Privacy Policy for BytesWrite

Collected automatically when users interact with our website or marketing materials.

Collected during sign-up, service use, support, and billing interactions.

Collected during the course of employment or contractual engagements.

• Technical Information: IP address, browser type and version, device type, screen resolution, operating system.
• Behavioral Data: Visited pages, time spent per session, scroll and click behavior, heatmaps, and exit paths.
• Marketing Attribution: Referral sources (e.g., ad campaign, newsletter), campaign UTM tags, interaction with call-to-actions (CTAs), and cookie preference.

• Contact Information: Full name, email address, phone number, and physical or business address.
• Business Information: Company name, industry type, number of employees, and organizational roles or hierarchies. If applicable
• Financial Data: Invoice details, transaction history, payment status, and method of payment (processed securely through PCI-DSS compliant providers). If applicable
• Usage Analytics: Interactions with the platform, feature engagement, error logs, and system performance metrics used to optimize user experience.

• Personal Information: Full name, contact details, government-issued ID numbers, emergency contacts.
• Professional Data: Employment history, job titles, qualifications, salary/compensation details, and performance evaluations. If applicable
• System Access Data: Assigned login credentials, login/logout timestamps, access activity logs, and administrative privilege records. If applicable

We process your personal and organizational data to provide access to our core services and to ensure uninterrupted, secure, and optimized performance of our platforms.

Personal data is also used for day-to-day operations, ensuring smooth internal functioning and efficient service delivery.

To continuously improve our services, we collect and analyze aggregated or pseudonymized data to understand user behavior and market trends.

• Enabling and customizing platform features based on your organization’s needs.
• Responding to customer support requests and technical issues.
• Performing routine maintenance, load balancing, and uptime management.
• Conducting real-time security monitoring, anomaly detection, and access control enforcement.

• Managing customer relationships and service subscriptions.
• Conducting invoicing, payment tracking, and financial reconciliation.
• Handling employee and contractor records for workforce management.
• Meeting compliance requirements, internal policy enforcement, and responding to audits or legal obligations.

• Analyzing feature usage patterns to enhance user experience.
• Evaluating performance metrics for operational efficiency.
• Driving product innovation based on user needs and market evolution.
• Performing competitive analysis and internal benchmarking.

• Contractual Necessity – to fulfill service obligations under customer agreements.
• Legitimate Interests – to maintain platform integrity and respond to user issues.

• Contractual Necessity – for account and relationship management.
• Legal Compliance – for tax records, audit trails, and labor laws.
• Legitimate Interests – for operational excellence and resource optimization.

• Legitimate Interests – to innovate and optimize services in a privacy-conscious way.
• Consent – where cookies or optional analytics are involved in web environments.

• Active Relationships: Duration of service agreement plus 7 years
• Inactive Accounts: 3 years from last interaction
• Financial Records: 10 years for accounting and tax purposes
• Support Communications: 5 years for service quality assurance

• Current Employees: Duration of employment plus 7 years
• Former Employees: 7 years post-termination for legal compliance
• Recruitment Data: 2 years for unsuccessful candidates
• Performance Records: 5 years for reference and evaluation

• System Logs: 2 years for security and performance analysis
• Backup Data: 1 year with automatic deletion procedures
• Security Incident Data: 5 years for investigation and prevention
• Usage Analytics: 3 years for trend analysis and improvement

• AES-Based Encryption: All sensitive data is encrypted using AES (Advanced Encryption Standard), ensuring strong protection for data at rest and during processing.
• Secure Data in Transit: Communications between clients, servers, and APIs are encrypted using TLS protocols, protecting data integrity and confidentiality.
• JWT Authentication: User sessions and access are secured with JWT (JSON Web Tokens), which are signed and encrypted to prevent unauthorized access or tampering.
• Encrypted Cloud Infrastructure: Our infrastructure providers—MongoDB Atlas, AWS, and Vercel—offer built-in encryption and comply with leading industry standards for data security.

• Role-Based Access Control (RBAC): Access is granted strictly based on job roles, adhering to the principle of least privilege.
• Zero-Trust Architecture: We enforce continuous authentication and real-time validation, assuming no inherent trust between systems.
• Privileged Access Management (PAM): Elevated privileges are strictly controlled, monitored, and periodically reviewed for administrative users.

• Privacy Impact Assessments (PIAs) are conducted before introducing new processing activities, ensuring risk is evaluated and mitigated proactively.
• We conduct regular internal privacy audits and compliance reviews to ensure ongoing alignment with data protection laws and best practices.
• All employees receive mandatory training on data privacy, information security, and secure handling practices as part of our onboarding and continuous learning processes.

• Our Incident Response Team (IRT) operates under a documented plan with clearly defined roles and escalation procedures.
• In the event of a personal data breach, we are committed to issuing notifications within 72 hours, as required under GDPR Article 33.
• Forensic investigation protocols are in place to trace, analyze, and remediate any incidents with transparency and accountability.

You have the right to request and receive clear, comprehensive details about the processing of your personal data.

If you believe that the data we hold about you is inaccurate, incomplete, or outdated, you may request us to correct or update it.

You have the right to request the erasure of your personal data when:

• The categories of personal data we process about you.
• The purposes for which your data is used.
• The legal basis for processing under applicable data protection laws.
• The entities (if any) with whom your data has been shared, including any cross-border transfers.
• The applicable retention periods for your data and the procedures for deletion or archival once that period has expired.

• Correct factual inaccuracies or typographical errors.
• Update outdated or obsolete information (e.g., contact details).
• Supplement missing relevant data for completeness.
• Verify and confirm the implementation of corrections made to your data across systems and services where applicable.

• The data is no longer required for the purpose it was collected.
• You withdraw consent where processing was based on it.
• You object to processing, and there are no overriding legitimate grounds.

• Monitoring of legal and regulatory changes (e.g., DPDP Act, GDPR, CCPA)
• Assessment of platform and infrastructure updates (e.g., new features, third-party integrations)
• Analysis of user feedback, grievances, and support trends
• Benchmarking against leading industry practices and risk frameworks

• Full end-to-end effectiveness evaluation of our privacy practices
• Independent compliance gap analysis and internal audit
• Stakeholder and legal counsel consultation
• Development of a strategic privacy roadmap for the upcoming cycle

When updates involve a change in data usage, legal rights, or processing scope, we will:

For non-material amendments (e.g., clarifications, formatting, security adjustments), we may:

• Provide a 30-day advance notice to affected users
• Send email communications to registered users
• Display a notification banner on relevant platform interfaces
• Offer opt-out or consent renewal mechanisms, where applicable

• Publish the updated policy directly on our website
• Maintain detailed version history with change logs
• Inform users at their next login or interaction
• Allow a grace period for adaptation, if necessary