Privacy Policy

This policy explains how UVXYZ Labs Private Limited (“UVXYZ”, “we”, “us”) collects and uses personal data when you visit uvxyz.in, contact us, apply for a role or book a meeting with our team. It is written to meet India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the EU and UK GDPR, the EU ePrivacy rules and UK PECR, and US state privacy laws such as the CCPA/CPRA where they apply.

1. Who we are

UVXYZ Labs Private Limited (CIN U62010TS2025PTC193339) is a software company registered in India. We are the data fiduciary (DPDP Act) and data controller (GDPR) for the personal data described here.

When we build or run software for a client and process their customers’ data, we act on the client’s instructions as a processor under our contract with them. That processing is covered by the client’s own privacy notice and our agreement with the client, not by this policy.

2. What we collect

• Project enquiries: name, work email, company, job title, website, industry, company size, services of interest, budget, timeline, project details, how you heard about us, and your consent to be contacted. If we ask you to confirm your email with a one-time code, we use that code only for verification.
• Job applications: name, email, phone, experience, current company, notice period, profile links (such as LinkedIn) and anything you include in your note.
• Job support and service requests: name, email, phone, the technology you need help with, and your request details. Details you type into this form may be saved as you fill it in, so that we can follow up if the submission does not complete.
• Meeting bookings and task suggestions through a team member’s booking page: name, email, phone, venue preference and agenda notes.
• Emails and calls: what you send us when you write to us directly.
• Technical data: IP address, approximate country, browser and device type, pages viewed and referring site. Our servers and our network provider (Cloudflare) record this for security and to keep the site running.
• Analytics and advertising data, only if you accept optional cookies: cookie identifiers, pages visited, campaign parameters (such as utm_source or gclid) and events such as form submissions. If you do not accept, Google Analytics runs in consent mode and sends only limited, cookieless measurement pings (for example, that a page was viewed): no analytics cookies are set and no identifiers are stored on your device. See our Cookie Policy.

We do not ask for sensitive data through the public website, and we ask you not to include it in messages. Team members joining UVXYZ provide employment details through a separate onboarding link, which is used only for employment, payroll and legal compliance.

3. Why we use it and our legal bases

• To reply to your enquiry, prepare proposals and take steps before a contract. GDPR basis: steps at your request before entering a contract, and our legitimate interest in responding to business enquiries. DPDP basis: your consent, or data you have voluntarily provided for that purpose.
• To deliver and manage services under a contract. GDPR basis: performance of a contract.
• To assess job applications. GDPR basis: steps before entering a contract and legitimate interests. DPDP basis: consent.
• To schedule and hold meetings you book. GDPR basis: steps at your request and legitimate interests.
• To keep the site and our systems secure, prevent spam and abuse, and keep records. GDPR basis: legitimate interests and legal obligations.
• To measure site use and advertising performance with optional cookies. Basis: your consent, which you can withdraw at any time from Cookie settings in the footer.
• To meet tax, accounting and other legal obligations. Basis: legal obligation.

We do not sell personal data. We do not use automated decision-making that has legal or similarly significant effects on you.

4. How long we keep it

• Enquiries that do not become projects: up to 24 months after our last contact with you.
• Client and contract records: for the engagement, then up to 8 years to meet Indian accounting and tax requirements.
• Job applications: up to 12 months after the role closes, unless you agree that we may keep them longer.
• Meeting bookings: up to 12 months after the meeting.
• Analytics data: up to 14 months. Server and security logs: usually no more than 90 days.

After these periods we delete or anonymise the data, unless the law requires us to keep it longer.

5. Who we share it with

We share personal data only with service providers that help us run our business, under contracts that limit their use of it:

• Amazon Web Services: hosting, database and transactional email (Amazon SES), in the AWS Asia Pacific (Hyderabad) region.
• Cloudflare: content delivery, security, privacy-friendly site statistics without cookies, and file storage.
• Google (Workspace/Gmail): business email. Google Analytics runs in consent mode: without your consent it sends only limited, cookieless measurement pings, and with your consent it uses analytics cookies. Google Tag Manager and Google AdSense run only with your consent.
• Meta Platforms: the Meta Pixel, for advertising measurement, only with your consent.
• ImprovMX: forwarding of email sent to our domain addresses.

We may also share data with professional advisers, or where required by law, a court or a public authority, or as part of a merger or acquisition subject to confidentiality.

6. International transfers

We are based in India and store website data mainly in India. Some providers, such as Google, Meta and Cloudflare, process data in the United States and other countries. When personal data from the EU, EEA or UK is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified. You can ask us for more information about these safeguards.

7. Your rights

Depending on where you live, you can:

• ask for a copy or summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to delete it;
• object to or ask us to restrict processing, including direct marketing;
• receive your data in a portable format (EU/UK);
• withdraw consent at any time, without affecting processing that happened before;
• nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
• in California and other US states with privacy laws: know, access, correct and delete your data, and opt out of the “sharing” of personal data for cross-context behavioural advertising. You can opt out by choosing Reject in Cookie settings; we also treat a Global Privacy Control signal as an opt-out. We will not treat you differently for using these rights;
• raise a grievance with us, and complain to a regulator (see below).

To use any of these rights, email hello@uvxyz.in with the subject “Privacy request”. We may need to confirm your identity. We aim to respond within 30 days, and always within the time required by law. Requests are free unless they are clearly unfounded or excessive.

8. Grievance Officer

For questions or complaints about how we handle personal data, including under the DPDP Act, contact:

If you are not satisfied with our response, you can complain to the Data Protection Board of India. In the EU or EEA you can complain to your local data protection authority, and in the UK to the Information Commissioner’s Office (ico.org.uk).

9. Children

Our website and services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

10. Security

We use encryption in transit (HTTPS), access controls, authentication for our internal tools, and limited staff access to protect personal data. No system is completely secure; if a breach affects your data, we will notify you and the relevant authorities as the law requires.

11. Marketing emails

Emails we send in reply to an enquiry, application or booking are service messages. If we send marketing emails, they will identify UVXYZ Labs Private Limited, include our postal address, and include a simple way to unsubscribe. You can also opt out at any time by emailing hello@uvxyz.in.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “last updated” date and, for significant changes, let you know where appropriate.