Privacy Policy

CyberLynk LLP, a Limited Liability Partnership incorporated in India ("CyberLynk", "we", "us") operates the Partha application-security platform and this portal at partha.cyberlynk.in. For the personal data we handle through this portal, we are the Data Fiduciary and you, the user, are the Data Principal, as those terms are used in India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). This notice explains what personal data we collect, why, how we protect it, and the rights you have.

1. Personal data we collect

• Account details you provide at sign-up: full name, email address, phone number, organisation name and organisation type.
• Authentication data: a one-way hash of your password (never the password itself) and, if you enable it, your two-factor authentication secret.
• Verification data: a short-lived one-time code we email to confirm you own the address you registered.
• Licensing & transaction data: orders, the licence(s) issued to you, and payment metadata (order id, payment id, amount, status). Card/UPI/bank details are handled entirely by our payment processor and are never seen or stored by us.
• Technical & usage data: your IP address, timestamps, browser user-agent and audit records of security-relevant actions, and the strictly-necessary cookies described in our Cookie Policy.
• Communications you send us (e.g. support emails).

We do not use advertising or third-party tracking cookies, and we do not sell your personal data.

2. Why we use it, and our lawful basis

Under the DPDP Act we process personal data only for lawful purposes, on the basis of your consent or a legitimate use permitted by the Act:

• To provide the service — create and secure your account, verify your email, issue and manage your licence, and provide support. (Necessary to deliver the service you asked for.)
• Security & fraud prevention — authentication, rate-limiting, audit logging and abuse prevention. (Legitimate use / our duty to keep data secure.)
• Payments & record-keeping — to process purchases and keep the financial records Indian law requires.
• Product updates & marketing — only if you opt in; you can withdraw at any time (see below).
• Legal compliance — to meet obligations and respond to lawful requests.

3. Consent and how to withdraw it

Where we rely on consent, we ask for it with a clear, specific, affirmative action (an un-ticked box you choose to tick) and we record the version of this policy you agreed to and when. Your consent is as easy to withdraw as it was to give:

• Turn product-update emails on or off any time under Account → Privacy & your data.
• Withdraw consent entirely by deleting your account (same page), or by emailing our Grievance Officer.

Withdrawing consent does not affect processing already carried out, and we may still keep the minimum data the law requires us to retain.

4. Who we share it with (our processors)

We share personal data only with the service providers ("Data Processors") needed to run the platform, under contract and only for these purposes:

• Payment processor — to take payments securely (they receive the payment details you enter directly; we receive only the transaction result).
• Email provider (Zoho) — to deliver verification codes, your welcome message and account emails. All our email is sent from contact@cyberlynk.in.
• Hosting provider — servers located in India that run this portal.

We may also disclose data where required by law or to protect our rights and users. We do not transfer your personal data outside India except as permitted under the DPDP Act, and we do not sell it to anyone.

5. How we protect your data

We apply reasonable security safeguards as required by section 8(5) of the DPDP Act, including:

• Encryption in transit (HTTPS/TLS 1.2+); HSTS; strict Content-Security-Policy and other hardening headers.
• Passwords stored only as salted Argon2id hashes; licence keys held in an encrypted store, not in plaintext.
• Role-based access control, object-level authorisation (you can only reach your own data), and per-account and per-network rate limits.
• Mandatory two-factor authentication for staff; CSRF, origin checks and HttpOnly, SameSite=Strict, Secure cookies.
• Audit logging of security-relevant events, data minimisation, and prompt patching.

If a personal-data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

6. How long we keep it

We keep your account data for as long as your account is active. When you delete your account we erase your personal profile without undue delay. Where the law requires us to keep certain records — chiefly financial and tax records relating to purchases — we retain the minimum necessary (generally 8 years) in a reduced, de-identified form, after which it is deleted. Backups are rotated and expire on a defined cycle.

7. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it — see Account → Privacy & your data, where you can also download your data.
• Correct, complete or update your data — edit it in your account or ask our Grievance Officer.
• Erase your data — delete your account yourself at any time from the same page (subject only to records we must keep by law).
• Grievance redressal — a readily available means to raise a complaint (below).
• Nominate another person to exercise your rights in the event of death or incapacity — contact us to record a nominee.

We will act on verified requests within the timelines set by the DPDP Act and its rules.

8. Children

Partha is a professional security tool intended only for users aged 18 or over. We do not knowingly collect the personal data of children. We do not carry out any tracking, behavioural monitoring or targeted advertising directed at children. If you believe a minor has created an account, contact our Grievance Officer and we will delete it.

Grievance Officer & complaints

If you have any question or complaint about how your personal data is handled, or wish to exercise any of your rights, contact our Grievance Officer:

Officer

The Grievance Officer, CyberLynk LLP

Email

contact@cyberlynk.in

Phone

+91 9395123493

Address

Visakhapatnam, Andhra Pradesh, India

We acknowledge grievances promptly and aim to resolve them within 30 days. If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India established under the Digital Personal Data Protection Act, 2023.

Changes to this policy

We may update this policy; the version and effective date above will change and, where the update is material, we will ask for fresh consent. Continued use after an update means you accept the current version.

Questions? Email contact@cyberlynk.in.