Privacy Policy

1.1 This Privacy Policy is issued by Codec Networks Private Limited, a company incorporated under the laws of India, bearing Corporate Identity Number [U72900DL2008PTC184004] and having its head office at Office No. 507, 5th Floor, New Delhi House, Barakhamba Road, New Delhi 110001, India, and its branch office at Office No. 707, 7th Floor, Silverton Tower, Sector 50, Golf Course Extension Road, Gurugram, Haryana 122018, India ("Codec Networks", "we", "us" or "our"). For the purposes of this Privacy Policy, Codec Networks is the Data Fiduciary.

1.2 This Privacy Policy applies to personal data that we process when you:

• (a) visit https://www.codecnetworks.com or any other website owned or operated by us that links to this Privacy Policy (the "Website");
• (b) submit an enquiry, request a meeting, or communicate with us by telephone, email or WhatsApp;
• (c) enquire about, enrol in or attend any of our training programmes;
• (d) apply for employment with us;
• (e) visit our offices; or
• (f) interact with us as a representative of a client, prospective client, partner or vendor.

1.3 This Privacy Policy does not apply to:

• (a) personal data that we process on behalf of our clients while delivering services such as vulnerability assessment and penetration testing, red teaming, managed security operations, digital forensics, audits or outsourced data protection officer services. In such cases, we act as a Data Processor under the instructions of the client and the terms of our contract with it, and the client's privacy notice applies;
• (b) personal data of our employees, which is governed by a separate internal notice; and
• (c) third-party websites and services linked from the Website, as described in paragraph 14.

1.4 This Privacy Policy is published in compliance with the Information Technology Act, 2000 and the SPDI Rules, which are presently in force, and is aligned with the DPDP Act and the DPDP Rules, which apply as and when their respective provisions come into force. It is a standalone notice, and acceptance of our Terms and Conditions does not constitute consent to any processing of personal data.

2.1 Terms used in this Privacy Policy have the meanings assigned to them under the DPDP Act. For ease of reference, the key terms are explained below:

2.2 In this Privacy Policy, references to "paragraphs" are to paragraphs of this Privacy Policy, references to "sections" are to sections of the DPDP Act, and references to "rules" are to rules of the DPDP Rules, unless otherwise stated.

3.1 In accordance with rule 3 of the DPDP Rules, the table below sets out an itemised description of the personal data we process, the specified purposes of such processing and the lawful ground relied upon. We collect only such personal data as is necessary for the specified purpose.

3.2 Personal data received from third parties. Where your employer nominates you for a training programme, a colleague shares your contact details with us, or a recruitment agency refers your candidature, we receive your personal data from that person, who is responsible for having obtained your authorisation. We shall inform you of the source of your personal data at the time of our first communication with you.

3.3 Sensitive personal data or information. We do not solicit passwords, financial account or payment instrument details, health information or biometric information through the Website, and you are requested not to submit such information. Where we are required to collect any sensitive personal data or information, we shall do so only with your prior consent in writing, as required by rule 5 of the SPDI Rules.

3.4 Automated decisions and anonymised data. We do not use personal data for automated decision-making that produces legal or similarly significant effects for you. We may use anonymised or aggregated information, which does not identify any individual, for statistical and analytical purposes.

4.1 We process personal data only for a lawful purpose and on one of the following grounds:

• (a) Consent (section 6). Where we rely on consent, it shall be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action such as the ticking of an unticked box, and limited to the personal data necessary for the specified purpose. Consent to marketing communications shall never be made a condition for responding to your enquiry or providing any service.
• (b) Certain legitimate uses (section 7). We may process personal data without seeking consent where section 7 of the DPDP Act so permits, including: (i) where you have voluntarily provided your personal data for a specified purpose and have not indicated that you do not consent to its use (section 7(a)); (ii) to fulfil an obligation under law to disclose information to the State or any of its instrumentalities (section 7(d)); (iii) to comply with any judgment, decree or order (section 7(e)); and (iv) to respond to a medical emergency, or to ensure the safety of individuals during a disaster or breakdown of public order, at our offices or training venues (sections 7(f) and 7(h)).
• (c) Exemptions (section 17). We may process personal data where this is necessary for the enforcement of any legal right or claim, or in the interest of the prevention, detection, investigation or prosecution of any offence or contravention of law (sections 17(1)(a) and 17(1)(c)). We rely on these exemptions only where they genuinely apply, such as for protecting the Website from attacks.

4.2 Consent given before commencement. Where you gave consent before the commencement of the relevant provisions of the DPDP Act, we shall give you a notice in accordance with section 5(2) as soon as reasonably practicable, and may continue to process your personal data until you withdraw that consent.

5.1 You may withdraw your consent at any time, with the same ease with which it was given (section 6(4)), by any of the following means:

• (a) clicking the "unsubscribe" link in any marketing email;
• (b) replying "STOP" to any marketing SMS or WhatsApp message;
• (c) using the [Cookie Settings] link in the footer of the Website, in respect of cookies; or
• (d) writing to [privacy@codecnetworks.com] with the subject line "Withdrawal of Consent", from the email address registered with us.

5.2 Upon withdrawal of consent, we shall, within a reasonable time, cease processing the relevant personal data and cause our Data Processors to do the same, unless such processing is required or authorised under the DPDP Act or any other law (section 6(6)). The withdrawal shall not affect the legality of processing carried out before it, and its consequences, such as our inability to continue a service that depends on such consent, shall be borne by you (section 6(5)).

5.3 You may also inform us at any time that you do not wish us to use personal data that you voluntarily provided for a particular purpose, whereupon we shall cease such use, save where retention is required by law.

5.4 Consent Managers. Where we make this facility available, you may give, manage, review and withdraw your consent through a Consent Manager registered with the Board, in accordance with sections 6(7) to 6(9) of the DPDP Act and rule 4 of the DPDP Rules. The name of any Consent Manager with whom we are integrated shall be published in this Privacy Policy.

6.1 Cookies are small text files placed on your device when you visit a website. The Website uses the following cookies and third-party services:

6.2 Your choices. Strictly necessary cookies are used because the Website cannot function securely without them. Analytics cookies are used only with your consent, which you may give or withdraw at any time through the [Cookie Settings] link in the footer of the Website. You may also block or delete cookies through your browser settings; however, blocking strictly necessary cookies may prevent the forms on the Website from functioning.

6.3 Google services. This Website is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply. We do not use cookies for advertising or to build a profile of any individual.

7.1 We do not sell, rent or trade personal data. We share personal data only with the categories of recipients set out below, and only to the extent necessary for the stated purposes:

7.2 Data Processors. Our hosting, email, content delivery, payment and training-platform service providers act as our Data Processors. We engage them only under a valid contract that requires them to process personal data solely on our instructions and to maintain reasonable security safeguards (section 8(2)), and we remain responsible for the processing they carry out on our behalf (section 8(1)). Google, certification bodies, professional advisers and governmental authorities process the personal data they receive in accordance with their own legal obligations and policies.

7.3 Disclosure required by law. We may disclose personal data without your prior consent to government agencies mandated under law to obtain information for the purpose of verification of identity, or for the prevention, detection, investigation, prosecution or punishment of offences, including cyber incidents. Such disclosure shall be made upon a written request stating clearly the purpose of the request, in accordance with rule 6 of the SPDI Rules and other applicable law.

7.4 Accuracy. Where personal data is likely to be used to make a decision that affects you, or is disclosed to another Data Fiduciary, we shall make reasonable efforts to ensure its completeness, accuracy and consistency (section 8(3)).

7.5 Information on sharing. Upon request, we shall provide you with the identities of the Data Fiduciaries and Data Processors with whom your personal data has been shared, together with a description of the personal data so shared, as set out in paragraph 12.

8.1 Certain of our service providers, including Google, Microsoft, GoDaddy and content delivery networks, may store or process personal data on servers located outside India.

8.2 We shall transfer personal data outside India only:

• (a) to a country or territory that has not been restricted by the Central Government by notification under section 16(1) of the DPDP Act;
• (b) in compliance with such requirements as the Central Government may specify under rule 15 of the DPDP Rules in respect of making personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State; and
• (c) to a recipient that ensures the same level of data protection as is required under Indian law, in accordance with rule 7 of the SPDI Rules.

8.3 Where any sector-specific law in India provides for a higher degree of protection of personal data, or for a restriction on its transfer outside India, we shall comply with that law (section 16(2)).

9.1 We retain personal data only for as long as is necessary to fulfil the specified purpose for which it was collected, or as required by law. Thereafter, we shall erase it, and cause our Data Processors to erase it, or irreversibly anonymise it (section 8(7)). The retention periods applicable to each category of personal data are set out below:

9.2 Minimum retention under the DPDP Rules. Notwithstanding the retention periods set out above, and in accordance with rule 8(3) of the DPDP Rules, we retain personal data, associated traffic data and other logs relating to its processing for a minimum period of one (1) year from the date of such processing, for the purposes specified in the Seventh Schedule to the DPDP Rules. Such data is held securely, used only for those purposes, and erased upon the expiry of that period unless its retention is otherwise required by law.

10.1 We have implemented reasonable security practices and procedures, and reasonable security safeguards, to protect personal data against unauthorised access, use, disclosure, alteration and destruction, in accordance with section 8(5) of the DPDP Act, rule 6 of the DPDP Rules and rule 8 of the SPDI Rules. These include:

• (a) Encryption and masking: encryption of all Website traffic through HTTPS (TLS), and encryption, obfuscation, masking or tokenisation of stored personal data, where appropriate;
• (b) Access control: access restricted to authorised personnel on a need-to-know basis, through individual accounts, the principle of least privilege and multi-factor authentication for administrative access;
• (c) Logging and monitoring: logging of access to personal data, with periodic review of such logs to detect, investigate and remediate unauthorised access, and retention of such logs for a minimum period of one (1) year;
• (d) Business continuity: data backups and recovery procedures to ensure the continued availability of personal data in the event of a compromise;
• (e) Contractual safeguards: security and confidentiality obligations in our contracts with Data Processors; and
• (f) Organisational measures: confidentiality undertakings from personnel, periodic privacy and security training, and regular security testing of our own systems.

10.2 [If certified: Our information security management system is certified to ISO/IEC 27001:2022.]

10.3 While we take all reasonable measures to protect personal data, no method of transmission over the internet or of electronic storage is completely secure. In the event of a personal data breach, we shall act in accordance with paragraph 11.

11.1 In the event of a personal data breach, we shall:

• intimate each affected Data Principal without delay, in a concise, clear and plain manner, through email, SMS or any other mode of communication registered with us. The intimation shall describe the breach (including its nature, extent, timing and location of occurrence), the consequences relevant to you that are likely to arise from it, the measures we have implemented or are implementing to mitigate the risk, the safety measures you may take to protect your interests, and the business contact information of a person able to respond to your queries (rule 7(1));
• intimate the Board without delay, and furnish a detailed report within seventy-two (72) hours of becoming aware of the breach, or within such longer period as the Board may allow upon a written request (rule 7(2)); and
• report cyber security incidents to CERT-In within six (6) hours of noticing them, in accordance with the directions issued by the Indian Computer Emergency Response Team on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000.

11.2 Where we act as a Data Processor for a client, we shall notify the client without undue delay, so as to enable it to discharge its own obligations.

12.1 Subject to the DPDP Act, you have the rights set out below. The rights of access, correction and erasure apply to personal data processed on the basis of your consent or under section 7(a).

12.2 Manner of exercising rights. You may exercise your rights by writing to [privacy@codecnetworks.com] or to our Grievance Officer at the address specified in paragraph 16. Your request should state your name, the email address or telephone number used in your dealings with us (which serves as your identifier for the purposes of rule 14(1)), and the nature of your request. We may seek such information as is reasonably necessary to verify your identity, which shall be used only for that purpose. No fee is charged for any request.

12.3 Timelines. We shall acknowledge your request within [forty-eight (48) hours] and respond within thirty (30) days of its receipt. This is within the period of one (1) month prescribed under rule 5(9) of the SPDI Rules and the maximum period of ninety (90) days prescribed under rule 14(3) of the DPDP Rules. Where we are unable to comply with a request in whole or in part, for instance because the law requires us to retain the data, we shall communicate the reasons to you.

12.4 Duties of Data Principals. In accordance with section 15 of the DPDP Act, you shall:

• (a) comply with all applicable laws while exercising your rights under the DPDP Act;
• (b) not impersonate any other person while providing your personal data for a specified purpose;
• (c) not suppress any material information while providing your personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
• (d) not register any false or frivolous grievance or complaint with us or the Board; and
• (e) furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

12.5 A breach of these duties may attract a penalty of up to Indian Rupees Ten Thousand (₹10,000), imposed by the Board.

13.1 The Website and our services are intended for adults. Persons below eighteen (18) years of age are requested not to submit personal data through the Website.

13.2 Where a child is to participate in a training programme, the child shall be enrolled by a parent or lawful guardian, whose verifiable consent shall be obtained before any personal data of the child is processed (section 9(1)). We shall observe due diligence to verify that the individual identifying themselves as the parent is an identifiable adult, by reference to reliable details of identity and age available with us, or to voluntarily provided details of identity and age or a virtual token mapped to them, issued by an entity entrusted by law or by the Government with the maintenance of such details, including details made available through a Digital Locker service provider (rule 10).

13.3 We shall not undertake any processing of personal data that is likely to cause any detrimental effect on the well-being of a child, nor shall we undertake tracking or behavioural monitoring of children or targeted advertising directed at children (sections 9(2) and 9(3)).

13.4 In respect of a person with disability who has a lawful guardian, we shall obtain the verifiable consent of that guardian, after verifying that the guardian has been appointed by a court of law, a designated authority or a local level committee under the applicable law (rule 11).

13.5 Where we become aware that we have collected the personal data of a child without verifiable consent, we shall erase it without delay.

14.1 Marketing communications. We send newsletters, invitations to webinars and events, and announcements of training programmes only to persons who have opted in to receive them. Every marketing email contains an unsubscribe link, and you may reply "STOP" to any marketing SMS or WhatsApp message. Commercial communications by telephone and SMS are made in compliance with the Telecom Commercial Communications Customer Preference Regulations, 2018, including your registered preferences. We do not send marketing communications to children.

14.2 Third-party websites. The Website contains links to third-party websites and services, including WhatsApp, Google Maps, social media platforms and accreditation bodies. Such websites and services are governed by their own privacy policies, and we are not responsible for their privacy practices. You are advised to review their policies before providing any personal data to them.

15.1 Amendments. We may amend this Privacy Policy from time to time, including to reflect changes in our processing activities or in applicable law. The amended Privacy Policy shall be published on the Website with a revised "Last Updated" date. In the case of material changes, we shall display a notice on the Website and, where we hold your email address, inform you by email. Where any change requires your fresh consent, we shall obtain it before applying the change to your personal data.

15.2 Language. This Privacy Policy is published in English. In accordance with section 5(3) of the DPDP Act, you may request a copy in any language specified in the Eighth Schedule to the Constitution of India, such as Hindi, Bengali, Marathi, Tamil, Telugu or Urdu, by writing to [privacy@codecnetworks.com].

15.3 Governing law. This Privacy Policy shall be governed by and construed in accordance with the laws of India.

16.1 In accordance with section 8(9) of the DPDP Act, rule 9 of the DPDP Rules and rule 5(9) of the SPDI Rules, the business contact information of the person who is able to answer, on our behalf, questions about the processing of your personal data, and who is also our Grievance Officer, is as follows:

16.2 We shall acknowledge every grievance within [forty-eight (48) hours] of its receipt and resolve it within thirty (30) days, and in no event later than the ninety (90) days prescribed under rule 14(3) of the DPDP Rules.

16.3 Complaints to the Board. If you are not satisfied with the resolution of your grievance, you may, after exhausting the grievance redressal mechanism set out above as required by section 13(3) of the DPDP Act, file a complaint with the Data Protection Board of India, which functions as a digital office.