GLOBAL PRIVACY & DATA PROTECTION POLICY

1. Global Reach & Regulatory Compliance Scope

Magnence LLC ("Magnence", "Company", "we", "our", or "us") serves enterprise clients, software partners, and end-users globally across North America, Europe, the United Kingdom, Asia-Pacific (APAC), the Middle East, and Latin America. As an organization headquartered in India with global operations, this Privacy Policy governs our cross-border data processing operations in compliance with international and domestic privacy mandates, including but not limited to:

• India: The Information Technology Act, 2000 (IT Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Digital Personal Data Protection Act, 2023 (DPDP Act).
• European Union & UK: General Data Protection Regulation (EU GDPR), UK Data Protection Act 2018 (UK GDPR), and the ePrivacy Directive 2002/58/EC.
• United States: California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and applicable federal data privacy standards.
• APAC & Global: Singapore Personal Data Protection Act (PDPA), Australian Privacy Principles (APPs), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Japan's Act on the Protection of Personal Information (APPI), and South Korea's Personal Information Protection Act (PIPA).

2. Categories of Information Collected

We process categories of data strictly required for international software development contracts, enterprise discovery, and cloud infrastructure operations:

• Corporate & Contact Credentials: Names, business email addresses, corporate titles, phone numbers, and regional billing addresses provided during contract execution, proposal requests, or discovery calls.
• Sensitive Personal Data or Information (SPDI): Under Indian IT Rules 2011 and DPDP Act 2023, SPDI such as financial payment instruments or biometric authentication data is processed exclusively through PCI-DSS compliant third-party gateways and zero-trust identity providers. We do not store raw SPDI on our servers.
• Client Engineering & Code Assets: Source code repositories, database schemas, API specs, and technical documentation explicitly covered under strict Non-Disclosure Agreements (NDAs).
• Telemetry & Infrastructure Data: Anonymized IP addresses, browser type, session timestamps, and diagnostic metrics collected automatically to maintain DDoS defense, infrastructure uptime, and security monitoring.
• Communication Records: Email correspondence, discovery call recordings (with prior consent), and project-related communications stored for contractual fulfillment and audit purposes.

3. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contractual Necessity: Processing required to execute Statements of Work (SOWs), Master Services Agreements (MSAs), and related engineering contracts.
• Legitimate Interest: Infrastructure security monitoring, fraud prevention, and service improvement analytics performed on aggregated, non-identifiable data.
• Legal Obligation: Compliance with tax laws (Indian GST, TDS), anti-money laundering regulations, and statutory record-keeping requirements under the Indian Companies Act, 2013.
• Consent: Where required by applicable law, such as for marketing communications or recording discovery calls. Consent may be withdrawn at any time by contacting legal@magnence.com.

4. Cross-Border Transfer Mechanisms

For data transferred internationally between our Global HQ in Bangalore, regional offices in India (Gurugram, Hyderabad), and client infrastructure globally, Magnence enforces Standard Contractual Clauses (SCCs) approved by the European Commission, UK International Data Transfer Agreements (IDTAs), and Data Transfer Impact Assessments (DTIAs). We strictly adhere to data localization rules mandated by the Reserve Bank of India (RBI) and the DPDP Act where applicable. For US-EU transfers, we comply with the EU-US Data Privacy Framework where applicable.

5. Zero Data Commercialization Guarantee

Magnence LLC strictly guarantees that client code, proprietary business data, and user personal data will never be sold, rented, monetized, traded, or shared with third-party data brokers, advertising networks, or AI model training providers under any circumstances. Data sharing is limited exclusively to authorized sub-processors under strict Data Processing Agreements (DPAs).

6. Authorized Sub-Processors

We engage the following categories of sub-processors, each bound by DPAs:

• Cloud Infrastructure: Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure — for hosting, compute, and data storage.
• Version Control & CI/CD: GitHub, GitLab — for source code management and deployment pipelines.
• Communication: Google Workspace, Slack — for project communications and email.
• Payment Processing: Razorpay (India), Stripe (International) — PCI-DSS Level 1 certified payment gateways. We never store card numbers or CVVs on our systems.

7. Enterprise Security & Encryption

All client data is protected using zero-trust network access (ZTNA), TLS 1.3 in-transit encryption, AES-256 at-rest encryption, role-based access control (RBAC), multi-factor authentication (MFA), continuous automated SAST/DAST vulnerability scanning, and secrets rotation in CI/CD pipelines. Infrastructure access is logged and auditable.

8. Data Retention & Deletion

We retain data only as long as necessary for its stated purpose:

• Active Project Data: Retained for the duration of the project engagement plus the 90-day warranty period.
• Contract & Financial Records: Retained for 8 years as required by the Indian Companies Act, 2013 and applicable tax statutes (Income Tax Act, GST Act).
• Client Source Code: Transferred to the client upon project completion. Our copies are securely deleted within 30 days of final handover, unless ongoing maintenance is contracted.
• Communication Logs: Retained for 2 years post-project for dispute resolution, then permanently deleted.
• Infrastructure Logs: Anonymized server logs retained for 90 days for security monitoring, then purged.

9. Automated Decision-Making & AI Processing

Magnence does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals accessing our website. For AI systems built for clients, automated decision-making safeguards are documented in our AI Ethics & Governance Policy.

10. Children's Privacy

Magnence services are designed for enterprise clients and B2B engagements. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, it will be deleted within 72 hours of discovery.

11. Data Breach Notification

In the event of a confirmed personal data breach, Magnence will notify affected clients and relevant supervisory authorities within 72 hours of discovery, as required under GDPR Article 33, the DPDP Act, and applicable breach notification laws. Notification will include the nature of the breach, estimated impact, and remediation measures taken.

12. Cookies & Tracking

Magnence does not deploy third-party analytics, advertising cookies, or behavioral tracking pixels. For full details on our browser storage practices, see our Cookie Policy.

13. Your Rights

Regardless of your geographical location, you possess the following rights under applicable law:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Restriction: Request we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, commonly used format (GDPR/DPDP).
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• CCPA/CPRA Rights: California residents may request disclosure of data collected, opt out of data sales (we do not sell data), and exercise the right to non-discrimination.
• DPDP Act Rights: Indian data principals may exercise rights to access, correction, erasure, and grievance redressal under the Digital Personal Data Protection Act, 2023.

14. Grievance Officer & Contact

In accordance with the IT Rules 2011 and DPDP Act 2023, we have appointed a Grievance Officer. To exercise any of your legal rights, submit a data subject access request, or contact our Grievance Officer & Global Data Protection Officer (DPO), email legal@magnence.com. All requests will be acknowledged within 48 hours and resolved within one (1) month from receipt.

15. Policy Updates

This policy may be updated periodically to reflect changes in applicable law, our processing practices, or regulatory guidance. Material changes will be posted on this page with an updated effective date. Continued use of our services after any modification constitutes acceptance of the updated policy.