This Privacy Policy explains how Neuron Cognitive OPC Private Limited, a company incorporated in India and based in Bengaluru, Karnataka (“NeuronCx”, “we”, “us” or “our”), collects, uses, shares and protects personal data, and the choices and rights you have over it. It is written to meet our duties under the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000.

In this policy, “personal data” means any data about an individual who can be identified from it, and “you” means the individual whose personal data we process. You can ask for this policy in any language listed in the Eighth Schedule to the Constitution of India by writing to [email protected].

1. Who this policy covers

This policy applies to personal data we process about:

visitors to our website at neuroncx.in and its subdomains;

people who contact us, ask for a demo, book a call, subscribe to our updates or meet us at events;

people at our client organisations who use the NeuronCx platform, and our clients’ billing and contract contacts; and

people who apply for roles at NeuronCx or work with us as suppliers or partners.

For these groups, NeuronCx decides why and how the data is processed, so we act as the data fiduciary.

This policy does not cover the personal data our clients load into the NeuronCx platform about their own customers, patients, students or contacts. For that data, our client is the data fiduciary and NeuronCx processes it on the client’s behalf, as explained in section 6.

2. Personal data we collect

Data you give us. When you fill in a form on our website, book a demo, write to us or speak to our team, we collect details such as your name, business email address, mobile number, organisation, job title and the message you send. When your organisation becomes a client, we also collect the names and work contact details of the people who use the platform or manage the contract, and billing details such as the billing contact, address and GST number.

Data collected when you use our website. When you visit our website, we and our service providers automatically collect technical data such as your IP address, browser and device type, the pages you visit, the time spent on them and the website that referred you, partly through cookies (see section 7).

Data collected when you use the platform. When you log in to the NeuronCx platform, we record your user details, role and permissions, and logs of your sign-ins and the actions you take, so we can provide the service, set access by role and investigate problems.

Data from others. We may receive your details when a colleague adds you as a user of the platform, when someone refers you to us, or when you share them with us at an event.

We do not ask website visitors for sensitive information such as health, financial account or government identity details, and we ask that you do not send these through our website forms.

3. How we use personal data

We use personal data to:

reply to your enquiry, arrange and run demos, and send you proposals you ask for;

set up and manage platform accounts, provide support and keep the platform running;

send service messages, such as account notices, security alerts and changes to our terms;

send you product updates and event invitations, where you have agreed to receive them (see section 5);

understand how our website and platform are used, so we can fix problems and improve them;

prevent fraud and misuse, and protect the platform, our clients and our team;

invoice clients, keep accounts and meet our tax and other legal obligations; and

handle job applications and manage our relationships with suppliers and partners.

We use personal data only for the purpose we collected it for, or a purpose that is clearly connected to it.

4. The basis on which we process personal data

We process personal data either with your consent, or for a legitimate use that the Digital Personal Data Protection Act, 2023 allows without consent. These legitimate uses include processing data you have given us voluntarily for a specific purpose, such as replying to the enquiry you sent, and processing needed to comply with the law, a court order or a request from a government authority.

Where we rely on your consent, we will ask for it clearly and for a stated purpose, and you can withdraw it at any time as easily as you gave it, by using the unsubscribe link in our emails or writing to [email protected]. Withdrawing consent does not affect processing that took place before you withdrew it, and we may not be able to provide some services without the data.

5. Marketing emails and messages

We send product updates, articles and event invitations only to people who have agreed to receive them. Every marketing email includes an unsubscribe link, and you can also ask us to stop at any time by writing to [email protected]. We will still send service messages that you need to use the platform. We do not send marketing messages on WhatsApp or SMS unless you have opted in to that channel.

6. Data we process for our clients

Our clients use the NeuronCx platform to manage their relationships with their own customers, which can include contact details, conversations, call recordings, documents, bookings, payments and other records (“Customer Data”). For Customer Data, our client is the data fiduciary: it decides why the data is collected and how it is used, and it is responsible for giving its customers a privacy notice and getting any consent the law requires, including verifiable consent from a parent or guardian for data about children.

NeuronCx processes Customer Data only on our client’s instructions, under our contract with that client, and not for our own purposes. If you are a customer of one of our clients and want to see, correct or erase your data, or withdraw your consent, please contact that organisation directly. If you write to us instead, we will pass your request to the client and help them respond to it.

7. Cookies

Cookies are small text files that a website saves in your browser. We use cookies that are needed for our website to work, such as those that keep the site running and remember your settings. If we use analytics cookies to understand how visitors use our website, we will ask for your consent before setting them where the law requires it.

Most browsers let you block or delete cookies in their settings. If you block cookies that the website needs, some parts of it may not work as they should. We do not store your name, email address or other contact details in cookies.

8. Who we share personal data with

We do not sell personal data. We share it only with:

service providers who help us run our business, such as cloud hosting and database providers, email, support desk and scheduling tools, messaging and telephony providers, and analytics providers, under contracts that require them to use the data only to provide their services to us and to protect it;

our professional advisers, such as lawyers, auditors and accountants, where they need it to advise us;

government authorities, courts and law enforcement, where the law requires it or to protect our rights, our clients or others; and

a buyer or successor, if NeuronCx is involved in a merger, acquisition or sale of assets, in which case your data will remain protected under this policy or a policy that is at least as protective.

9. Where personal data is stored

The main NeuronCx platform database is hosted in Mumbai, India. Clients who choose a deployment in their own cloud account keep their Customer Data in that account, in the location they choose. Some of our service providers, such as email and productivity tools, may store or process data outside India. We transfer personal data outside India only where the law allows it, and to providers bound by contracts that require them to protect it.

10. How we protect personal data

We use reasonable technical and organisational safeguards to protect personal data from unauthorised access, loss, misuse and change. On the platform, data is encrypted in transit and at rest, access is set by role so that each person sees only what their role allows, and workflow runs are logged. Our website uses HTTPS, so the data you send through our forms is encrypted in transit. Only NeuronCx staff and service providers who need personal data to do their work can access it, and they are required to keep it confidential.

No method of storing or sending data over the internet is completely free of risk, so we cannot promise that personal data will never be accessed, disclosed, changed or destroyed by a breach of our safeguards.

11. How long we keep personal data

We keep personal data only for as long as we need it for the purpose we collected it for, or as long as the law requires. In practice:

enquiry and demo data is kept while we are in discussion with you or your organisation, and for a reasonable period after that so we can follow up, unless you ask us to delete it sooner;

platform account data and logs are kept for as long as your organisation’s contract with us continues, and then for as long as our contract with the client or the law requires;

billing and accounting records are kept for as long as tax and accounting laws require; and

marketing data is kept until you unsubscribe or withdraw your consent, after which we keep only a record that you opted out, so we do not contact you again.

When we no longer need personal data, we delete it or anonymise it so that it can no longer identify you.

12. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

get information about the personal data we process about you, how we process it, and who we have shared it with;

correct, complete or update personal data that is inaccurate, incomplete or out of date;

erase personal data that we no longer need, unless the law requires us to keep it;

withdraw your consent at any time, where we process your data on the basis of consent;

nominate another person to use these rights on your behalf if you die or are unable to use them yourself; and

have your grievances addressed by us, and if you are not satisfied with our response, complain to the Data Protection Board of India.

To use any of these rights, write to [email protected] with “Privacy” in the subject line. We may ask you to confirm your identity before we act on your request, so that we do not give your data to someone else. If your request is about Customer Data held by one of our clients, see section 6.

13. Children’s data

Our website and platform are built for businesses and institutions and are not directed at children. Under Indian law, a child is anyone under 18 years of age. We do not knowingly collect personal data from children through our website. If you believe a child has given us personal data, please write to [email protected] and we will delete it.

14. Links to other websites and services

Our website links to other websites and services, such as our scheduling tool for booking demos, our support desk, our product documentation and WhatsApp. When you use them, the provider’s own privacy policy applies to the data they collect, and we are not responsible for their practices. We encourage you to read their privacy policies.

15. Personal data breaches

If a breach of personal data that we are responsible for affects you, we will inform you and the Data Protection Board of India as the law requires, and tell you what happened, what we are doing about it and what you can do to protect yourself. If a breach affects Customer Data, we will inform the client concerned so that it can meet its own duties.

16. Changes to this policy

We may update this policy from time to time, and the date at the top of this page shows when it last changed. Where a change is significant, we will tell clients and subscribers by email or within the platform before it takes effect.

17. Grievance officer and contact

If you have a question or complaint about this policy or how we handle your personal data, you can write to our Grievance Officer at [email protected], in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Please write “Privacy” in the subject line so your message reaches the Grievance Officer directly. We will acknowledge your message within 24 hours and aim to resolve it within 15 days of receiving it, and we will tell you if we need longer.

Neuron Cognitive OPC Private Limited, Bengaluru, Karnataka, India