GDPR Statement

1. Overview

The General Data Protection Regulation (EU) 2016/679 (“GDPR”) is a regulation in EU law on data protection and privacy. It also applies to the processing of personal data of individuals in the United Kingdom under the UK GDPR (as retained in UK law post-Brexit).

DataMatrix Technology Solutions Pvt. Ltd. (“we”, “us”, or “our”) is an India-based IT services company. While we are not established in the EEA or UK, the GDPR applies to us when we process personal data of individuals located in those regions — for example, when an EEA or UK-based organisation engages our services or when EEA/UK residents visit our website. This statement explains how we meet those obligations.

2. Our role under GDPR

Depending on the context, we act in one of two capacities under the GDPR:

Where we act as a Processor, we enter into a Data Processing Agreement (DPA) with the Controller that sets out our obligations in line with Article 28 GDPR. Please contact us to request our standard DPA.

3. Lawful bases for processing

We process personal data only when we have a lawful basis under Article 6 GDPR. The bases we rely on are:

• Article 6(1)(a) — Consent: For non-essential cookies, marketing communications, and any processing where we have explicitly asked for and received your consent. You may withdraw consent at any time.
• Article 6(1)(b) — Contract: For processing necessary to perform a contract with you or to take pre-contractual steps at your request — for example, setting up a project engagement or a platform account.
• Article 6(1)(c) — Legal obligation: Where we must process data to comply with applicable law — for example, retaining financial records for tax purposes.
• Article 6(1)(f) — Legitimate interests: For website security monitoring, fraud prevention, and improving our services, provided our interests are not overridden by your fundamental rights and freedoms.

Where we process special category data (Article 9 GDPR), we identify an additional condition under Article 9(2) and document it accordingly. We do not routinely process special category data.

4. Data subject rights

If you are located in the EEA or UK, you have the following rights under the GDPR. We will respond to all verified requests within one calendar month (extendable by two further months for complex requests, with notice).

To exercise any of these rights, submit a written request to business@dmtspl.com. We may need to verify your identity before processing the request.

5. International data transfers

DataMatrix Technology Solutions Pvt. Ltd. is based in India. When we process personal data of EEA or UK residents, this constitutes an international transfer of personal data to a third country. We ensure adequate safeguards are in place for such transfers, including:

• Standard Contractual Clauses (SCCs): Where required, we incorporate the European Commission’s approved SCCs (2021 edition) or the UK International Data Transfer Addendum (IDTA) into our data processing agreements.
• Transfer Impact Assessments (TIAs): We conduct TIAs where required to assess whether SCCs provide effective protection in the context of data transfers to India.
• Sub-processors: Where we engage sub-processors (e.g., AWS for cloud infrastructure), we ensure appropriate transfer mechanisms are in place with those parties.

You may request a copy of the relevant transfer safeguards by contacting us at business@dmtspl.com.

6. Data retention

We retain personal data for the minimum period necessary to fulfil the purpose for which it was collected or as required by law. Our general retention schedule:

7. Security measures

We implement appropriate technical and organisational measures (TOMs) as required by Article 32 GDPR to ensure a level of security appropriate to the risk. These include:

• Encryption of personal data in transit (TLS 1.2+) and at rest where applicable.
• Role-based access controls limiting data access to authorised personnel only.
• Regular security assessments and vulnerability testing of our platforms.
• AWS infrastructure with ISO 27001-certified data centres.
• Staff training on data protection and information security.
• Incident response procedures including breach notification processes.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of EEA/UK data subjects, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Article 33 GDPR) and affected individuals without undue delay where required (Article 34 GDPR).

8. Sub-processors

Where we act as a Data Processor, we engage sub-processors only with prior written authorisation from the Controller and ensure they are bound by data protection obligations no less protective than those in our DPA. Key sub-processors we use in service delivery:

Clients may request an up-to-date list of sub-processors relevant to their specific engagement by contacting us.

9. Data Processing Agreement

If you engage DataMatrix Technology Solutions Pvt. Ltd. to process personal data on your behalf and you are a Controller subject to the GDPR or UK GDPR, we are required under Article 28 to enter into a written Data Processing Agreement (DPA). Our standard DPA incorporates the 2021 EU Standard Contractual Clauses (Module 3: Processor-to-Processor) where applicable. To request a copy of our DPA or to initiate the signing process, please contact us at business@dmtspl.com.

10. Supervisory authority & complaints

If you are located in the EEA or UK and believe we have not handled your personal data in compliance with the GDPR, you have the right to lodge a complaint with the relevant supervisory authority:

• EEA residents: Contact the data protection authority in your EU member state. A list is available at edpb.europa.eu.
• UK residents: Contact the Information Commissioner’s Office (ICO) at ico.org.uk or by phone on 0303 123 1113.

We would appreciate the opportunity to address your concerns before you contact a supervisory authority. Please reach out to us first at business@dmtspl.com and we will respond within 30 days.

11. Changes to this statement

We review and update this GDPR Statement periodically to reflect changes in our practices, applicable law, or guidance from supervisory authorities. When we make material changes, we will update the “Last updated” date above. We encourage you to review this page regularly. Continued use of our website or services after changes are posted constitutes acceptance of the updated statement.