Privacy Policy

This policy applies to website visitors, prospective and existing customers, customer representatives, business partners and job applicants whose personal data we process for our own business purposes. It also explains how we handle personal data when we act as a Data Fiduciary under applicable Indian data protection law.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), a Data Principal is the individual to whom personal data relates. A Data Fiduciary determines the purpose and means of processing personal data. Where Fortisign processes personal data solely on a client’s documented instructions, Fortisign generally acts as a Data Processor and the client remains responsible for determining the purposes and means of that processing, subject to the applicable contract and law.

Business documents supplied by a company may contain personal data. Client-controlled project information is governed by the client’s privacy notice, instructions, confidentiality requirements and applicable service agreement or data processing agreement, to the extent those documents apply.

A product or service may have an additional privacy notice describing specific processing. That notice should be read together with this policy. This policy does not replace client confidentiality obligations, employment privacy notices or product-specific notices.

• Contact and professional details: Name, email address, telephone number, designation and company details, respond to enquiries, prepare proposals and communicate about services.
• Business and project information: Requirements, documents and project details you share, including personal data contained in them, to assess, deliver, secure and support agreed services.
• Communications: Enquiries, emails, support requests, feedback and related records, to provide assistance, follow up on requests, improve service quality and maintain appropriate business records.
• Technical information: IP address, browser type, device information, security events and website usage information, to operate, secure and troubleshoot the website and understand usage, subject to applicable cookie choices and law.
• Recruitment information: Resume/CV, qualifications, work history, contact details and other information submitted during recruitment, to assess suitability, communicate with applicants and administer recruitment.
• Billing and transaction information: Billing contact details, invoice information, payment references and relevant transaction records, where applicable, to invoice customers, reconcile payments, prevent fraud and meet accounting, tax and recordkeeping obligations.
• Service account and support information: Login identifiers, service configuration details, support history and other information needed to authenticate users, provide support and administer contracted services, where applicable.

We aim to collect only personal data that is necessary and relevant for the stated purpose. The exact categories collected depend on the service, form or interaction.

We receive personal data when you complete a form, contact us, submit a job application, enter into a business relationship, create or use an applicable service account, or provide material for a project. Technical information may be collected through server logs, cookies and similar technologies when you use our website. We may also receive relevant personal data from a customer, partner or authorised representative in connection with a service or business relationship.

Please provide only personal data necessary for your request. If you provide another person’s personal data, you should ensure that you are authorised to do so and that any notice or permission required by law has been provided.

Do not send passwords, full payment-card details, health information, biometric information or other high-risk information through general enquiry forms. If a service legitimately requires such information, the applicable collection notice and secure submission method will be provided separately.

Forms should identify required fields and optional fields at the point of collection. If necessary information is not provided, we may be unable to respond to a request, assess an application or deliver a requested service.

We process personal data only for a lawful purpose. Depending on the processing and when the relevant provisions of the DPDP Act apply, this may include processing based on consent or processing for a permitted use recognised by applicable law.

Where consent is required, we will request consent in a clear and plain manner and limit the request to personal data necessary for the specified purpose. The collection notice will identify the relevant personal data and purpose and provide the available method for withdrawing consent and exercising rights.

Consent, where used, should be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Withdrawal of consent will be made available through a method that is comparable in ease to the method used to give consent, where the DPDP Act applies.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, we will cease consent-based processing within a reasonable period, including directing relevant Data Processors to cease it, unless continued processing is required or authorised by applicable law or another lawful basis.

An enquiry does not by itself authorise unrelated promotional communications. Where promotional communications are sent, you may use the unsubscribe mechanism or contact us to opt out. Necessary service, billing, security and legal communications may continue.

Our website may use cookies or similar technologies for functionality, preferences, security and usage analysis. Necessary technologies may be used to provide requested website functions and security. Optional analytics or similar technologies, if used, will be described in the applicable cookie or website notice, including their purpose, provider and duration.

Where consent is required, optional technologies will be used only after the required consent is obtained. We will provide an appropriate mechanism for managing or withdrawing such consent where required. Blocking necessary technologies may affect website functionality.

We do not sell or rent personal data. We disclose personal data only for the stated purpose, for a permitted use, to fulfil a contract or service, to comply with law, or otherwise as permitted by applicable law.

• Authorised Fortisign personnel who need access to perform their duties.
• Hosting, cloud, technology, communication, support, security and payment service providers that process data for Fortisign or support delivery of an agreed service.
• Professional advisers, auditors, consultants and insurers where needed for professional, assurance, legal or business administration purposes.
• Government, law-enforcement, regulatory or judicial authorities where disclosure is required or lawfully requested.
• Other recipients where disclosure is necessary to protect rights, safety, security or legal interests, to the extent permitted by applicable law.

Where a vendor acts as our Data Processor, we will use contractual or other appropriate arrangements requiring confidentiality, security safeguards and processing consistent with our instructions and applicable law. A vendor that acts independently as its own Data Fiduciary may have a separate privacy notice.

Depending on the services and providers involved, personal data may be stored or processed in India or outside India. Any transfer of personal data outside India will be carried out subject to the restrictions, requirements or conditions applicable under Indian law, including any country or territory restrictions notified by the Central Government under the DPDP Act, as applicable.

Client-specific hosting locations, data residency commitments and transfer restrictions are governed by the applicable service agreement or data processing agreement. We do not represent that all personal data remains in India unless this has been expressly agreed for the relevant service.

Client project information is used to deliver the agreed service and is handled under the applicable contract, confidentiality obligations and documented client instructions. Personal data supplied on a client’s behalf will not be repurposed outside those authorised instructions except where required or permitted by law.

If an agreed service uses third-party AI or language-model providers, the applicable service or product notice and/or agreement should identify, as appropriate, the categories of information submitted, purpose, relevant provider, applicable retention settings and other material privacy implications. Fortisign will not submit client confidential information to an external AI service for a new or unrelated purpose without the applicable client authorisation and required safeguards.

AI processing is not authorised merely because this general policy is accepted. Where a product involves prompts, uploaded files, conversation histories, profiling or automated decision-making that materially affects individuals, an appropriate additional notice and contractual safeguards will be provided where required.

We implement reasonable technical and organisational measures appropriate to the nature, scope and risks of processing. Depending on the service and risk, these measures may include access controls, authentication, encryption or equivalent protection, masking or tokenisation where appropriate, backups and continuity measures, security monitoring and logging, vulnerability management, incident response and contractual security requirements for Data Processors.

We limit access to personal data to authorised persons and service providers who need it for legitimate purposes. No electronic transmission or storage method is completely secure; this does not limit our responsibilities under applicable law.

If we become aware of a personal data breach, we will investigate, contain and remediate it and provide notices to affected Data Principals and the Data Protection Board of India as required by applicable law. When Rule 7 of the DPDP Rules, 2025 applies, the required process includes notifying affected Data Principals without delay and notifying the Board without delay, with the detailed information required by the Rules to be furnished within 72 hours of becoming aware of the breach, or within a longer period allowed by the Board.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, for an applicable contractual or legal requirement, or for legitimate dispute, security, audit or enforcement needs permitted by law. Retention periods are determined by the type of record, the relationship, the purpose of processing, statutory obligations and any legal hold.

• Enquiries and communications: while the enquiry, follow-up or related business matter remains relevant, plus any necessary recordkeeping period.
• Project and service records: during delivery and agreed support, followed by the period required by the contract, applicable law or a justified dispute/security need.
• Recruitment records: during recruitment administration and, where future-opportunity retention is offered, for the disclosed period and on the basis required by applicable law.
• Invoices and transaction records: for applicable accounting, tax and statutory retention periods.
• Technical logs and cookies: for periods appropriate to security, operation or the disclosed analytics purpose, subject to any mandatory retention requirement.

When personal data is no longer required, we will delete or anonymise it as appropriate. Client information will be returned or deleted according to agreed instructions, subject to legal obligations. Backup copies may remain until the applicable backup cycle expires and will remain protected and unavailable for unrelated use.

Where a DPDP Rule or other applicable law requires a minimum retention period for specified records or logs, Fortisign will retain those records for the required period and will not treat a deletion request as overriding a mandatory retention obligation.

Subject to applicable law and the commencement of the relevant provisions, a Data Principal may have rights including: (i) access to information about personal data and its processing; (ii) correction, completion and updating of personal data; (iii) erasure of personal data where permitted; (iv) withdrawal of consent where consent is the basis of processing; (v) grievance redressal; and (vi) nomination of another individual to exercise applicable rights in accordance with law.

Where applicable, the right to access information may include a summary of the personal data being processed and information about Data Fiduciaries and Data Processors with whom personal data has been shared, subject to the statutory exceptions.

Requests may be sent to the contact in Section 15 with the subject “Privacy Request”. Please describe the right you wish to exercise and identify the relevant interaction, account or service. We may request proportionate information to verify identity or authority. Please do not send unnecessary identity documents or passwords in your initial request.

We will respond within the period required by applicable law. When Rule 14 of the DPDP Rules, 2025 applies, our published grievance mechanism will specify the applicable response period, which will not exceed the statutory maximum.

If you are dissatisfied with our response, you may use the published grievance escalation mechanism and, where permitted by applicable law, approach the Data Protection Board of India after completing any required internal grievance process.

Our business website and general IT and consulting services are intended primarily for business users and are not directed at children. Please avoid submitting a child’s personal data through general enquiry forms.

For purposes of the DPDP framework, a child is an individual who has not completed 18 years of age. Where processing of a child’s personal data is undertaken in circumstances governed by the DPDP Act, Fortisign will obtain verifiable parental consent as required and comply with applicable restrictions on processing that is likely to cause a detrimental effect on the well-being of a child, tracking or behavioural monitoring of children, and targeted advertising directed at children.

Where the law requires consent of a lawful guardian for a person with disability who has a lawful guardian, Fortisign will follow the applicable verification requirements.

If you believe personal data was submitted without the required authorisation, please contact us so that we can assess the circumstances and take appropriate action.

Links to external websites are provided for convenience. Their operators have their own privacy practices, which you should review. Fortisign does not control processing performed independently by those operators.

Embedded tools, payment services, analytics tools or other integrations may collect information within the service experience. Where Fortisign uses such tools as a Data Fiduciary or engages a provider as a Data Processor, the relevant processing will be addressed through the applicable notice, cookie information, contract or service documentation.

We may update this policy to reflect changes in our services, processing practices, security measures or legal requirements. The revised policy will be published with an updated effective date. Material changes will be communicated through an appropriate notice where required, and fresh consent will be obtained where required for changed processing.

Fortisign will comply with the Indian privacy and information-technology requirements applicable to the relevant processing. The DPDP Act, 2023 and DPDP Rules, 2025 have notified phased commencement dates. As of this policy’s effective date, some operational provisions are in force while the principal notice, consent, rights and security obligations in the later commencement phase are scheduled to take effect 18 months after 13 November 2025. Fortisign intends to implement the relevant controls ahead of their applicable commencement dates.

Nothing in this policy should be read as stating that every provision of the DPDP Act or Rules is already enforceable as of the policy’s effective date. The policy will be updated if commencement dates, rules or applicable requirements change.

Where another jurisdiction’s privacy law applies to a particular service or individual, additional notices or contractual terms may apply.

Fortisign Infotech Private Limited

No. 19/1, G-1 Ground Floor, Bajiani Koil Street,
Madipakkam, Kancheepuram, Tamil Nadu - 600091, India.

Privacy enquiries, rights requests, consent withdrawals, grievances and suspected personal data incidents:
contact@fortisigninfotech.com

Please identify whether your message concerns a privacy request, consent withdrawal, grievance or suspected data incident. Include enough information to locate the relevant interaction without sharing unnecessary sensitive information. For client-controlled project information, identify the client or service so the request can be routed appropriately.

Fortisign will review and update its privacy, security and grievance procedures as the DPDP Act and Rules take effect. To the extent any earlier Indian privacy or information-technology requirement continues to apply during the transition period, Fortisign will comply with that requirement to the extent applicable. References in earlier versions of this policy to “sensitive personal data or information” should not be read as creating a separate category under the DPDP Act; the DPDP framework generally uses the broader concept of “personal data”.