Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide to us through various channels:

Category	Data Elements
Consultation & Inquiry	Full name, email address, phone number, company name, job title, industry sector, project description, estimated budget range, preferred timeline
Service Engagement	Organisational structure, operational workflows, technology infrastructure documentation, system architecture, database schemas, business process specifications, project requirements
Credentials & Access	Server credentials, hosting account details, API keys, third-party service logins, database connection strings, cloud platform access, domain registrar details
Career Applications	Resume/CV, cover letter, portfolio links, work samples, professional references, educational qualifications, employment history, salary expectations
Communications	Correspondence via email, messaging platforms, video conferencing, project management tools, and any other communication channel used during an Engagement

1.2 Information Collected Automatically

When you visit our Website, we may automatically collect certain technical and usage data through cookies, server logs, and similar technologies:

• Internet Protocol (IP) address and approximate geographic location derived therefrom
• Browser type and version, operating system, device type, and screen resolution
• Pages visited, date and time of access, duration of visit, referring URL, and exit page
• Click patterns, scroll depth, and user interaction events on the Website

1.3 Information from Third-Party Sources

We may receive limited information about you from third-party sources, including professional networking platforms (such as LinkedIn), business directories, referral partners, and publicly available sources, solely for the purpose of responding to business inquiries or evaluating potential engagements.

2. How We Use Your Information

We process the information we collect for the following purposes and on the following legal bases:

Purpose	Legal Basis
Respond to inquiries, prepare proposals, and schedule consultations	Performance of a contract / pre-contractual steps
Deliver contracted services, manage milestones, communicate progress, and provide post-delivery support	Performance of a contract
Process and manage system credentials and access data required for service delivery	Performance of a contract
Evaluate career applications, conduct recruitment, and communicate hiring decisions	Legitimate interest / consent
Improve our Website, analyse usage patterns, and enhance user experience	Legitimate business interest
Develop anonymised case studies and testimonials (with Client consent)	Consent
Send relevant updates about our services, articles, or industry insights	Consent (with opt-out available)
Comply with applicable laws, regulations, tax obligations, and respond to lawful governmental requests	Legal obligation
Protect against fraudulent, unauthorised, or illegal activity on our systems	Legitimate business interest

3. Client Credentials & System Access

Given the nature of our services as an embedded technology partner, Clients may provide us with access credentials to their systems, platforms, servers, databases, and third-party service accounts. We recognise the critical sensitivity of such information and commit to the following safeguards:

• Purpose limitation: Credentials are used exclusively for the purpose of performing the work described in the applicable Statement of Work (SOW) or Master Services Agreement (MSA). No credential shall be used for any purpose outside the defined scope of work.
• Access control: Credentials are accessible only to authorised team members directly assigned to the Client's project. Access is granted on a need-to-know and least-privilege basis.
• Secure storage: All credentials are stored in encrypted password management systems with multi-factor authentication. Credentials are never stored in plaintext, code repositories, project documentation, email, or messaging platforms.
• Credential rotation: We strongly recommend that Clients rotate all shared credentials upon completion or termination of an Engagement. Upon Client request or upon termination of the Engagement, we shall permanently delete all stored credentials and provide written confirmation of such deletion within seven (7) business days.
• No credential sharing: Client credentials are never shared with third parties, subcontractors, or any personnel not directly authorised under the applicable Engagement, unless the Client provides explicit prior written consent.
• Breach notification: In the event of a security incident involving Client credentials, we shall notify the affected Client within twenty-four (24) hours of becoming aware of the incident, along with a detailed assessment of the scope and remediation steps taken.

4. Protection of Business Data & Proprietary Information

As an embedded technology partner, we gain deep visibility into our Clients' business models, operational strategies, competitive positioning, revenue structures, and proprietary methodologies. We treat all such Business Data with the highest degree of confidentiality:

• Non-disclosure by default: All Business Data shared during an Engagement is treated as confidential information, regardless of whether it is formally marked as such. Our obligations of confidentiality apply from the moment information is shared and survive the termination of the Engagement.
• Segregation of Client data: Business Data belonging to one Client is never commingled with, disclosed to, or used in connection with the work of another Client. We maintain strict logical and organisational separation of all Client information.
• Internal access restrictions: Business Data is accessible only to the specific team members assigned to the relevant Engagement. Internal discussions and training exercises use anonymised or synthetic data and never reference identifiable Client information.
• No competitive use: We shall not use any Client's Business Data, business model, or proprietary methodology to benefit a competing business, develop competing products or services, or gain any commercial advantage outside the scope of the Engagement.
• Residual knowledge: Nothing in this Policy restricts our right to use general knowledge, skills, experience, and expertise (excluding specific Confidential Information) acquired during the course of an Engagement, provided such use does not disclose or derive from any identifiable Client Business Data.

5. Confidentiality & Non-Disclosure

Ascendate maintains rigorous non-disclosure obligations as a core operating principle:

• Employee and contractor obligations: All employees, contractors, and consultants engaged by Ascendate are required to execute binding Non-Disclosure Agreements (NDAs) as a condition of their engagement. These NDAs cover all Client information encountered during the course of their duties.
• Mutual NDA with Clients: We encourage the execution of a Mutual Non-Disclosure Agreement at the commencement of every Engagement. Where a Client-specific NDA is executed, its terms shall supplement the confidentiality obligations described in this Policy. In the event of any conflict, the terms of the executed NDA shall prevail.
• Duration: Unless otherwise specified in a signed NDA or service agreement, our obligation of confidentiality with respect to a Client's Confidential Information shall survive for a period of three (3) years following the termination or expiration of the applicable Engagement. For trade secrets, obligations continue for as long as the information retains its trade secret status.

6. Sharing & Disclosure

We do not sell, rent, lease, or trade your Personal Data or Business Data to any third party. We may share information only in the following limited and controlled circumstances:

Recipient	Purpose & Safeguards
Authorised Service Providers	Cloud hosting, email delivery, analytics, project management tools — bound by data processing agreements with security and confidentiality requirements
Subcontractors	Specialised components of contracted work — subject to Client's prior written consent and binding NDA obligations at least as restrictive as this Policy
Legal Authorities	When required by applicable law, regulation, court order, or enforceable governmental request — with prior notice to you where legally permissible
Business Transfers	In the event of a merger, acquisition, or sale of assets — with notification to affected parties and privacy obligations at least as protective as this Policy
Professional Advisors	Legal counsel, auditors, and insurance providers — bound by professional confidentiality obligations

7. Data Security

We implement and maintain comprehensive administrative, technical, and physical security measures to protect information from unauthorised access, alteration, disclosure, destruction, or loss:

7.1 Technical Measures

• Encryption: TLS 1.2+ for data in transit; AES-256 or equivalent for sensitive data at rest, including credentials and Business Data
• Access controls: Role-based access control (RBAC) across all internal systems; multi-factor authentication (MFA) required for all accounts with access to Client environments
• Secure development: Coding practices aligned with OWASP guidelines; code reviews, static analysis, and vulnerability assessments as standard components of delivery
• Endpoint security: All devices used to access Client data are protected by endpoint security solutions, disk encryption, and remote wipe capabilities

7.2 Organisational Measures

• Information security policies and procedures reviewed and updated regularly
• Employee security awareness training conducted at onboarding and periodically thereafter
• Background verification for all team members with access to Client data
• Documented incident response plan with defined escalation procedures

7.3 Incident Response

In the event of a data breach or security incident affecting Client data, we shall:

• Notify the affected Client within twenty-four (24) hours of confirmed detection
• Provide a detailed incident report within seventy-two (72) hours
• Implement appropriate remediation measures and preventive controls
• Cooperate fully with any investigation initiated by the Client or regulatory authority

8. International Data Transfers

Ascendate Technologies is headquartered in India and primarily processes data within the territory of India. If you are accessing our Website or engaging our services from a jurisdiction outside India, please be aware that your information may be transferred to, stored, and processed in India, where data protection laws may differ from those of your jurisdiction.

We shall ensure that all cross-border data transfers are conducted in accordance with applicable data protection laws and with appropriate safeguards in place, including standard contractual clauses or other legally recognised transfer mechanisms where required.

9. Data Retention

We retain information only for as long as reasonably necessary to fulfil the purposes for which it was collected. Our retention periods are as follows:

Data Category	Retention Period
Website inquiry & consultation data	24 months from last interaction
Client Engagement data	Duration of Engagement + 5 years (contractual, legal, audit purposes)
Client credentials & access data	Active Engagement only — deleted within 7 business days of completion/termination
Career application data	12 months after recruitment conclusion (unless extended consent is provided)
Financial & invoicing records	Minimum 8 years (Indian tax and accounting regulations)
Website analytics data	26 months (anonymised and aggregated)

Upon expiration of the applicable retention period, data is securely deleted or irreversibly anonymised using commercially reasonable methods.

10. Cookies & Tracking Technologies

Our Website uses cookies and similar tracking technologies to enhance functionality and analyse usage patterns. By using our Website, you agree that we can place cookies on your device as explained in our Cookie Policy.

Cookie Type	Purpose
Strictly Necessary	Essential for Website operation — session management, security functions, load balancing. Cannot be disabled.
Analytics	Anonymised data on how visitors interact with the Website — pages visited, session duration, navigation paths. Used to improve site structure and performance.
Functional	Remember your preferences and settings (language, region) to provide a personalised experience.

You may control cookie preferences through the Cookie Settings panel on our Website or through your browser settings. We do not use cookies for third-party advertising or cross-site behavioural tracking. For full details, please refer to our Cookie Policy & Settings page.

11. Your Rights

Subject to applicable law, you may exercise the following rights with respect to your Personal Data:

• Right of access: Request a copy of the Personal Data we hold about you, along with information regarding the purposes and recipients of processing.
• Right of rectification: Request the correction of any inaccurate or incomplete Personal Data.
• Right of erasure: Request the deletion of your Personal Data, subject to our legal obligations and legitimate business interests.
• Right to restrict processing: Request that we restrict processing under certain circumstances, such as when you contest the accuracy of data.
• Right to data portability: Where technically feasible, request your Personal Data in a structured, commonly used, machine-readable format.
• Right to object: Object to processing for direct marketing at any time. Object to processing based on legitimate interests, in which case we shall cease unless compelling grounds override your interests.
• Right to withdraw consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing.

12. Children's Privacy

Our Website and services are intended for use by individuals who are at least eighteen (18) years of age and by business entities. We do not knowingly collect, solicit, or process Personal Data from individuals under the age of eighteen (18). If we become aware that we have inadvertently collected Personal Data from a minor, we shall take prompt steps to securely delete such data. If you believe a minor has provided us with Personal Data, please contact us at legal@ascendate.com.

13. Grievance Redressal

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable rules thereunder, if you have any grievances or complaints regarding the processing of your Personal Data, you may contact our designated Grievance Officer:

14. Changes to This Policy

We reserve the right to amend, modify, or update this Policy at any time. When we make material changes, we shall:

• Update the "Effective Date" and "Last Revised" date at the top of this page
• Post the revised Policy on our Website
• Where practicable and required by law, provide direct notice to affected individuals or Clients via email

Your continued use of our Website or services following the publication of a revised Policy constitutes your acceptance of the updated terms.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy, please contact us: