Privacy Policy

This Privacy Policy explains how Xbreyins India Private Limited ("Xbreyins", "we", "us", "Data Fiduciary") processes digital personal data when you use https://www.xbreyins.com and when you submit forms on this site.

It is prepared with reference to the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") and the rules notified thereunder, as applicable to our role as a Data Fiduciary for data collected through this website.

This policy does not describe processing we perform solely as a Data Processor on behalf of a client under a signed services agreement. In those cases the client is the Data Fiduciary and their privacy terms apply.

Data Fiduciary: Xbreyins India Private Limited

Registered office: #404, Balaji Tower, Wedia Colony, Miyapur, Hyderabad, Telangana 500049, India

General contact: info@xbreyins.com

Grievance / data rights: info@xbreyins.com (subject line: "DPDP grievance" or "Data principal request")

We collect only what is necessary for the purpose you choose:

• Enquiries — name, work email, phone, company, role details (for staffing), programme interest (for training), and message content.
• Careers — name, contact details, experience, résumé/CV, portfolio or LinkedIn URL you provide.
• Newsletter — email address.
• Technical data — IP address, browser/device type, pages viewed, and referral source, collected through analytics only after you consent via the cookie banner.

We do not intentionally collect special categories of personal data through this website. Please do not include government IDs, health data, or financial account details in free-text fields.

We process personal data for these purposes:

• To respond to enquiries, proposals, admissions, and job applications.
• To send newsletters you subscribe to, until you withdraw consent or unsubscribe.
• To operate, secure, and improve the website (including aggregated analytics with consent).
• To comply with applicable law, respond to lawful requests, and establish or defend legal claims.

For form submissions and marketing email, our primary ground under the DPDP Act is your consent, obtained through the consent checkbox at submission. For analytics cookies, consent is collected separately in the cookie banner.

We do not sell personal data or use your enquiry content to train third-party AI models.

When you submit a form, you must tick the consent box confirming you agree to processing as described in this policy. Without that consent we will not process your submission.

You may withdraw consent at any time by writing to info@xbreyins.com. Withdrawal does not affect processing that was lawful before withdrawal. Where consent was the only basis, we will stop processing and delete data unless another ground applies.

If we offer a Consent Manager mechanism on this site in future, you may use it to manage consent preferences; until then, email us to withdraw or update preferences.

Subject to the DPDP Act, you may:

• Access a summary of personal data we process about you and the processing activities.
• Correction and erasure of inaccurate data, or deletion where we have no continuing lawful need.
• Grievance redressal regarding our processing.
• Nominate another individual to exercise your rights in the event of death or incapacity (as permitted by law).

To exercise these rights, email info@xbreyins.com with enough detail for us to verify your identity. We aim to respond within timelines prescribed under applicable law.

If you are not satisfied with our response, you may approach the Data Protection Board of India as provided under the DPDP Act.

• Sales and general enquiries not converted to a contract: up to 24 months, then deleted unless you ask us to delete sooner.
• Client records under contract: for the contract term and as required for statutory, tax, and audit purposes (typically up to 8 years where applicable).
• Job applications: up to 12 months unless you request earlier deletion.
• Newsletter: until unsubscribe or withdrawal of consent.
• Analytics: per our analytics provider retention (currently 14 months where Google Analytics 4 is enabled with consent).

We use service providers who process data only on our instructions and under appropriate contracts, including:

• Hosting and infrastructure (website delivery and logs).
• Transactional email (form delivery and acknowledgements).
• Analytics (only with cookie consent).
• Scheduling / chat embeds when you choose to use them.

We may disclose data where required by law or to protect rights, safety, and security. We do not share enquiry data with advertising networks.

Some processors may store or process data outside India. Where the DPDP Act requires it, we rely on permitted transfer mechanisms (such as standard contractual clauses or government-notified jurisdictions) and assess that appropriate safeguards exist.

We use HTTPS, access controls, and organisational measures appropriate to the risk. Form submissions are transmitted over TLS and stored in systems with restricted access.

No method of transmission over the internet is completely secure. For highly confidential commercial information, ask us for a secure channel rather than using a web form.

If we become aware of a personal data breach likely to affect you, we will take steps required under the DPDP Act, which may include notifying the Data Protection Board and affected Data Principals where mandated.

This website is not directed at children. We do not knowingly process personal data of children without verifiable consent of a parent or lawful guardian, as required under the DPDP Act. Training enquiries for applicants under 18 should be submitted by a parent or guardian.

We update this policy when our practices or legal requirements change. The "Last updated" date at the top reflects the current version. Material changes will be highlighted on this page for a reasonable period before taking effect where required.

See also our Cookie Policy and Terms of Use.