Privacy Policy

Aanetic Pvt. Ltd. (“Aanetic”, “we”, “us”) operates the website https://aanetic.in and provides cybersecurity, audit and governance, risk & compliance (GRC) services. For the personal data we handle through this website and our enquiry channels, Aanetic acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).

This policy applies to personal data we collect from visitors and prospective clients through our website, contact and enquiry forms, email and phone. Where we process personal data on behalf of a client (for example while delivering an audit), we act as a Data Processor and handle that data strictly under our written agreement with that client; this policy does not govern such client-controlled data.

We practise data minimisation and collect only what we need:

• Identity & contact data you provide — name, work email, mobile number (with country code), company and the contents of your message.
• Consent record — the fact that you agreed to be contacted, with a timestamp.
• Technical & usage data — limited information such as your approximate region, device/browser type and pages viewed, collected via cookies and analytics where you allow it.

We do not intentionally collect special or sensitive categories of data through this website. Please do not include such information in free-text fields.

We process your personal data for specific, lawful purposes, and — as required by the DPDP Act — only with your consent or for legitimate uses recognised by the Act:

• To respond to your enquiry, schedule consultations and provide the information or services you request.
• To manage our client relationship, send service communications and, where separately permitted, relevant updates.
• To operate, secure and improve our website.
• To comply with legal, regulatory and audit obligations.

Before or at the time of collecting consent-based data, we provide a clear notice describing the personal data sought and the purpose, the way to withdraw consent, how to exercise your rights, and how to complain to the Data Protection Board of India — in English and, on request, other languages listed in the Eighth Schedule to the Constitution.

Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action (such as ticking the consent box on our form). Your consent is limited to the purposes notified to you.

You may withdraw your consent at any time, as easily as you gave it, by writing to us at info@aanetic.com. Withdrawal does not affect the lawfulness of processing done before withdrawal. After withdrawal we will stop the relevant processing and erase the personal data unless we are required to retain it by law. You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board, where available.

We use your data only for the purposes above. We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.

We may share personal data with trusted service providers (Data Processors) — for example email, hosting and analytics providers — who act only on our instructions under contractual obligations consistent with the DPDP Act. We may also disclose data where required by law or to protect our rights. We remain accountable for personal data processed on our behalf.

We keep personal data only for as long as needed to fulfil the purpose for which it was collected, or as required by law. When the purpose is served, or you withdraw consent and no legal retention applies, we will erase your personal data and cause our processors to do the same.

As required by the DPDP Rules, we implement reasonable technical and organisational security safeguards to protect personal data against breach, including measures such as encryption in transit, access controls and least-privilege, logging and monitoring, secured backups, and reasonable measures to maintain the confidentiality, integrity and availability of personal data. We review these safeguards on an ongoing basis.

Subject to the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we process about you and our processing activities.
• Correction & erasure — have inaccurate or incomplete data corrected, updated or completed, and have your data erased where it is no longer needed.
• Grievance redressal — a readily available means to raise grievances with us (see Section 15).
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any right, write to us at info@aanetic.com. We will respond within the timeframes prescribed under the DPDP Rules. You must provide accurate information and cooperate so we can verify your identity and act on your request.

We do not collect or knowingly process the personal data of children. Under the DPDP Act, a child is any individual under 18 years of age. Our website, forms and services are intended only for individuals aged 18 or above acting in a business capacity, and our contact form asks you to confirm that you are 18 or older before submitting.

We do not knowingly process any child's personal data, we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, and we do not process personal data likely to cause any detrimental effect on the well-being of a child. We do not require or seek verifiable parental consent because we do not intend to collect children's data at all. If you are under 18, please do not submit any personal data to us.

If you believe a child has provided us personal data, please contact us at info@aanetic.com and we will delete it promptly.

We primarily process personal data within India. Where any processing or storage occurs outside India (for example through a service provider), we do so consistent with the DPDP Act and any restrictions notified by the Central Government, and we apply appropriate safeguards.

We use a small number of cookies and similar technologies to make the site work and, where you allow it, to understand usage. Non-essential cookies are used only with your consent, which you can change at any time through your browser settings or our consent controls where provided.

If a personal data breach occurs, we will assess it and, in accordance with the DPDP Rules, notify each affected Data Principal and the Data Protection Board of India without undue delay and within the timeframes prescribed, with the information the Rules require, and take steps to mitigate harm.

If you have any question, request or grievance about your personal data, please contact our Grievance Officer / Data Protection point of contact:

We aim to resolve grievances within the period prescribed under the DPDP Rules. If you are not satisfied with our response, you have the right to register a complaint with the Data Protection Board of India.

We may update this policy to reflect changes in law, our services or our practices. We will post the revised version here with a new “last updated” date. Material changes will be highlighted where appropriate.