Privacy Policy

Notice

As a Data Fiduciary, Infronest is required to provide a clear and plainly worded privacy notice each time personal data is collected on the basis of consent. This notice must explain what personal data is being collected, the specific purposes for which it will be processed, the ways in which a Data Principal may exercise their rights, and the procedure for lodging complaints with the Data Protection Board of India. The notice must be made available in English or in any of the 22 languages listed in the Eighth Schedule of the Constitution of India, ensuring accessibility for all users.

The DPDP Rules, 2025 strengthen these requirements further by mandating that every privacy notice be self-contained and independently comprehensible — meaning a user must be able to understand it without reference to any other document. The Rules also specify the required content of such a notice, which must include the information set out in this Policy.

Verifiable Consent

The DPDP Act, 2023 mandates that before processing the personal data of a child or a person with a disability, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. The Act further prohibits any form of processing that is likely to cause harm to the Data Principal, and expressly bans the behavioural monitoring or targeting of advertising directed at children.

The DPDP Rules expand upon these protections by specifying the manner in which such parental or guardian verification must be carried out. However, the Rules also recognise that certain specific processing activities may be undertaken without obtaining prior parental consent, as follows:

• Child protection duties: Processing only to the extent necessary to fulfil a legal protection function
• Subsidy, benefit, or service issuance: Processing only as necessary for the provision of the relevant benefit or service
• Email account creation: Processing limited strictly to account creation and the use of email services
• Real-time location tracking: Processing only where necessary for the safety or security of the child
• Blocking of harmful content: Processing only to the extent required to prevent access to content, services, or advertising that is detrimental to children
• Child verification or due diligence: Processing only as necessary to carry out the required verification or confirmation

These exceptions define specific, bounded circumstances, such as child protection functions, the issuance of government subsidies or services, and email account creation, where the obligation to obtain prior parental consent does not apply, provided the processing remains strictly limited to the stated purpose.

Infronest is an enterprise B2B platform intended for professional use only. We do not knowingly collect personal data from individuals under 18 years of age, and our services are not directed at children.

Significant Data Fiduciary (SDF)

The DPDP Act, 2023 introduces the designation of a Significant Data Fiduciary (SDF) — a classification that the Government of India may apply to any Data Fiduciary based on an assessment of the volume and sensitivity of personal data it processes, as well as the risks associated with such processing. Entities designated as SDFs are subject to heightened obligations, including periodic data protection impact assessments and appointment of a Data Protection Officer.

The DPDP Rules further strengthen oversight of SDFs by requiring them to periodically share significant observations, findings, and identified compliance gaps with the Data Protection Board of India, thereby ensuring ongoing regulatory visibility and accountability.

Citizens' Rights

The DPDP Act, 2023 meaningfully empowers individuals as Data Principals. The following rights are specifically conferred:

• Right to access information about personal data being processed and the purposes thereof
• Right to correction of inaccurate or incomplete personal data, and erasure of data no longer required
• Right to grievance redressal through a clearly defined mechanism
• Right to nominate another individual to exercise data rights in the event of death or incapacity

The DPDP Rules reinforce these protections by requiring that Data Principals be able to submit requests through a publicly accessible mechanism — such as a website or application — using an identifier provided by the Data Fiduciary. Data Fiduciaries are further obligated to clearly publish the details of how such requests may be submitted, and to address all grievances within 90 days of receipt.

Breach Notification

The DPDP Act, 2023 defines a personal data breach as any unauthorised or accidental compromise of the confidentiality, integrity, or availability of personal data. Upon becoming aware of a breach, a Data Fiduciary is required to promptly notify the Data Protection Board of India and the affected Data Principals, providing sufficient detail to enable timely protective action.

The DPDP Rules expand on this obligation by requiring that such notification be made without any delay upon the Data Fiduciary becoming aware of the breach. In addition, the Data Fiduciary must submit a comprehensive detailed report to the Board within 72 hours of awareness, or within such extended period as may be approved by the Board in the circumstances.

Reasonable Safeguards

The DPDP Act, 2023 requires all organisations acting as Data Fiduciaries to implement appropriate technical and organisational security measures to protect personal data at every stage of processing. These safeguards must be proportionate to the nature of the data being processed and the risks associated with its processing. Importantly, the responsibility for data protection is not diminished when personal data is processed by a third-party data processor on the organisation's behalf — the Data Fiduciary remains accountable for ensuring that adequate safeguards are maintained throughout the data lifecycle.

1. Scope and Applicability

This Policy applies to:

• All individuals who visit, browse, or use our website at www.infronest.com
• Prospective, current, or former clients who engage Infronest for IT infrastructure management services or use the Infronest Enterprise Operations Platform
• Business representatives, vendors, partners, or contractors who share personal data with us in the course of commercial engagement
• Any individual whose personal data is processed by Infronest in connection with its business operations

This Policy is applicable to digital personal data collected online or collected offline and subsequently digitised, in accordance with the DPDP Act, 2023.

2. Personal Data We Collect

Infronest may collect the following categories of personal data, depending on the nature of your interaction with us:

Data Provided Directly by You

• Identity information: Full name, job title, designation, and organisation name
• Contact information: Email address, telephone number, postal or registered office address
• Professional information: Industry, company size, IT infrastructure requirements, and service preferences
• Communication records: Enquiries, support tickets, feedback, and correspondence via email, chat, or contact forms
• Financial information: Billing details, payment references, and invoicing information (processed through secure payment gateways; we do not store card or banking credentials directly)
• Account data: Name, email address, role, and department — provided during platform registration
• Server/IT data you enter: Asset records, server configurations, ticket content, and technical configurations — stored on your organisation's tenant-isolated instance

Data Collected Automatically

• Technical data: IP address, browser type and version, operating system, device identifier, screen resolution, platform type (web/desktop/mobile), OS version, and app version
• Usage data: Pages visited, time spent on pages, features used, session duration, click-through behaviour, and navigation patterns
• Cookie and tracking data: Session identifiers, preference cookies, and analytics cookies (subject to your cookie preferences)
• Crash reports: Anonymous error logs to diagnose bugs (no personal data included)
• Push notification tokens: Device tokens used to deliver alerts when you grant notification permissions

Data from Third Parties

• Business intelligence and lead data received from partners, referral channels, or publicly available professional directories
• Data shared by clients for the purpose of service delivery, including technical configurations, network diagrams, and system credentials (processed strictly under confidentiality obligations)

3. Legal Basis and Purpose of Processing

Infronest processes personal data on the following lawful bases, as recognised under the DPDP Act, 2023:

• Consent: Where you have explicitly provided your consent for processing for a specific, disclosed purpose — such as receiving marketing communications or subscribing to our newsletter
• Contractual Necessity: Where processing is required to perform a contract to which you are a party, or to take pre-contractual steps at your request — such as onboarding you as a client or delivering agreed services
• Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation applicable to Infronest under Indian law
• Legitimate Interest: Where processing is necessary for Infronest's legitimate business interests, provided such interests are not overridden by your rights and interests — such as fraud prevention, business analytics, and internal reporting

4. Specific Purposes of Processing

Your personal data may be processed for the following specific purposes:

• To respond to your enquiries and provide pre-sales information
• To deliver, manage, and support IT infrastructure services and the Infronest Enterprise Operations Platform contracted with you
• To authenticate users and maintain sessions securely
• To generate and issue invoices, process payments, and maintain financial records
• To communicate service updates, maintenance windows, and technical alerts
• To send marketing and promotional communications (only where you have opted in)
• To improve our website, service offerings, and user experience through analytics
• To diagnose crashes and improve platform reliability
• To comply with statutory, regulatory, and legal obligations
• To investigate complaints, resolve disputes, and enforce our contractual rights
• To prevent fraud, unauthorised access, and other security threats

5. Data Sharing and Disclosure

Infronest does not sell, rent, or trade your personal data to third parties. We may, however, share personal data in the following limited circumstances:

• Service Providers and Data Processors: We engage third-party vendors for cloud hosting, payment processing, customer support, and analytics. These entities access personal data solely to perform services on our behalf and are contractually bound to process data only in accordance with our instructions and applicable law
• Legal and Regulatory Authorities: We may disclose personal data when required to do so by law, court order, governmental directive, or regulatory body — including under provisions of the IT Act, 2000, the DPDP Act, 2023, or as directed by law enforcement agencies
• Business Transfers: In the event of a merger, acquisition, corporate restructuring, or sale of assets, your personal data may be transferred to the successor entity, subject to equivalent data protection obligations
• With Your Consent: We may share personal data with third parties for purposes not listed above if you have provided explicit consent for such sharing

All third-party data processors engaged by Infronest are subject to appropriate data processing agreements that ensure compliance with the DPDP Act, 2023 and applicable standards.

6. Cross-Border Data Transfers

Infronest may transfer personal data outside the territory of India in the course of service delivery, cloud operations, or vendor management. Any such transfer shall be conducted only to countries or territories notified by the Central Government of India as permissible destinations under the DPDP Act, 2023, or subject to such contractual safeguards as are required by applicable law.

We implement appropriate technical and organisational measures to ensure that your personal data receives a level of protection equivalent to that afforded under the DPDP Act wherever it is processed.

7. Data Retention

Infronest retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention principles apply:

• Client data: Retained for the duration of the contractual engagement and for a period of 5 years thereafter, or as required by applicable statutory obligations (e.g., under the Companies Act, 2013, or Income Tax Act, 1961)
• Website usage data: Retained for up to 12 months, unless a longer period is required for legal or security purposes
• Marketing communications data: Retained until you withdraw your consent or unsubscribe
• Legal and compliance records: Retained for the period prescribed by applicable law

Upon expiry of the applicable retention period, personal data shall be securely deleted or anonymised in a manner that renders identification of the Data Principal impossible.

8. Data Storage, Security & Platform Architecture

Infronest implements industry-standard technical and organisational security measures to safeguard your personal data from unauthorised access, disclosure, alteration, loss, or destruction. Our security practices include, but are not limited to:

• Organisation data stored on your private server or a logically isolated tenant instance enforced by database row-level security (RLS)
• Encryption of data in transit using TLS/SSL protocols and at rest using AES-256-GCM authenticated encryption with per-tenant data keys
• JWT authentication, HTTPS/TLS encryption, and role-based access controls (RBAC) limiting data access to authorised personnel on a need-to-know basis
• Passwords hashed using Argon2id
• Regular vulnerability assessments, security reviews, and code audits
• Incident detection and response mechanisms with defined escalation protocols
• Employee training on data protection and information security best practices
• An ISO 27001:2022 certified information security management system (Ranalysis Certification Pvt. Ltd., certified 9 October 2026)

In the event of a personal data breach that is likely to result in risk to the rights of Data Principals, Infronest shall notify the Data Protection Board of India within 72 hours of becoming aware of such breach, and shall notify affected Data Principals as required under the DPDP Act, 2023 and DPDP Rules, 2025.

9. Push Notifications

If you grant notification permissions on mobile or desktop, we may send server alerts, ticket updates, and security warnings. You can revoke permission at any time in your device settings.

10. Cookies and Tracking Technologies

Our website and platform use cookies and similar tracking technologies to enhance user experience, analyse traffic, and personalise content. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the operation of the website and cannot be disabled
• Performance and Analytics Cookies: Collect anonymised data about how visitors use our website, enabling us to improve its functionality
• Functionality Cookies: Remember your preferences and personalise your experience
• Marketing Cookies: Used to deliver relevant advertisements — deployed only with your explicit consent

On the Infronest platform, authentication tokens are stored in HttpOnly, Secure cookies that are not accessible to page JavaScript, reducing the risk of token theft, while localStorage holds only non-sensitive user preferences such as theme and language. No third-party tracking cookies are used on the platform.

You may manage your cookie preferences through your browser settings or through our cookie consent manager. Please note that disabling certain cookies may affect the functionality of our website.

11. Third-Party Links and Services

Our website may contain hyperlinks to third-party websites, platforms, or services that are not operated or controlled by Infronest. This Privacy Policy does not apply to such third-party websites. We encourage you to review the privacy policies of any third-party site you visit. Infronest accepts no responsibility or liability for the privacy practices or content of third-party websites.

12. Rights of Data Principals

As a Data Principal under the DPDP Act, 2023, you are entitled to exercise the following rights with respect to your personal data:

• Right to Access Information (Section 11, DPDP Act): You have the right to obtain confirmation as to whether Infronest processes your personal data, and to receive a summary of the data being processed and the purposes thereof
• Right to Correction and Erasure (Section 12, DPDP Act): You have the right to request correction of inaccurate or outdated personal data, and to request erasure of personal data that is no longer necessary for the stated purpose, subject to applicable legal obligations
• Right to Grievance Redressal (Section 13, DPDP Act): You have the right to have your grievances addressed by Infronest's designated Grievance Officer within a reasonable timeframe
• Right to Nominate (Section 14, DPDP Act): You have the right to nominate any individual to exercise your data rights in the event of your death or incapacity
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal

To exercise any of the above rights, please submit a written request to our Grievance Officer at the contact details specified in Section 13 of this Policy. We will respond to your request within a reasonable period and in any event not exceeding the timelines prescribed under applicable law.

If you are a user of an organisation's Infronest workspace, you may also contact your organisation's Infronest administrator to assist with data access or correction requests relating to your workspace account.

13. Grievance Redressal and Contact

Infronest has designated a Grievance Officer to address concerns, complaints, or requests relating to this Privacy Policy or the processing of your personal data. If you have any queries, concerns, or wish to exercise your rights as a Data Principal, please contact:

• Designation: Data Protection & Compliance Officer
• Email: privacy@infronest.com
• Working Hours: Monday to Friday, 10:00 AM – 6:00 PM IST
• Registered office:

Infronest Technologies Pvt. Ltd.

Shop No-121, Satyam Plaza

Shaheed Major Vikash Yadav Marg, Civil Lines

Gurugram, Haryana 122001, India

GSTIN: 06AAICI9364G1Z9

We shall endeavour to respond to your grievance within 30 (thirty) days of receipt. If you are dissatisfied with our response, you may escalate your complaint to the Data Protection Board of India, once constituted and operational under the DPDP Act, 2023.

14. Applicable Legal Framework

This Privacy Policy is governed by and construed in accordance with the laws of India, including but not limited to:

• The Digital Personal Data Protection Act, 2023 (DPDPA) — India's primary legislation governing the collection, processing, and protection of digital personal data
• The Digital Personal Data Protection Rules, 2025 — operative rules notified on 13 November 2025, providing procedural guidance for DPDPA compliance (full compliance deadline: 13 May 2027)
• The Information Technology Act, 2000 (IT Act) and the Information Technology (Amendment) Act, 2008
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — applicable to the extent not superseded by the DPDP Act
• ISO/IEC 27001:2022 — International Standard for Information Security Management Systems (Infronest is certified, October 2026)
• National Cyber Security Policy (NCSP), 2013 and subsequent guidelines issued by CERT-In

Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of courts in Gurugram, India.

15. EU/EEA and UK Visitors (GDPR)

Infronest is an Indian company and processes personal data primarily in India. Where the General Data Protection Regulation (EU) 2016/679 (GDPR) or the UK GDPR applies to personal data we process — for example, when we offer services to organisations in the European Economic Area or the United Kingdom — the following applies in addition to the rest of this Policy:

• Lawful bases. We process personal data on the bases of contract performance (providing the workspace and support), legitimate interests (securing the platform, preventing abuse, improving the Service), consent (marketing communications and optional cookies), and legal obligation (tax and accounting records).
• International transfers. Transfers of EEA/UK personal data to India are protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with supplementary technical measures described in Section 8. A copy of the relevant transfer mechanism is available on request from legal@infronest.com.
• Your rights. You may exercise the rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by contacting privacy@infronest.com. We respond within one month. You also have the right to lodge a complaint with your local supervisory authority.
• Representative. Where Article 27 GDPR requires it, Infronest will appoint a representative in the Union; the representative's contact details will be published in this section once appointed.

16. California Residents (CCPA/CPRA)

If you are a California resident and the California Consumer Privacy Act, as amended by the CPRA, applies to our processing of your personal information: we collect the categories of personal information described in Section 2, for the purposes described in Sections 3 and 4. We do not sell personal information and do not share it for cross-context behavioural advertising. You have the rights to know, access, correct and delete personal information, and to not be discriminated against for exercising those rights. Submit requests to privacy@infronest.com; we verify requests before acting on them and respond within the statutory period. Authorised agents may submit requests on your behalf with proof of authorisation.

17. Amendments to this Policy

Infronest reserves the right to amend, update, or revise this Privacy Policy at any time to reflect changes in law, technology, or our business practices. Material changes to this Policy will be communicated via a prominent notice on our website and, where required under applicable law, by direct notification to affected Data Principals.

Your continued use of our website or services following the publication of an updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically to stay informed of how we protect your personal data. Changes will also be reflected by the "Last updated" date above and, where appropriate, via in-app announcement.

© 2026 Infronest Technologies Pvt. Ltd. All rights reserved.