Data Protection Policy

We are committed to protecting your personal data and respecting your privacy rights in accordance with applicable data protection laws.

Last Updated: January 1, 2024

Effective Date: January 1, 2024

Our Data Protection Principles

Data Minimization

We collect only the minimum data necessary for our services

Transparency

Clear information about what data we collect and how we use it

User Control

You have full control over your personal data and privacy choices

Security First

Strong technical and organizational measures protect your data

Limited Retention

We keep data only as long as necessary for legitimate purposes

Legal Compliance

Full compliance with applicable data protection regulations

Data Controller Information

Who Controls Your Data

VyomA acts as the data controller for personal information collected through our website and services. This means we determine the purposes and means of processing your personal data.

Data Controller Details

Organization: VyomA

Registration: Indian Private Entity

Address: Bangalore, Karnataka, India - 560001

Contact: privacy@vyoma.online

Data Protection Officer

Role: Privacy and Data Protection Lead

Email: dpo@vyoma.online

Responsibilities: Oversight of data protection compliance

Response Time: Within 72 hours

Personal Data We Collect

Calculator Usage - No Personal Data Collected

✅ Your land measurement calculations are completely private and never collected or stored.

How Our Calculators Protect Your Privacy:

• Client-side processing: All calculations happen in your browser
• No data transmission: Your input values never leave your device
• No storage: We don't save your calculation history
• Offline capable: Works without internet connection once loaded
• No tracking: We don't monitor what you calculate

Personal Data We Do Collect

We collect minimal personal data only when you voluntarily provide it for specific services:

Contact Form Submissions

Data Collected:

Name (required)
Email address (required)
Phone number (optional)
State/region (optional)
Message content
Timestamp of submission

Purpose: Responding to your inquiries and providing support

Legal Basis: Legitimate interest (providing requested information)

Retention: 2 years from last contact

Newsletter Subscriptions

Data Collected:

Email address
Subscription date
Subscription preferences
Email interaction data (opens, clicks)

Purpose: Sending updates about new calculators and features

Legal Basis: Consent (explicit opt-in required)

Retention: Until you unsubscribe

Website Analytics

Data Collected:

Anonymized IP address
Browser type and version
Device type and screen resolution
Pages visited and time spent
Referrer website
General geographic location (country/state)

Purpose: Understanding website usage to improve user experience

Legal Basis: Consent (cookie acceptance required)

Retention: 26 months (Google Analytics default)

Technical Information

Data Collected:

Server log data (IP, timestamp, request)
Error logs for debugging
Performance metrics
Security event logs

Purpose: Security, performance monitoring, and technical support

Legal Basis: Legitimate interest (service operation and security)

Retention: 90 days for logs, 1 year for aggregated metrics

Legal Basis for Data Processing

Under data protection laws (including GDPR), we must have a valid legal basis for processing your personal data. Here are the legal bases we rely on:

Consent

When we use it:

Newsletter subscriptions
Analytics cookies
Marketing communications

Your rights: You can withdraw consent at any time

Legitimate Interest

When we use it:

Responding to contact form inquiries
Website security and fraud prevention
Service improvement and optimization

Balancing test: We ensure our interests don't override your rights

Legal Obligation

When we use it:

Tax and accounting records
Legal compliance reporting
Court orders or legal requests

Note: We only process what's legally required

Vital Interest

When we use it:

Emergency situations
Life-threatening circumstances
Public health emergencies

Note: Rarely applicable to our services

Data Sharing and Third-Party Processors

What We Don't Do

❌ We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Specifically, we do NOT:

• Sell your email addresses to marketers
• Share personal data with data brokers
• Provide user information to advertisers
• Exchange data for commercial gain
• Create user profiles for external use

Authorized Third-Party Processors

We work with carefully selected service providers who process personal data on our behalf. All processors are bound by strict data protection agreements:

Analytics Services

Provider: Google Analytics

Data Processed: Anonymized usage statistics

Purpose: Website performance analysis

Safeguards: IP anonymization, data retention controls

Location: EU and US (adequacy decision)

Email Services

Provider: Professional email hosting

Data Processed: Contact form submissions, newsletters

Purpose: Communication and support

Safeguards: Encryption, access controls

Location: India and EU

Hosting Services

Provider: Cloud hosting providers

Data Processed: Website data, server logs

Purpose: Website hosting and delivery

Safeguards: Encryption, access logging, backups

Location: India, Singapore, EU

Security Services

Provider: CDN and security providers

Data Processed: IP addresses, request logs

Purpose: DDoS protection, performance optimization

Safeguards: Limited retention, anonymization

Location: Global network with data residency controls

Legal Disclosure Requirements

We may disclose personal data only when legally required or in specific circumstances:

Legal Obligations

• Court orders and legal proceedings
• Government requests under applicable law
• Tax and regulatory compliance
• Law enforcement investigations

Emergency Situations

• Protecting life or preventing serious harm
• Preventing fraud or security threats
• Protecting our legal rights
• Public safety concerns

Our Commitment: We will notify you of any legal disclosure request when legally permitted, and we will challenge overly broad or inappropriate requests to protect your privacy.

International Data Transfers

Cross-Border Data Protection

As a global service, some of your personal data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place for all international transfers.

Adequate Protection Jurisdictions

Primary Locations:

India: Primary data processing location
European Union: GDPR adequacy for EU users
Singapore: Strong data protection laws
Canada: PIPEDA compliance

Transfer Safeguards

Protection Mechanisms:

Standard Contractual Clauses: EU-approved contracts
Adequacy Decisions: Government-recognized protections
Binding Corporate Rules: Internal data protection rules
Explicit Consent: When other safeguards aren't available

Special Note for US Transfers

For transfers to the United States, we rely on Standard Contractual Clauses and additional safeguards such as encryption, data minimization, and access controls to ensure your data receives adequate protection.

Data Security Measures

Technical Security Measures

Encryption

• In Transit: TLS 1.3 encryption for all communications
• At Rest: AES-256 encryption for stored data
• Database: Encrypted database storage
• Backups: Encrypted backup systems

Access Controls

• Role-based access: Minimal necessary permissions
• Multi-factor authentication: Required for admin access
• Regular audits: Access review and monitoring
• Principle of least privilege: Limited data access

Infrastructure Security

• Secure hosting: ISO 27001 certified data centers
• Network security: Firewalls and intrusion detection
• Regular updates: Security patches and updates
• Monitoring: 24/7 security monitoring

Vulnerability Management

• Security testing: Regular penetration testing
• Code reviews: Security-focused code analysis
• Dependency scanning: Third-party library monitoring
• Incident response: Prepared response procedures

Organizational Security Measures

Staff Training

Regular privacy and security training for all team members with access to personal data

Confidentiality Agreements

All staff and contractors sign comprehensive privacy and confidentiality agreements

Background Checks

Appropriate background verification for personnel with data access

Policies and Procedures

Comprehensive data protection policies covering all aspects of data handling

Incident Response

Documented procedures for handling data breaches and security incidents

Regular Reviews

Periodic assessment and improvement of security measures and practices

Data Retention and Deletion

Our Retention Policy

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and protect our legitimate interests.

Data Type	Retention Period	Deletion Trigger	Legal Basis
Contact Form Data	2 years from last contact	Automatic deletion after period	Support provision
Newsletter Subscriptions	Until unsubscribed	User unsubscribes	Consent
Analytics Data	26 months (anonymized)	Google Analytics retention settings	Legitimate interest
Server Logs	90 days	Automatic rotation	Security and performance
Legal Records	7 years	Legal requirement ends	Legal obligation

Secure Deletion Process

When data retention periods expire or deletion is requested:

Data is securely overwritten using industry-standard methods
Backup copies are identified and removed within 30 days
Third-party processors are notified to delete their copies
Deletion is verified and documented for compliance

Your Data Protection Rights

Your Fundamental Rights

Under data protection laws, you have several important rights regarding your personal data. These rights are free to exercise and we will respond within the legally required timeframes.