Privacy

Data Privacy & Protection Policy

Version 5.0 · Effective May 2023. How we handle personal data for our clients, their users, our team and visitors to this site.

Who we are

Altherix is a brand of Altherix Codecraft (OPC) Private Limited, a One Person Company incorporated in India (CIN U62011TZ2026OPC041408), registered office D No 5/1247-N1, Stanely Park, Ottupattarai, Coonoor, Nilgiris, Tamil Nadu 643105. In this policy, "Altherix", "we" and "us" mean that company.

This website

altherix.in sets no cookies and loads no analytics, advertising or tracking scripts. Our fonts and images are served from this site.

The contact form does not send anything to our servers. It opens your own email app with your message addressed to contact@altherix.in, and you decide whether to send it. If you do, we use your message and contact details only to reply and to discuss the work you asked about.

1. Introduction

Altherix is committed to protecting the privacy and security of personal data and sensitive information entrusted to us by our clients, partners, and service users. This Data Privacy & Protection Policy outlines our principles, practices, and obligations regarding the collection, processing, storage, and protection of personal and confidential data in accordance with applicable data protection regulations including the General Data Protection Regulation (GDPR), the Indian Information Technology Act, 2000, and other relevant data privacy laws.

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person (data subject), directly or indirectly.
Processing: Any operation performed on personal data such as collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, or erasure.
Data Controller: The entity that determines the purposes and means of processing personal data (e.g., Altherix's client).
Data Processor: The entity that processes personal data on behalf of the controller (e.g., Altherix when acting as a service provider).
Data Subject: The individual to whom personal data relates.
Breach: Any unauthorized or accidental access, disclosure, loss, alteration, or destruction of personal data.

3. Scope

This policy applies to all personal data processed by Altherix in connection with the provision of software development services, system implementation, maintenance, and support. It covers data in any format (electronic, paper, or other) and includes information about employees, contractors, clients, end users, and third parties.

4. Data Processing Principles

Altherix adheres to the following core principles in all data processing activities:

Lawfulness, Fairness & Transparency: Data is processed lawfully, fairly, and transparently with respect to the data subject.
Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
Data Minimization: Only necessary and relevant personal data is collected and processed.
Accuracy: Personal data is kept accurate and up-to-date; reasonable steps are taken to erase or correct inaccurate data.
Storage Limitation: Personal data is kept in a form which permits identification of data subjects for no longer than necessary.
Integrity & Confidentiality: Personal data is processed securely with appropriate protection against unauthorized access, loss, or damage.
Accountability: Altherix is responsible for demonstrating compliance with these principles.

5. Types of Data Collected

5.1 Employee & Contractor Data

Name, contact information, employment history
Tax identification numbers, bank details
Performance records, training history

5.2 Client & End-User Data

Business contact information
Transactional and usage data related to services provided
Communication records (emails, logs)

5.3 Third-Party & Sensitive Data

Any personal data of third parties included in client data or business documents
Financial, health, or other sensitive categories processed only with explicit consent and appropriate safeguards

6. Legal Basis for Processing

Altherix processes personal data only when we have a lawful basis, including:

Contractual Necessity: Data processing required to fulfill contractual obligations
Legal Obligation: Compliance with laws, regulations, and government requests
Legitimate Interest: Processing necessary for Altherix's legitimate business operations (security, fraud prevention)
Consent: Explicit consent from the data subject for specific purposes
Vital Interest: Protection of life or health in emergency situations

7. Data Security & Protection Measures

Altherix implements comprehensive technical, organizational, and administrative safeguards to protect personal data:

7.1 Technical Measures

Encryption: Sensitive data encrypted in transit (TLS/SSL) and at rest (AES-256)
Access Control: Role-based access controls (RBAC) limiting data access to authorized personnel
Firewalls & Intrusion Detection: Network security infrastructure to prevent unauthorized access
Secure Backups: Regular encrypted backups with secure recovery procedures
Vulnerability Management: Regular security assessments, penetration testing, and patch management

7.2 Organizational Measures

Data Protection Training: All employees receive regular data privacy and security training
Access Restrictions: Data access restricted to personnel with legitimate business needs
Confidentiality Agreements: All employees and contractors sign confidentiality agreements
Incident Response Plan: Procedures to detect, investigate, and remediate security breaches

7.3 Administrative Measures

Data Inventory: Comprehensive record of personal data processing activities
Data Processing Agreements: Formal Data Processing Agreements (DPA) with all processors and third parties
Privacy Impact Assessments: Conducted for high-risk processing activities
Audits & Monitoring: Regular audits of data protection practices and compliance

9. International Data Transfers

Where personal data is transferred outside the country of origin, Altherix ensures adequate safeguards:

Standard Contractual Clauses (SCCs) for transfers to countries without adequate protection
Binding Corporate Rules (BCRs) for intra-group transfers
Adequacy decisions recognized by relevant data protection authorities
Explicit consent from data subjects where required

10. Data Subject Rights

Data subjects have the following rights, which Altherix respects and facilitates:

Right of Access: Request and obtain confirmation of personal data processing and receive a copy
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of personal data (subject to legal retention requirements)
Right to Restrict Processing: Request limitation of processing for specific purposes
Right to Data Portability: Request data in structured, machine-readable format
Right to Object: Object to processing on grounds of legitimate interest or direct marketing
Right Not to be Subject to Automated Decision-Making: Request human review of automated decisions

Requests to exercise these rights should be directed to our Data Protection Officer (contact details in Section 13). We will respond within 30 days.

11. Data Retention & Deletion

Altherix retains personal data only for as long as necessary to fulfill the purposes for which it was collected, unless:

Required by applicable law or regulation
Necessary to establish, exercise, or defend legal claims
Retained for legitimate business purposes with reduced access controls

Upon deletion, personal data is securely erased or anonymized such that it cannot be reconstructed.

12. Data Breach Notification

In the event of a data breach that may compromise the rights or freedoms of data subjects, Altherix will:

Promptly notify affected data subjects (without undue delay, where legally required)
Notify relevant regulatory authorities where legally mandated
Provide details of the breach, impact assessment, and mitigation measures
Conduct post-breach investigation and implement corrective actions

Altherix maintains an incident response plan and breach notification procedures aligned with GDPR and other applicable regulations.

13. Data Protection Officer

Altherix has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and applicable data protection laws.

For data privacy inquiries, complaints, or to exercise data subject rights, email contact@altherix.in with the subject “Data protection request”. Your message goes to the Data Protection Officer.

14. Compliance & Audits

Altherix complies with all applicable data protection regulations including:

General Data Protection Regulation (GDPR): EU/EEA
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: India
Digital Personal Data Protection Act (DPDPA), 2023: India
California Consumer Privacy Act (CCPA) and other US state privacy laws

Altherix conducts regular audits and assessments to ensure compliance and maintains comprehensive documentation of all processing activities.

15. Policy Updates

This policy is reviewed annually and updated as necessary to reflect changes in laws, regulations, and best practices. Any material changes will be communicated to data controllers and stakeholders. Continued use of Altherix services constitutes acceptance of the updated policy.

16. Acknowledgment

By entering into a service agreement with Altherix, clients acknowledge that they have reviewed and understood this Data Privacy & Protection Policy and agree to be bound by its terms.