This Global Privacy Policy & Data Governance Framework ('Policy') governs the processing and safeguarding of personal, operational, and technical data collected by Qualtriq Software Solutions Pvt. Ltd. ('Qualtriq', 'we', 'us', or 'our'), a corporate software engineering and cloud infrastructure firm headquartered in New Delhi, India.

Data Controller Status: For data collected through our corporate website, consultation inquiries, and commercial client communications, Qualtriq acts as the Data Controller under the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the General Data Protection Regulation (GDPR, EU), and the California Consumer Privacy Act (CCPA/CPRA).

Data Processor Status: When engineering, deploying, or managing cloud platforms, database clusters, or custom software for our enterprise clients, Qualtriq acts strictly as a Data Processor or Service Provider, processing data solely in accordance with mutually executed Statements of Work (SOW) and Data Processing Addendums (DPA).

We adhere to strict data minimization principles, collecting only information necessary to deliver high-performance engineering services and maintain enterprise platform security. Data categories include:

1. Business & Contact Data: Name, corporate email address, phone number, company name, job title, and commercial invoicing details provided during consultation bookings or contract execution.

2. Technical & Network Telemetry: IP addresses, browser user-agent tokens, device operating system versions, referring URLs, and anonymized access timestamps gathered automatically via secure server logs for intrusion detection and load balancing.

3. Project & Staging Data: API endpoints, staging credentials, architectural topologies, and test datasets shared under mutual non-disclosure agreements (NDAs) to facilitate sprint delivery, container integration, and automated QA testing.

Qualtriq processes information only when backed by an established lawful basis recognized under global privacy regulations:

• Contractual Necessity: Processing required to formulate architecture blueprints, execute sprint deliverables under an SOW, provision cloud instances, and manage commercial invoicing.

• Legitimate Business Interests: Monitoring platform security, detecting cyber threats, optimizing server load distribution, and maintaining disaster recovery failover pipelines without overriding your fundamental privacy rights.

• Statutory & Regulatory Compliance: Retaining accounting ledgers, invoices, and transaction logs in compliance with Indian taxation laws (GST/TDS) and global corporate reporting mandates.

• Explicit Consent: Where required (such as subscribing to technical architecture dispatches or optional analytics cookies), you may withdraw consent at any time.

Qualtriq enforces zero cross-tenant contamination across all development pipelines. Client code repositories, database staging environments, and architectural schematics are strictly isolated within dedicated, access-controlled virtual private clouds (VPCs).

Confidentiality Safeguards: All Qualtriq engineers, DevOps architects, and project leads operate under perpetual, legally binding non-disclosure agreements. Access to client source code and production credentials requires multi-factor authentication (MFA) and is governed by strict Role-Based Access Control (RBAC) on a need-to-know basis.

Zero Data Monetization: We categorically pledge that Qualtriq does not sell, rent, monetize, or trade client source code, proprietary algorithms, customer databases, or user telemetry to any third-party data broker, ad network, or external entity under any circumstances.

To provide world-class engineering and resilient deployment infrastructure, Qualtriq partners with audited enterprise subprocessors bound by strict data security addendums (DPAs):

• Cloud Infrastructure: Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure for dedicated container orchestration, virtual servers, and edge caching.

• Persistent Data & DevOps: MongoDB Atlas, PostgreSQL/Neon, and GitHub/GitLab for secure database clustering, version control, and containerized CI/CD pipelines.

• Transactional Processing: Stripe, Razorpay, and authorized banking partners for corporate payment clearing with full PCI-DSS Level 1 compliance.

We maintain an active registry of all approved subprocessors. Subprocessors are vetted to ensure equivalence with ISO/IEC 27001, SOC-2 Type II, and GDPR standards.

Qualtriq applies defense-in-depth cybersecurity engineering across all layers of our digital ecosystem:

1. Cryptographic Protection: All data in transit is encrypted using TLS 1.3 with Perfect Forward Secrecy (PFS). All persistent databases, backup snapshots, and staging volumes are encrypted at rest using AES-256 with managed Key Management Services (KMS).

2. Vulnerability Management: Automated static application security testing (SAST) and software composition analysis (SCA) run continuously in our CI/CD pipelines to detect code vulnerabilities and dependency risks prior to production merges.

3. Incident Response SLA: In the unlikely event of a verified data compromise affecting client information, Qualtriq will notify affected clients within seventy-two (72) hours of verification in accordance with applicable statutory standards.

As an international engineering consultancy based in India serving global enterprises across North America, Europe, the Middle East, and Asia-Pacific, Qualtriq facilitates cross-border technical collaboration under recognized legal safeguards.

International Transfer Mechanisms: Where personal data originating in the European Economic Area (EEA), UK, or Switzerland is transferred to India, we execute Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring adequate technical and contractual protection.

Sovereign Data Residency: For enterprise clients in regulated verticals (such as FinTech, Healthcare, or Public Sector), Qualtriq engineers localized cloud topologies ensuring data residency strictly within specified sovereign boundaries (e.g., AWS Mumbai for India, AWS Frankfurt for EU, or AWS US-East for North America).

Qualtriq retains operational data only for the duration required to fulfill contractual obligations, defend against legal claims, or comply with statutory accounting requirements.

• Staging & Ephemeral Test Logs: Automated continuous integration artifacts, ephemeral test containers, and staging server logs are systematically purged after thirty (30) calendar days.

• Contractual & Financial Records: Invoices, signed SOWs, and transaction audit trails are retained for seven (7) years in accordance with Indian corporate and taxation statutes.

• Post-Handover Repository Decommissioning: Following milestone completion and final code handover, staging credentials and client sandbox data are securely wiped from our internal servers within sixty (60) days.

Regardless of your geographical location, Qualtriq provides transparent mechanisms to exercise your statutory data privacy rights:

• Right of Access & Portability: Request confirmation of whether we process your data and receive a machine-readable export (JSON/CSV) of your personal records.

• Right to Rectification: Correct any inaccurate, incomplete, or outdated personal contact or billing details.

• Right to Erasure ('Right to be Forgotten'): Request irreversible cryptographic deletion of your personal data, subject to non-waivable statutory tax or legal retention requirements.

• Right to Restrict or Object: Restrict certain processing activities or opt out of direct technical communications at any time.

To exercise any privacy right, contact our Data Protection Officer at dpo@qualtriq.com. We respond to all verified statutory requests within thirty (30) calendar days at zero charge.

Our website utilizes minimal, privacy-centric telemetry to ensure reliable page delivery and Core Web Vitals performance:

• Strictly Necessary Tokens: Essential for secure navigation, CSRF token validation, load distribution, and preserving dropdown or theme preferences across sessions.

• Anonymized Analytics: Privacy-preserving aggregated telemetry (such as page response latencies and server HTTP status codes) that does not fingerprint individual devices or track cross-site browsing behavior.

• Zero Third-Party Ad Pixels: Qualtriq does not install Facebook Meta pixels, Google behavioral advertising tags, or third-party retargeting scripts that harvest user profiles across the web.

You can configure your browser to block or alert you about cookies; however, certain interactive scoping tools and estimators may experience reduced functionality if session storage is disabled.