractual and legal framework.

If you submit your CV or apply for a position with Cyphrna, we may process information such as:

• Name and contact details;
• Professional qualifications;
• Employment history;
• Certifications;
• Educational information;
• Skills and experience;
• CV/resume information;
• Interview-related information; and
• Other information voluntarily provided during recruitment.

Recruitment information will be used for recruitment, candidate evaluation, communication and related employment administration.

Cyphrna does not sell personal data.

We may disclose or provide access to personal data where reasonably necessary to:

• Employees and authorised personnel;
• Service providers and technology providers;
• Cloud hosting and infrastructure providers;
• Website, analytics or communications providers;
• Professional advisers;
• Legal, regulatory or governmental authorities where required or permitted by law;
• Business partners where necessary to provide a requested service; or
• Other parties where you have authorised or requested such disclosure.

Where appropriate, we seek to ensure that third-party service providers process personal data under appropriate contractual, confidentiality and security obligations.

Depending on the technologies, service providers and business arrangements used by Cyphrna, personal data may be processed or stored in jurisdictions outside India.

Where personal data is transferred or made accessible outside India, Cyphrna will take appropriate steps as required under applicable law, contractual commitments and relevant regulatory requirements.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including:

• Providing requested services;
• Maintaining business and contractual records;
• Meeting legal, regulatory and accounting requirements;
• Resolving disputes;
• Preventing fraud or security incidents; and
• Establishing, exercising or defending legal claims.

When personal data is no longer required, we will take reasonable steps to delete, anonymise or otherwise dispose of it in accordance with applicable requirements and our internal retention practices.

As a cybersecurity and GRC organisation, Cyphrna recognises the importance of protecting personal data against unauthorised access, disclosure, alteration, loss or destruction.

Depending on the nature of the information and processing activity, we may use appropriate technical and organisational measures such as:

• Access controls;
• Authentication mechanisms;
• Encryption where appropriate;
• Secure communications;
• Logging and monitoring;
• Vulnerability and security management;
• Backup and recovery controls;
• Personnel confidentiality obligations;
• Third-party risk controls; and
• Incident response procedures.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Accordingly, while we implement reasonable security measures, we cannot guarantee absolute security.

Cyphrna maintains processes for identifying, assessing, responding to and managing personal data security incidents.

Where required by applicable law, Cyphrna will take appropriate steps to notify affected individuals and/or relevant authorities within applicable regulatory timelines.

Subject to applicable law and any conditions or limitations prescribed by law, you may have rights relating to your personal data, including rights to:

• Obtain information about processing of your personal data;
• Request access to personal data;
• Request correction or updating of inaccurate or incomplete personal data;
• Request deletion of personal data where legally applicable;
• Withdraw consent where processing is based on consent;
• Exercise other rights available under applicable data protection law; and
• Raise a grievance concerning processing of your personal data.

The DPDP Act establishes rights for Data Principals, while the notified Rules provide additional requirements concerning notices, consent withdrawal, rights requests and grievance mechanisms.

Requests should be submitted using the contact details provided below.

We may need to verify your identity before processing certain requests in order to protect personal data from unauthorised disclosure.

Our website and professional services are primarily intended for businesses, professionals and other adult users.

We do not knowingly seek to collect personal data from children except where permitted and appropriately authorised under applicable law.

Where applicable law imposes specific requirements relating to children’s personal data, Cyphrna will apply the required safeguards.

Our website may contain links to third-party websites, applications, platforms or services.

Cyphrna is not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy notices of third parties before providing them with personal data.

Where analytics or similar technologies are used, they may collect information about how visitors interact with our website.

Depending on the services configured on the website, these technologies may include first-party or third-party cookies, analytics tools, pixels or similar technologies.

You may manage certain cookies through your browser settings or any cookie-consent mechanism made available on our website.

Where permitted by applicable law, Cyphrna may send information about its services, events, publications, cybersecurity updates or other business communications.

You may opt out of marketing communications at any time by:

• Using the unsubscribe mechanism included in the communication; or
• Contacting Cyphrna using the details provided below.

You will continue to receive essential service, contractual, security or transactional communications where necessary.

Cyphrna may update this Privacy Notice periodically to reflect:

• Changes in our services;
• Changes in technology;
• Changes in our data processing practices;
• Changes in applicable laws or regulations; or
• Regulatory guidance or industry developments.

The updated version will be published on this page with a revised “Last Updated” date.

If you have questions about this Privacy Notice, wish to exercise applicable privacy rights, withdraw consent, or raise a privacy-related grievance, please contact:

Cyphrna Private Limited

Privacy / Data Protection Contact

[Insert designated privacy contact name or role]

Email

info@cyphrna.com

Registered Office

Bengaluru, Karnataka, India

Website

cyphrna.com

We will review and respond to privacy requests in accordance with applicable law and within the applicable regulatory timelines.

This Privacy Notice shall be interpreted in accordance with the laws of India, including applicable data protection and privacy legislation.

Where mandatory data protection or privacy requirements of another jurisdiction apply to particular processing activities, Cyphrna will seek to comply with those requirements to the extent applicable.

This Privacy Notice is intended as a website privacy document and should be read together with Cyphrna’s applicable Terms of Use, Cookie Notice, Information Security Policy and other contractual or service-specific terms.

This Notice does not create contractual rights beyond those provided by applicable law or applicable agreements between Cyphrna and its customers.

© 2026 Cyphrna Private Limited. All rights reserved.