Privacy Policy

1. Scope & Definitions

This policy explains how we collect, use, share and protect personal data when you visit our website, engage with our services, apply for careers, or interact with our AI assistant. "Personal data" means any information relating to an identified or identifiable natural person, including any "personal data" under the EU GDPR and "personal data" under the India Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Information We Collect

• Contact & lead data: name, work email, company, role, phone (optional), goal, timeline — submitted via forms.
• Assessment data: answers you provide in the AI Readiness Assessment.
• Chatbot transcripts: prompts and responses exchanged with our AI assistant.
• Training interest data: name, email, phone (optional), preferred topic area, and any message submitted when expressing interest in free training sessions.
• Talent/career profile data: name, email, LinkedIn URL, resume or CV content, skill areas, and career interests submitted via the Careers page or directly by email.
• Awareness communications: email address and communication preferences for training updates, newsletter, and relevant awareness content.
• Career applications: resume, LinkedIn URL, cover note, screening answers.
• Usage & device data: IP (hashed), user agent, referrer, pages viewed, session identifiers.
• Workforce solutions data: where you engage our third-party payroll (employer-of-record) or staffing services, we process employee and candidate details supplied by you or the candidate — name, contact details, identifiers required for statutory payroll compliance, bank details for salary disbursement, attendance and payroll inputs. For this data we act as a processor on your instructions, or as an employer of record where we are the contractual employer.
• Cookies: strictly-necessary, analytics, and marketing categories — see Cookie Policy.

3. How We Use Your Information

• Respond to inquiries and deliver contracted services.
• Schedule strategy sessions and readiness assessments.
• Operate and secure the website (fraud, abuse, and rate-limit protection).
• Improve product content and service quality (aggregated, non-identifying analytics).
• Send opt-in updates about services and thought leadership.
• Meet legal, tax, audit and ISO 9001:2015 quality obligations.

Legal bases (GDPR): contract performance, legitimate interests (business development, security), consent (marketing, non-essential cookies), and legal obligation.Grounds under DPDP: consent, or legitimate use where permitted by the Act.

3a. Training and Career Data

When you submit a training interest inquiry, career profile, or resume to ZigmaNeural, we collect the information you provide. This data is used to evaluate suitability for training session invitations, future employment opportunities, and relevant communication. We do not share this data with third parties for marketing. Data submitted for training interest is retained for 12 months and may be deleted on request. You may request access, correction, or deletion of your data by emailing info@zigmaneural.com.

Lawful basis: The lawful basis for processing training and career data is your consent, provided at the time of submission. You may withdraw consent at any time by contacting info@zigmaneural.com.

4. AI-Specific Data Processing & Right to Explanation

When AI features (chatbot, readiness assessment, content generation) process your data:

• Prompts and responses are transiently processed by our AI Gateway to generate replies.
• We do not use client submissions to train foundation models.
• Automated decisions with legal or similarly significant effect are not deployed on this website.
• Right to explanation: where any AI feature contributes to a consequential decision about you, you may request a plain-language explanation of the input factors and their relative weight, and appeal the decision to a human reviewer (GDPR Art. 22 & EU AI Act Art. 86).

5. EU AI Act 2024 Compliance

ZigmaNeural aligns delivery with Regulation (EU) 2024/1689 ("EU AI Act"). Where we design, build or advise on AI systems that may be classified as high-risk, we implement:

• Documented risk-management systems and data-governance controls.
• Technical documentation and event logging suitable for conformity assessment.
• Human-oversight design and clear system-of-record trails.
• Transparency notices for AI-generated or AI-assisted content.
• Explanation interfaces for individual decisions where required.

We refuse to build systems in the prohibited-practice categories (social scoring, unlawful biometric categorisation, manipulative dark patterns).

6. India DPDP Act 2023 Compliance

For personal data of individuals in India we act as a Data Fiduciary or Data Processor as applicable and provide:

• Free, specific, informed, unconditional and unambiguous consent with a clear withdrawal mechanism.
• Data-principal rights: access, correction, erasure, grievance redressal, nomination.
• Purpose limitation, data minimisation, and secure processing.
• Breach notification to the Data Protection Board of India and affected principals within statutory timelines.
• A designated grievance officer reachable at info@zigmaneural.com.

7. Cookie Consent

We use a granular consent banner. Only strictly-necessary cookies load by default. Analytics and marketing cookies load only after your explicit opt-in and can be withdrawn at any time via /cookie-settings. Consent is stored per-browser and re-prompted after material policy changes.

8. Data Retention Schedule

• Contact & lead submissions: 24 months from last interaction.
• AI Readiness Assessment answers: 24 months, then anonymised.
• Chatbot transcripts: 90 days.
• Analytics (hashed IP): 14 months.
• Career applications: 12 months after decision (longer where required by law).
• Contract & billing records: 8 years (statutory audit periods).
• Workforce & payroll records: retained for the statutory period required under applicable Indian labour, tax and social-security law (typically 8 years).
• Security & audit logs: 12 months (extended for active investigations).

9. Third-Party Processors

We rely on the following sub-processors under Data Processing Agreements (DPAs) and, where relevant, EU Standard Contractual Clauses:

• Cloud infrastructure: Amazon Web Services (AWS) — hosting, backups, edge delivery.
• Application platform & database: Supabase (Postgres, Auth, Storage, Edge Functions).
• Front-end hosting & CDN: Vercel.
• Email delivery: Resend.
• AI Gateway & foundation models: Lovable AI Gateway, OpenAI, Google (Gemini), Anthropic (Claude), Azure OpenAI, Groq, Perplexity, OpenRouter.
• Analytics: Google Analytics 4, Microsoft Clarity — consent-gated.
• Scheduling: Cal.com.
• Search & SEO tooling: SerpApi, Bing Webmaster APIs (server-side).

A current sub-processor list is available on request from info@zigmaneural.com.

10. International Data Transfers

Where personal data leaves the EU/EEA, UK or India, we rely on adequacy decisions, EU Standard Contractual Clauses (2021), the UK IDTA/Addendum, or specific consent as appropriate. Transfer Impact Assessments are performed where applicable.

11. Data Security

Current measures include TLS 1.3 in transit with HSTS, encryption at rest, a strict Content Security Policy, origin-restricted CORS, row-level security on all application tables, rate limiting on authentication and public forms, and administrative access to our content platform restricted to a single allowlisted account protected by email one-time-passcode verification and server-enforced password rules.

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-Level Security on all client-facing tables; least-privilege service roles.
• Secrets managed in a dedicated vault; no credentials in source code.
• Continuous vulnerability scanning and quarterly access reviews.
• Incident-response runbooks aligned to GDPR 72-hour and DPDP notification obligations.

12. Your Rights

Subject to applicable law, you may:

• Access, rectify, erase, or port your personal data.
• Restrict or object to processing.
• Withdraw consent at any time (without affecting prior lawful processing).
• Request human review of AI-assisted decisions.
• Lodge a complaint with your supervisory authority (EU DPAs, ICO, or the Data Protection Board of India).

Requests are honoured within 30 days (extendable by 60 days for complex cases).

13. Children's Privacy

Our services are directed at business users and are not intended for individuals under 18. We do not knowingly collect data from children.

14. Changes to this Policy

Material changes are announced on this page with an updated effective date. Continued use of the site after changes indicates acceptance of the revised policy.

15. Data Protection Officer & Grievance Officer

Data Protection Officer: info@zigmaneural.com
Grievance Officer (India, DPDP Act): info@zigmaneural.com
General inquiries: info@zigmaneural.com
Operated by: Zigmapeople Private Limited
Address: India (Global · Remote-First)

Request a Data Processing Agreement (DPA) by emailing info@zigmaneural.com with the subject "DPA Request".