Privacy Notice
Version 1.0 · Effective 6 November 2026 · CyberTrustWorks LLP
We respect your privacy. This notice explains what personal data CyberTrustWorks collects through this website, why, how long we keep it, who we share it with, and how you can withdraw consent, exercise your rights or complain to the Data Protection Board of India.
1. Who we are
CyberTrustWorks LLP ("CyberTrustWorks", "we", "us"), Flat No 5, Shruti Apartment, DP Road, Guruganesh Nagar, Kothrud, Pune, Maharashtra 411038, India. Phone: +91 97650 20200. We are the Data Fiduciary for the personal data described in this notice under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.
2. Personal data we collect
- Identity and contact details – full name, first and last name, work or business email, phone number, company, role or job title.
- Enquiry details – the service you are interested in, your message, and demo request details.
- Report profile details – company size, industry and country.
- AI Chat content – the messages you type and your conversation history.
- Technical data – IP address, device and browser type, timestamps, pages visited, and signals from our bot-protection 'Security check'.
- Communications – emails and calls you make to sales@cybertrustworks.com or +91 97650 20200.
- Consent records – which consents you gave or withdrew, and when.
3. Why we use it
- To respond to your enquiries and to assessment or consultation requests.
- To deliver downloads you request (the DPDP checklist and the CISO Report).
- To arrange product demos (vCISO Platform, Fussion_GRC).
- To provide the AI Security Consultant chat.
- To send marketing communications – only if you opt in.
- To protect the website against bots, fraud and misuse.
- To keep records of consent and meet our legal obligations.
- To produce aggregated statistics that do not identify you.
4. What this enables
Replies to your enquiries, security assessments and consultations, downloadable research and checklists, product demos, AI chat assistance and, if you opt in, newsletters and event invitations.
5. What is required and what is optional
Fields marked * on each form are needed to provide that specific service. All other fields and every marketing consent are optional. Declining optional items never affects the service you asked for.
6. Who receives your data
Our authorised staff and partners, and service providers who process data on our instructions under written contracts: We use Lovable Cloud (hosting and database), Lovable Emails (email delivery) and Lovable AI Gateway (Google Gemini) (AI chat). We do not sell personal data. We may disclose data where a law, court or government authority (including CERT-In) requires it.
7. How long we keep it
- Enquiry and lead data: while your enquiry is open and for 12 months after our last interaction, unless you become a client (then our client contract applies).
- Download records: 12 months.
- AI Chat conversations: 12 months from your last message, or earlier if you delete them.
- Rights requests: 3 years after closure.
- Marketing preferences: until you withdraw. We keep only your email on a suppression list, so that we respect your opt-out.
- We erase data once its purpose has been served, unless a law requires us to keep it longer.
9. Notices for specific forms
Each form on this website shows a short notice and a full notice explaining exactly what that form collects. They are reproduced below.
10. Consent records and logs
We keep a record of every consent you give or withdraw (what you agreed to, the notice version, the time and the page) and related technical logs for at least one year from the date of processing, as required by Rule 8(3) of the DPDP Rules, 2025, and for up to 3 years where needed to show that valid consent was obtained (Section 6(10)). After that they are erased.
11. Processing outside India
Some of our service providers may store or process personal data outside India. We transfer personal data only to countries that are not restricted by the Central Government under Section 16 of the DPDP Act, and under written contracts that require the provider to protect it.
12. Security and breaches
We protect personal data with reasonable security safeguards, including encryption in transit, access controls, and logging and monitoring (Section 8(5); Rule 6). If a personal data breach occurs, we will inform affected individuals and the Data Protection Board of India as required (Section 8(6); Rule 7), and CERT-In where applicable.
13. How to withdraw consent
You can withdraw your consent at any time, as easily as you gave it. Use "Manage consent" in the website footer (https://cybertrustworks.com/privacy/requests), the unsubscribe or withdraw link in any email from us, or write to sales@cybertrustworks.com. You do not need to give a reason. Withdrawal does not affect processing carried out before you withdrew (Section 6(4)). After withdrawal we will stop processing, and make our service providers stop, within a reasonable time, except where the law requires us to keep the data (Section 6(6)). When Consent Managers registered with the Data Protection Board of India become available, you may also give, manage or withdraw consent through one of them.
14. Your rights
- Get a summary of the personal data we process about you, our processing activities, and the identities of others with whom it has been shared (Section 11).
- Have your personal data corrected, completed, updated or erased (Section 12).
- Have your grievances addressed by us (Section 13).
- Nominate another person to exercise your rights if you die or become incapable (Section 14).
- To exercise any right, use https://cybertrustworks.com/privacy/requests or email sales@cybertrustworks.com. We will respond within 30 days, and in any case within the period prescribed under the DPDP Rules, 2025 (not exceeding 90 days).
15. Grievances and the Data Protection Board
If you are unhappy with how we use your personal data, please contact our Grievance Officer first. If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India. The DPDP Act requires you to use our grievance process before approaching the Board (Section 13(3)).
16. Your duties
When sharing personal data with us, please give accurate information, do not impersonate anyone, do not share other people's personal data without their authority, and do not file false or frivolous grievances (Section 15).
17. Children
Our website and services are for business users aged 18 and above. We do not knowingly collect personal data of children. If you believe a child has given us personal data, contact us and we will erase it.
18. Contact our Grievance Officer
Ajay Devnath, Grievance Officer & Data Protection Contact. Email: sales@cybertrustworks.com. Phone: +91 97650 20200. Post: CyberTrustWorks LLP, Flat No 5, Shruti Apartment, DP Road, Guruganesh Nagar, Kothrud, Pune, Maharashtra 411038, India (Attn: Grievance Officer).
19. Language
This notice is available in English. You can ask for it in Hindi, Marathi or any other language listed in the Eighth Schedule to the Constitution of India by writing to sales@cybertrustworks.com (Section 5(3)).