Privacy & Data Governance

1. Information We Collect

We collect only the business information voluntarily provided when you submit an enquiry through our contact form:

• Project Overview: Desired discipline (e.g. Web Development, SEO, Paid Advertising), optional project or brand name, optional current website address, and a brief description of your project objectives.
• Contact Details: Your full name, business email address, and optional phone number and company name.
• Project Scope: Optional estimated budget range and target implementation timeframe.
• Anti-Abuse Technical Data: When submitting an enquiry, we generate a privacy-preserving SHA-256 hash of your network IP address combined with an internal salt. We do not store raw IP addresses in our application database or application logs.

2. Purpose of Processing

We process submitted information strictly for legitimate commercial business purposes:

• Evaluating the technical and strategic feasibility of your requested project.
• Communicating directly with you to schedule discovery calls and provide proposals.
• Protecting our public endpoints against automated denial-of-service and form-spam attacks.

3. Recipients & Third-Party Disclosure

We never sell, rent, trade, or lease personal or client data to data brokers or third-party advertisers. Information submitted is accessible solely to authorized internal Qubizon team members and leadership responsible for project scoping and execution.

Internal email notifications are delivered over encrypted TLS connections directly to our company inbox (info@qubizon.com).

4. Data Storage, Security & Retention

Enquiry records are stored in secure, server-isolated database infrastructure with access controls and parameterized query protections. We retain enquiry records for as long as necessary to evaluate the business opportunity or fulfill an active client agreement.

Enquiries that do not lead to an active contract may be archived or permanently purged after 12 months, or sooner upon written request.

5. Indian DPDP Act & International Data Governance Standards

Qubizon complies with the principles of the Digital Personal Data Protection (DPDP) Act of India and international benchmarks including GDPR. We collect only personal data necessary for legitimate business inquiry evaluation, operate with complete transparency, and enforce strict purpose-limitation controls.

For corporate clients and cross-border partners in the GCC, Europe, and North America, we execute data processing agreements (DPAs) upon engagement kick-off, establishing explicit data residency, processing scopes, and confidential breach notification protocols.

6. Cookie Governance & Local Telemetry

Our web platform uses minimal, strictly essential session indicators and anonymized aggregate analytics. We do not set persistent cross-site tracking cookies or sell behavioral telemetry to programmatic advertising networks.

Where first-party measurement tools (such as Google Analytics 4) are configured, client IP addresses are masked and anonymized at the edge before storage.

7. Technical Safeguards & Transport Layer Security (HSTS)

All web traffic between client browsers and Qubizon infrastructure is strictly governed by HTTP Strict Transport Security (HSTS), enforcing TLS 1.3 encryption across all root domains and subdomains. We configure defensive HTTP response headers including X-Content-Type-Options: nosniff, strict Referrer-Policy, and restricted Permissions-Policy.

8. Your Privacy Rights & Contact Method

You have the right to request access to the information you submitted, request corrections, or request complete deletion of your enquiry record from our systems.

9. Cross-Border International Data Governance & GCC Compliance

As a global digital engineering collective serving enterprises across India, the United Arab Emirates, the Kingdom of Saudi Arabia, Qatar, Kuwait, Bahrain, and the Sultanate of Oman, Qubizon enforces jurisdictional privacy parity:

• European Union (GDPR): All data processing adheres to EU Regulation 2016/679 with standard contractual clauses (SCCs) governing cross-border transfers.
• India (DPDP Act 2023): Personal data is processed exclusively under lawful consent guidelines with explicit purpose limitation and designated Data Protection Officer oversight.
• UAE Federal Decree-Law No. 45 of 2021: Enterprise client databases comply with UAE national data protection mandates and sovereign localization options.
• Saudi Arabia (PDPL): Systems handling Saudi resident data strictly comply with the Personal Data Protection Law promulgated by Royal Decree No. M/19.

10. Third-Party Subprocessor Oversight & Audit Protocols

We maintain strict vendor risk management protocols. Third-party cloud infrastructure providers utilized for platform hosting, edge routing, and communications (including Amazon Web Services, Cloudflare, Vercel, and Meta WhatsApp Business Cloud API) are audited for SOC 2 Type II, ISO/IEC 27001, and PCI-DSS Level 1 compliance.

We execute formal Data Processing Agreements (DPAs) with every subprocessor, mandating technical encryption standards and immediate 24-hour breach notification obligations.

11. Enterprise Incident Response & Breach Protocol SLA

In the event of a suspected or confirmed security anomaly affecting customer information, Qubizon activates an automated incident containment protocol within 60 minutes. Affected enterprise stakeholders and statutory authorities are notified in accordance with regulatory timetables (within 72 hours for GDPR and immediate notification under DPDP Act requirements).

For questions regarding our enterprise security posture, please review our Enterprise Consultation Portal or review our core Web Architecture SLAs and CRM Governance Protocols.