GDPR Compliance
How we collect, process, store and transfer the personal data of people in the European Union and European Economic Area under the GDPR.
- Effective Date
- October 26, 2026
- Document Version
- v2.4 (EU Market Edition)
- Regulation
- (EU) 2016/679
1. Introduction & Scope
Dinjan Infotech ("Company", "we", "us", or "our") is committed to protecting the privacy, security, and personal data of our clients, website visitors, employees, and software end-users within the European Union (EU) and European Economic Area (EEA). This document sets forth our policy regarding the collection, processing, storage, and transfer of Personal Data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).
2. Legal Bases for Data Processing
In accordance with Article 6 of the GDPR, Dinjan Infotech processes personal data only where a valid lawful basis exists. The table below outlines our primary processing activities and their corresponding legal grounds:
| Category of Data | Purpose of Processing | GDPR Legal Basis (Art. 6) |
|---|---|---|
| Client Contact Data (Name, Email, Business Phone) | Service delivery, contract negotiation, account management. | Art. 6(1)(b) - Performance of Contract |
| Technical Data (IP Address, Device Logs, Cookies) | Platform security, IT diagnostic logging, website optimization. | Art. 6(1)(f) - Legitimate Interest |
| Marketing Leads (Inquiry details, Newsletter signups) | Sending promotional communications, service updates. | Art. 6(1)(a) - Explicit Consent |
| Financial & Billing Data (Invoices, Tax IDs) | Tax compliance, invoicing, statutory audit maintenance. | Art. 6(1)(c) - Legal Obligation |
3. Core Principles of Data Protection
Dinjan Infotech adheres strictly to the fundamental principles established in GDPR Article 5:
- Lawfulness, Fairness, and Transparency: Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
- Purpose Limitation: Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimization: Adequate, relevant, and limited strictly to what is necessary in relation to the operational context.
- Accuracy: Kept accurate and, where necessary, up to date. Erasure or rectification is carried out without delay.
- Storage Limitation: Kept in a form permitting identification of data subjects for no longer than is necessary.
- Integrity and Confidentiality: Processed using appropriate security measures against unauthorized or unlawful processing, loss, or damage.
4. Rights of Data Subjects (EU/EEA Residents)
Under Chapter III of the GDPR, individuals whose personal data is processed by Dinjan Infotech possess specific statutory rights. We provide dedicated workflows to fulfill these requests within 30 calendar days:
- Right to Access (Art. 15): Request confirmation of whether your data is being processed and obtain a copy of personal records.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data held by us.
- Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of data where processing is no longer necessary or consent is withdrawn.
- Right to Restriction of Processing (Art. 18): Request temporary suspension of data processing under legitimate dispute conditions.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON/CSV).
- Right to Object (Art. 21): Object at any time to data processing based on legitimate interests or direct marketing profiling.
5. International Data Transfers (Third-Country Transfers)
As Dinjan Infotech operates technical development centers and operations outside the EEA (including India), transfers of personal data from the EU/EEA to non-adequate third countries are governed by strict safeguard protocols under GDPR Chapter V.
To maintain full regulatory compliance, Dinjan Infotech implements:
- Standard Contractual Clauses (SCCs): Implementation of EU Commission-approved Standard Contractual Clauses (Controller-to-Processor / Controller-to-Controller) with all offshore facilities and vendors.
- Transfer Impact Assessments (TIAs): Regular evaluations of third-country legal frameworks to ensure imported data receives an equivalent level of protection.
- Supplementary Safeguards: Application of end-to-end encryption in transit (TLS 1.3) and at rest (AES-256) to mitigate external regulatory surveillance risks.
6. Technical & Organizational Security Measures (TOMs)
Pursuant to GDPR Article 32, Dinjan Infotech maintains robust security protocols designed to prevent unauthorized access, alteration, disclosure, or destruction of personal data:
| Security Domain | Implemented Safeguard Measures |
|---|---|
| Access Control | Role-Based Access Control (RBAC), mandatory Multi-Factor Authentication (MFA), strict Principle of Least Privilege. |
| Data Encryption | AES-256 bit encryption for data at rest; TLS 1.3 encryption for data in transit; key management via dedicated KMS. |
| Network Security | Next-Gen Firewalls (NGFW), Intrusion Detection/Prevention Systems (IDS/IPS), regular vulnerability scanning. |
| Incident Response | 24/7 SIEM monitoring, automated alerts, and defined escalation pathways for potential security events. |
7. Personal Data Breach Notification
In the event of a physical or technical security incident affecting personal data, Dinjan Infotech adheres strictly to Articles 33 and 34 of the GDPR:
- Supervisory Authority Notification: In the event of a data breach posing a risk to the rights and freedoms of natural persons, Dinjan Infotech will inform the competent EU Lead Supervisory Authority within 72 hours of becoming aware of the breach.
- Data Subject Communication: If the breach is likely to result in a high risk to the rights and freedoms of individuals, affected data subjects will be notified without undue delay.
- Breach Documentation: All security incidents, details of affected records, impacts, and remedial actions taken are formally documented in our Internal Breach Register.
8. Vendor Management & Sub-Processors
Dinjan Infotech engages third-party service providers (cloud infrastructure, CRM tools, payment processors) to support business operations. All third-party sub-processors undergo rigorous data privacy audits and are contractually bound through Data Processing Agreements (DPAs) under GDPR Article 28.
Key processing partners must satisfy technical security compliance, agree to audit rights, and guarantee that data processing occurs exclusively under written instructions from Dinjan Infotech.
9. Policy Governance & Contact Information
This GDPR policy is reviewed annually or upon material changes to regulatory frameworks. For inquiries, exercising data subject rights, or reporting potential compliance concerns, please contact our Data Protection Officer: