Privacy Notice & Data Governance Policy

1. Legal Entity & Data Controller

This website and its associated digital services are operated by ARIVINEX TECHNOLOGIES PRIVATE LIMITED, a private limited company incorporated under the Companies Act, 2013 in India (hereinafter referred to as “Arivinex”, “we”, “our”, or “us”).

• Corporate Identity Number (CIN): U62099TN2026PTC194238
• Permanent Account Number (PAN): ABFCA9232M
• Registered Office: 26/4, Rajakandhammal Street, VGN Earnest Road, Melpakkam, Veeraraghavapuram, Poonamallee, Tiruvallur, Tamil Nadu - 600077, India
• Corporate Email: contact@arivinex.com
• Grievance & Data Protection Officer Contact: privacy@arivinex.com

2. Regulatory Scope & Applicable Laws

Arivinex provides B2B software engineering, automation, and enterprise platforms to clients in India, Singapore, the United Arab Emirates (UAE), and internationally. We have aligned this Privacy Notice with the statutory standards of our principal operating regions:

• India: The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, together with cybersecurity directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000.
• Singapore: The Personal Data Protection Act 2012 (PDPA) and Advisory Guidelines published by the Personal Data Protection Commission (PDPC) of Singapore.
• United Arab Emirates (UAE): Federal Decree-Law No. 45/2021 on Personal Data Protection (UAE PDPL) for mainland processing, and DIFC Data Protection Law No. 5 of 2020 where engagements originate within the Dubai International Financial Centre.

3. Categories of Personal Data Collected

We adhere strictly to the principle of data minimization and collect only personal data necessary for commercial project evaluation and technical operations:

• Inquiry & Business Communication Data: Name, work email address, company or organization name, operational process category, and details of the business problem submitted via our contact gateway.
• Technical & Telemetry Data: IP address, browser type and version, operating system, HTTP referrers, request timestamps, and network diagnostic parameters collected automatically by our hosting and web infrastructure.
• Site Preference Data: A single first-party cookie (arivinex_cookie_notice) recording the dismissal state of our privacy notice banner.

Sensitive Personal Data: Arivinex does not solicit, require, or intentionally process sensitive personal data (such as financial passwords, payment cards, government identifiers, biometric information, or health data) via this public website.

4. Purposes and Legal Basis for Processing

5. Data Hosting, Subprocessors & Recipients

We do not sell, rent, or trade personal data. Data submitted to Arivinex is processed solely by authorized personnel and trusted technical infrastructure providers under binding data processing agreements (DPAs):

• Cloud Hosting & Storage: Amazon Web Services (AWS) Asia Pacific (Mumbai / ap-south-1 region) for web hosting, secure static storage, and CloudFront content delivery.
• Corporate Email & Communications: Secure enterprise email infrastructure for receiving and dispatching project communications.
• Statutory Authorities & Legal Counsel: Law enforcement, regulators (e.g., CERT-In, MCA, GST authorities), or external legal counsel when strictly mandated by applicable law or court order.

6. International Data Transfers & Cross-Border Safeguards

Because we serve enterprise clients across India, Singapore, and the UAE, project communications and technical data may be transferred across international borders between these jurisdictions.

When cross-border transfers occur, Arivinex implements recognized legal safeguards, including Standard Contractual Clauses (SCCs), bilateral Data Processing Agreements incorporating PDPC Singapore transfer obligations, and technical encryption standards ensuring recipient environments meet comparable data protection levels.

7. Retention Periods & Secure Disposal Schedule

In accordance with data minimization mandates, personal data is retained only as long as necessary for the purpose it was gathered:

• General Contact Inquiries: Retained for 90 calendar days following receipt. If an inquiry does not materialize into an active commercial contract, records are permanently deleted or irreversibly anonymized.
• Server Security & Access Logs: Retained for 180 calendar days in strict accordance with the CERT-In Cybersecurity Directions under the IT Act, after which logs are automatically purged.
• Commercial Contracts & Accounting Records: Where an inquiry matures into an executed contract, statutory financial documents, tax invoices, and audit logs are retained for 8 financial yearsas required by Section 128 of India’s Companies Act, 2013 and GST legislation.

8. Security Safeguards & Incident Response Commitments

Arivinex maintains technical, physical, and administrative safeguards designed to protect personal information from unauthorized access, alteration, disclosure, or destruction:

• Transport Security: Strict enforcement of TLS 1.3 encryption across all website endpoints with HTTP Strict Transport Security (HSTS) preloading.
• Content Security: Enforcement of Content Security Policy (CSP), anti-framing headers (X-Frame-Options: DENY), and MIME sniffing controls (X-Content-Type-Options: nosniff).
• Access Governance: Role-based access control (RBAC), multi-factor authentication (MFA) on all administrative systems, and least-privilege credentialing.
• Incident Reporting Protocol: In the event of a cybersecurity incident affecting personal data:
  • India: Certain specified cyber incidents are notified to CERT-In within 6 hours of detection, and affected data principals are notified without undue delay under the DPDP Rules.
  • Singapore: Notifiable data breaches are reported to the Personal Data Protection Commission (PDPC) no later than 3 calendar days after determining that a breach is notifiable.

9. Your Legal Rights by Jurisdiction

Depending on your location and governing law, you have specific rights regarding your personal data:

For Visitors in India (DPDP Act, 2023)

• Right to Access: Request a summary of personal data processed by Arivinex and the processing activities undertaken.
• Right to Correction & Erasure: Request correction of inaccurate data or deletion of personal data no longer necessary for the specified purpose.
• Right of Grievance Redressal: Submit grievances directly to our designated Grievance Officer.
• Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.

For Visitors in Singapore (PDPA 2012)

• Right of Access & Correction: Request access to personal data in our possession or control and request correction of errors or omissions.
• Right to Withdraw Consent: Withdraw consent for data processing at any time upon reasonable notice.

For Visitors in the UAE (UAE PDPL / DIFC)

• Right to Access & Portability: Request access to your personal data and receipt in a structured, machine-readable format.
• Right to Rectification & Restriction: Request rectification of inaccurate records or restriction of processing in contested circumstances.
• Right to Erasure (“Right to be Forgotten”): Request erasure of data where processing is no longer legally justified.

10. Grievance Redressal, DPO & Escalation Procedure

To exercise any of the statutory rights described above, or to submit a data protection inquiry or complaint, please contact our designated Grievance & Data Protection Officer:

Response Timetable: We acknowledge receipt of all formal grievances within 48 business hours and provide a definitive substantive response within 30 calendar days.

If you remain unsatisfied with our resolution, you retain the right to lodge a complaint with the relevant supervisory body:

• India: Data Protection Board of India
• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• UAE: UAE Data Office / DIFC Commissioner of Data Protection

11. Children’s Data Policy

Our website and software services are exclusively intended for commercial enterprises, working professionals, and individuals aged 18 and older. We do not knowingly solicit or collect personal data from children. If we discover that personal data of a minor has been submitted unintentionally, we take prompt measures to delete such data from our records immediately.

12. Automated Decision-Making & Profiling

Arivinex does not use automated decision-making systems, algorithms, or automated profiling that produce legal effects or similarly significant effects concerning any visitor or data principal.

13. Consequences of Refusal to Provide Personal Data

You are under no statutory obligation to supply personal information to browse this website. However, where you choose not to provide necessary business contact details (e.g., name, business email, problem description), Arivinex will be unable to evaluate your inquiry, prepare commercial proposals, or execute an engagement agreement with your organization.

14. Cookie Notice & Browser Storage

This website uses only an essential first-party preference cookie. We do not load advertising trackers, behavioural pixels, or third-party marketing cookies. For granular specifics, please consult our Cookie Policy.

15. Amendments & Revision History

We may update this Privacy Notice periodically to reflect evolving regulatory directives or operational updates. When revisions occur, the updated policy will be published with a revised effective date. Material amendments affecting data handling practices will be highlighted on our website.