Privacy Policy

Global headquarters. UNIFYING Technologies PVT. LTD., Plot C-55, G Block, Bandra Kurla Complex, Bandra East, Mumbai, 400098, India.

United States headquarters. UNIFYING Technologies LLC, 2524 Tybee Rd, Saint Cloud, FL 34769, USA.

India office (coming soon). Bengaluru — planned.

Europe offices (coming soon). Germany and London — planned.

UNIFYING Technologies PVT. LTD. is the data controller of your personal data under this policy. Our United States headquarters, UNIFYING Technologies LLC, and our other offices process personal data on its instructions when delivering services to you.

Data Protection Officer: dpo@theunifying.com · Privacy team: privacy@theunifying.com · Legal: legal@theunifying.com

Contact information — name, business email, phone number, job title, business address. Used for client communication and project coordination.

Employment data — work history, qualifications, certifications and background check results, for staffing, contractor engagement and compliance.

Technical data — IP address, browser type, device information and cookie identifiers, for website security, analytics and service delivery.

Financial data — billing information, payment details and tax identification numbers, for invoicing and tax compliance.

Project data — communications, deliverables, time records and expense reports, for service delivery and quality assurance.

Software and system data — diagnostics, logs, error reports, configuration, licence and usage information generated by the software and systems we use to deliver our services and products, for operating, securing and improving them.

We collect this directly from you (forms, email, contracts, applications), from client or employer organisations when we engage consultants on their behalf, automatically through cookies, server logs and analytics, and from third parties such as professional references and verification agencies.

EU / UK GDPR. Contract performance (fulfilling consulting agreements); consent (marketing and optional services, withdrawable at any time); legitimate interests (business operations, fraud prevention, network security); legal obligation (tax reporting, employment law, regulatory requirements).

India DPDPA. Consent that is free, specific, informed, unconditional and revocable, plus the legitimate uses set out in Section 6(2) of the Act.

US state laws. Contractual necessity, legitimate business purposes, and consent where a specific state statute requires it.

Essential. Delivering IT consulting and technology services; managing client relationships and project coordination; processing payments and invoicing; securing our networks and information; meeting legal and regulatory obligations.

With consent or legitimate interest. Newsletters and marketing communications; improving our services and website; surveys and feedback; business analytics and performance measurement.

Because we operate across India, the United States and Europe, your personal data may be transferred to and processed in a country other than the one you live in.

Safeguards. EU to India/US: Standard Contractual Clauses. UK to India/US: UK International Data Transfer Agreement or Addendum. India to other countries: permitted destinations as notified under the DPDPA. Within the EEA: the GDPR framework.

Software, cloud and other vendors — relevant project data and contact details, for service delivery such as cloud hosting, licensed software and payroll.

Client organisations — consultant details, timesheets and deliverables, for contract fulfilment.

Professional advisers — legal, audit and tax information, for compliance and advisory services.

Regulatory authorities — disclosures required by law.

Successors — business data in connection with an acquisition or merger.

We do not sell your personal data. For the purposes of the California CPRA and comparable state laws, we also do not "share" personal data for cross-context behavioural advertising without your affirmative opt-in.

When you or your organisation take a licence to software we build, sell or host, we process limited personal data to issue and administer that licence: the name and contact details of named users and licence administrators, the organisation and seats assigned, subscription and renewal dates, and the activation, version and usage records described in section 2.

Why we process it. To issue, verify and transfer licences; to provide support, updates and maintenance; to enforce the licence restrictions set out in section 6 of our Terms and Conditions; and to meet our own audit and tax obligations. We do not use licence or usage data to build marketing profiles about identified individuals.

Who receives it. Licensing, cloud and reseller vendors process this data for fulfilment, hosting and invoicing under contracts that limit them to those purposes (section 6). Where a licence is held by an organisation, its own administrators may view the usage records of its users.

How long we keep it. Licence, activation and entitlement records for the term of the agreement plus 7 years for audit and tax purposes. Aggregate usage statistics are retained in anonymised form, from which no individual can be identified. Requests to correct or delete an individual's usage records follow the process in section 9.

Third-party and open source components. Our software may include third-party or open source components governed by their own licence terms. Those terms do not change how we handle personal data, and we collect no personal data from them beyond the diagnostics described in section 2.

Client contract records — 7 years after the contract ends (tax law, limitation periods).

Employee and consultant records — 8 years after engagement ends (labour and tax compliance).

Payment and billing data — 7 to 10 years depending on jurisdiction.

Website analytics — 13 to 24 months.

Marketing communications — until opt-out, or 24 months of inactivity.

Job application data — 12 to 24 months unless you consent to longer.

EU / UK. Access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent at any time.

India (DPDPA). Grievance redressal through our DPO with escalation to the Data Protection Board; erasure where the purpose is served or consent is withdrawn; the right to nominate another individual to exercise your rights.

United States. Rights vary by state and generally include confirming, accessing, correcting and deleting data, and opting out of sale, sharing or targeted advertising.

How to exercise them. Email privacy@theunifying.com or write to our Global headquarters, UNIFYING Technologies PVT. LTD., Plot C-55, G Block, Bandra Kurla Complex, Bandra East, Mumbai, 400098, India, or our United States headquarters, UNIFYING Technologies LLC, 2524 Tybee Rd, Saint Cloud, FL 34769, USA. Response times: 30 calendar days under GDPR/UK GDPR (extendable to 60 for complex requests), 30 days under the DPDPA, and 45 days under the California CPRA (extendable by a further 45 days with notice).

We do not knowingly collect personal data from anyone under 18. The DPDPA requires verifiable parental consent for under-18s and prohibits tracking, behavioural monitoring and targeted advertising directed at children; US COPPA applies stricter protections for children under 13.

Strictly necessary — essential to site operation, session-based, cannot be disabled.

Functional — remember preferences, 12 to 24 months, controllable in your browser.

Analytics — measure usage and performance, 13 to 24 months, opt-out available.

Marketing — 6 to 12 months, controllable via advertising ID reset and opt-out links.

We apply industry-standard controls: encryption in transit (TLS 1.2+) and at rest (AES-256), multi-factor authentication on internal systems, regular patching, network firewalls and intrusion detection, and a secure software development lifecycle with code review, dependency scanning and vulnerability patching across the software we build and operate.

EU GDPR and UK GDPR: notification to the supervisory authority or ICO within 72 hours, and to affected individuals without undue delay where there is a high risk. India DPDPA: notification to the Data Protection Board and affected individuals within the prescribed timeframe.

We may use automated systems for résumé screening and security threat detection. You have the right not to be subject to solely automated decisions with legal or similarly significant effects — contact dpo@theunifying.com.

Contact our DPO first and we will investigate. You may also complain to your supervisory authority: your EU member state authority, the UK ICO, the Data Protection Board of India, or your state attorney general in the US.

We may update this policy periodically. Material changes will be posted on this page at least 30 days before taking effect and, where applicable, emailed to active users.