Privacy Policy
At Cypherox Technologies, we are committed to protecting your privacy and upholding the highest standards of data confidentiality. This Privacy Policy details how we collect, process, safeguard, and respect your personal information and enterprise data across our website and engineering solutions.
Controller
The controller for personal data collected through our website for Germany and the EU, within the meaning of the GDPR and the German Federal Data Protection Act (BDSG), is:
| Detail | Information |
|---|---|
| Organisation | Cypherox Technologies Pvt. Ltd |
| [email protected] | |
| Website | www.cypherox.de |
Cypherox has no office or establishment in Germany or elsewhere in the EU.
Representation in the EU
Cypherox is not established in the EU. You can contact us with any question about how we handle your data, and to use your rights, at [email protected].
Data protection contact
For all privacy questions, write to [email protected].
Personal data we collect
| Category | Examples | When collected |
|---|---|---|
| Identity data | First and last name, job title, company name | Contact forms, enquiries, onboarding |
| Contact data | Email address, phone number, postal address | Contact forms, calls, emails |
| Technical data | IP address, browser type, device type, operating system, referral source | Automatically, via cookies and analytics (with consent where required) |
| Usage data | Pages viewed, links clicked, session duration | Automatically during website visits |
| Communication data | Content of emails, enquiries, messages, call notes | When you contact us or we communicate during a project |
| Financial data | Invoice details, payment records, VAT ID (we do not store card numbers) | Invoicing and payment |
| Project data | Files, documents, content and assets shared for project delivery | During active engagements |
| Marketing data | Your preferences for marketing communications | When you opt in or contact us |
We do not knowingly collect special categories of data (Art. 9 GDPR, such as health or biometric data) or data from people under 18. If you think we have collected such data, please contact us at once.
How we collect your data
- Directly from you: when you use our contact form, book a call, email us or engage our services
- Automatically: through cookies, similar technologies and analytics tools as you use our website, if you consent
- From third parties: through business introductions, referrals, professional networks such as LinkedIn, or public business directories
- During projects: data and content you share with us while we work together
Purposes and legal bases
We process your personal data only where Art. 6 GDPR allows it:
| Answering enquiries and preparing quotations | Pre-contractual steps, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Delivering services and managing projects | Contract, Art. 6(1)(b) |
| Invoicing and payment | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Accounting and tax records | Legal obligation, Art. 6(1)(c) |
| Marketing emails and newsletters | Consent, Art. 6(1)(a); § 7 UWG |
| Analytics, functional and marketing cookies | Consent, Art. 6(1)(a) and § 25(1) TDDDG |
| Strictly necessary cookies | Legitimate interests, Art. 6(1)(f); § 25(2) TDDDG |
| Improving our services and website | Legitimate interests, Art. 6(1)(f) |
| Preventing fraud and securing our systems | Legitimate interests, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests, Art. 6(1)(f) |
Our legitimate interests are running and securing our business, answering business enquiries and enforcing our rights. You may object to processing based on legitimate interests (see section 10).
Providing data is voluntary. Without the data needed for an enquiry or a contract, however, we cannot answer you or perform the services. We do not use automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).
We will not use your data for incompatible purposes without telling you and, where needed, asking for your consent.
Recipients of your data
We do not sell your personal data. We share it only in these cases:
- Service providers (processors): cloud hosting, payment, project management and analytics providers that process data for us under a data processing agreement (Art. 28 GDPR)
- Professional advisers: lawyers, accountants and auditors, bound by professional confidentiality
- Subcontractors: specialist developers and designers who help deliver projects and are bound by confidentiality and data protection duties
- Authorities: where the law, a court order or a lawful official request requires it
- Business transfers: in a merger, acquisition or sale of assets, with equivalent protection
Transfers outside the EU
We are based outside the EU, and our team and systems are in India. Your data is therefore processed in India and, through some providers, in other countries. India has no EU adequacy decision.
Where data is transferred to us or onward to a third country, we protect it with one of these safeguards under Chapter V GDPR:
- the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with a transfer impact assessment and supplementary measures where needed
- for US providers, certification under the EU-US Data Privacy Framework
- in limited cases, your explicit consent, after we inform you of the risks
You can request a copy of the safeguards by writing to [email protected].
How long we keep your data
We keep personal data only as long as needed for the purpose it was collected for. These are our standard periods:
| Data type | Retention period | Reason |
|---|---|---|
| Contracts, project records and business correspondence | 6 years from the end of the year the contract ended | Statutory retention duties and limitation periods |
| Accounting records and invoices | 8 years from the end of the financial year | Tax and accounting law |
| Enquiries and contact form data | 12 months after last contact, if no contract follows | Legitimate interests (follow-up) |
| Marketing consent records | Until you withdraw consent, plus proof of consent for 3 years | Consent, evidence of consent |
| Website analytics data | Up to 14 months | Consent |
| Job application data | 6 months after a rejection | Legitimate interests (defence against claims) |
After these periods, we delete or anonymise the data. Legal holds can extend them.
Your rights
Under the GDPR you have these rights:
- Access (Art. 15): receive a copy of your personal data and information about how we use it
- Rectification (Art. 16): have inaccurate or incomplete data corrected
- Erasure (Art. 17): have your data deleted where we no longer need it or you withdraw consent, unless a legal retention duty applies
- Restriction (Art. 18): have processing paused in certain cases, for example while you contest accuracy
- Data portability (Art. 20): receive your data in a structured, machine-readable format where processing is based on consent or a contract
- Objection (Art. 21): object at any time to processing based on legitimate interests, and to direct marketing. For direct marketing, we stop at once
- Withdrawal of consent (Art. 7(3)): withdraw consent at any time, with effect for the future
- No solely automated decisions (Art. 22): see section 6
To use your rights, email [email protected]. We reply within one month. In complex cases we may extend this by up to two further months and will tell you why. We may need to verify your identity first. Requests are free, unless they are manifestly unfounded or excessive.
Cookies and similar technologies
We use cookies and similar technologies only as the German Telecommunications Digital Services Data Protection Act (TDDDG) and the GDPR allow. A cookie is a small file stored on your device.
| Cookie type | Purpose | Consent required? |
|---|---|---|
| Strictly necessary | Security, form submission, session management, saving your cookie choice | No |
| Analytics | Understand how visitors use our website, for example Google Analytics | Yes |
| Functional | Remember your preferences | Yes |
| Marketing | Remarketing and targeted advertising | Yes |
When you first visit our website, a consent banner lets you accept all, reject all or choose by category. Rejecting is as easy as accepting. We load non-essential cookies only after you consent. You can change or withdraw your choice at any time through the cookie settings link in the website footer. We record your choice as proof of consent.
You can also block cookies in your browser settings. Blocking strictly necessary cookies may limit what the website can do.
Marketing communications
We send marketing emails and newsletters only with your consent, confirmed by a double opt-in, or as § 7(3) UWG allows for existing customers: we received your address in connection with a sale, we advertise our own similar services, and you have not objected.
Every marketing email contains an unsubscribe link. You can also opt out by:
- clicking "unsubscribe" in any marketing email
- emailing [email protected] with the subject "Unsubscribe"
You can opt out at any time, without costs other than transmission costs at basic rates. Opting out does not stop service-related messages about your project or contract.
Data security
We protect your data with appropriate technical and organisational measures (Art. 32 GDPR) against unauthorised access, loss, alteration and disclosure. These include:
- encryption of data in transit (TLS/SSL) and at rest where appropriate
- access controls and role-based permissions
- regular security assessments and code reviews
- staff training on data protection and information security
- secure deletion of data we no longer need
If a personal data breach is likely to put people's rights at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it (Art. 33 GDPR). If the risk is high, we inform the affected individuals without undue delay (Art. 34 GDPR).
Third-party links
Our website may link to third-party sites, such as partner platforms, review sites and social networks. This policy does not cover them. We are not responsible for their content or privacy practices, so please read their privacy policies.
Children
Our website and services are aimed at business professionals and not at anyone under 18. We do not knowingly collect personal data from children. If we learn that we have, we will delete it promptly. If you think we hold a minor's data, email [email protected].
Changes to this policy
We may update this policy to reflect changes in our practices, the law or regulatory guidance. We publish the new version on our website with an updated date. For material changes, we notify active clients and newsletter subscribers by email at least 14 days before they take effect.
Last updated:14 October 2026
Right to lodge a complaint
Please contact us first at [email protected]. We investigate and reply within one month.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). You can choose the authority in the EU member state where you live or work, or where the alleged infringement took place. In Germany, these are the Federal Commissioner for Data Protection and Freedom of Information BfDI and the data protection authorities of the federal states.
Contact
For privacy questions, access requests or to use your rights:
| Detail | Information |
|---|---|
| [email protected] | |
| Website | www.cypherox.de |
We do not have an office in Germany. Please contact us by email.