1. Policy Statement
Vmatic Global Technologies Private Limited is committed to protecting information handled in connection with VMATIC Shield. This Policy establishes the baseline principles for collection, access, use, disclosure, storage, security and disposal. It is intended to be supported by technical standards, operational procedures, contracts and periodic reviews.
2. Governance and Accountability
Vmatic will assign appropriate responsibility for privacy and security governance, maintain a record of processing activities where required, define ownership for systems and datasets, and review compliance with applicable law and contractual commitments. Staff and service providers with access to protected information must follow confidentiality and acceptable-use requirements.
3. Data Minimisation and Purpose Limitation
Only information reasonably necessary for a defined and disclosed purpose should be collected. New data categories, permissions, analytics tools, SDKs or integrations must undergo a privacy and security review before release. Information must not be repurposed in a materially incompatible way without an appropriate lawful basis and notice or consent where required.
4. Access Control
Access must be role-based, approved, limited to the minimum required and reviewed periodically. Privileged access should use strong authentication and be logged. Shared accounts should be avoided; access should be removed promptly when a person changes role or leaves. Production data must not be used in development or testing unless appropriately authorised and protected, with de-identification preferred.
5. Encryption and Secure Transfer
Sensitive and personal data should be protected in transit using current secure transport protocols. Encryption at rest should be applied where appropriate to the data classification, architecture and threat model, with encryption keys managed separately and access restricted. Secrets and credentials must not be embedded in public code or logs.
6. Secure Development and Change Management
Software development should incorporate threat modelling, code review, dependency management, vulnerability scanning, secure configuration, testing and controlled release practices proportionate to risk. Security-sensitive changes to permissions, data collection, third-party SDKs or risk models must be documented and approved before release.
7. Logging, Monitoring and Incident Response
Security logs should capture relevant access and system events without unnecessarily recording sensitive content. Logs must be protected against unauthorised access and alteration. Suspected incidents should be triaged, contained, investigated, documented and remediated under an incident-response process. Required notifications to affected users, customers or authorities must be made within applicable legal timelines.
8. Vendors and Enterprise Customers
Third parties handling protected information should be assessed according to risk and bound by written terms covering purpose limitation, confidentiality, security, breach reporting, retention, deletion and subcontracting as appropriate. Enterprise integrations must define data flows, responsibilities, access boundaries and incident escalation routes.
9. Retention, Backup and Disposal
Retention schedules should be documented for each data category and aligned with purpose, contractual requirements and applicable law. Expired information must be securely deleted, anonymised or otherwise disposed of. Backups should have defined retention periods and access controls. Legal holds and incident investigations may require a documented exception.
10. Training, Audit and Review
Personnel with relevant access should receive privacy and security awareness training. Controls should be reviewed periodically and after material changes or incidents. Where appropriate, internal checks or independent assessments should verify that documented controls operate as intended. This policy does not by itself certify compliance with any standard.
11. Legal Alignment and Exceptions
Implementation must be assessed against applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as applicable and in force at the relevant time, as well as other applicable information-technology, contractual and sectoral requirements. Commencement and transitional provisions must be checked for each obligation.
Any exception must be documented, risk-assessed, approved by an authorised owner and time-limited. This Policy must be reviewed at least annually or when significant legal, product or architectural changes occur.
12. Contact
Questions or requests related to data protection may be sent to business@vmatic.in with the subject “VMATIC Shield Data Protection”.
Contact
Vmatic Global Technologies Private Limited
Product: VMATIC Shield
Website: vmaticshield.com
Privacy and policy queries: business@vmatic.in — please use the relevant policy name in the email subject.
↑ Back to top