Security, Privacy & Legal Standards

We collect information you provide directly to us, such as when you request our GRC consulting services, schedule a security evaluation, or contact us for advisory support. This includes: • Corporate & Contact Information (Full name, work email address, phone number, company name) • Security & Compliance Assessment Data (Scope preferences, target frameworks such as ISO 27001, SOC 2, VAPT requirements) • Transaction & Invoicing Information (Processed securely via PCI-compliant payment gateways) • Interactive Communication Records (Support inquiries, consultation notes, project specifications)

We process your data strictly to deliver enterprise-grade advisory and security operations: • Deliver, manage, and optimize our GRC consulting and VAPT engagements • Prepare accurate Statements of Work (SOW) and compliance roadmap proposals • Dispatch critical technical notices, audit updates, and security advisory reports • Respond promptly to consultation inquiries and enterprise RFP requests • Ensure compliance with global privacy regulations (GDPR, HIPAA, DPDP)

We enforce strict non-disclosure standards. CyberAtrix does not sell, lease, or monetize your corporate or personal data. Data is shared exclusively under the following terms: • Certified Third-Party Service Providers (Encrypted infrastructure hosting, authorized audit partners under executed NDA) • Legal & Regulatory Mandates (Where required by binding legal process or statutory regulatory authority) • Corporate Restructuring (In connection with a merger, acquisition, or asset consolidation under strict NDA)

We implement defense-in-depth security measures to protect client data against unauthorized access, loss, or alteration: • AES-256 Bit Encryption at rest and TLS 1.3 encryption for data in transit • Role-Based Access Control (RBAC) with strict Multi-Factor Authentication (MFA) • Continuous vulnerability management and penetration testing of internal infrastructure • ISO/IEC 27001 compliant administrative, physical, and technical safeguards

Subject to local data protection laws, you retain complete authority over your information: • Request complete access to or copies of your personal data stored with CyberAtrix • Request correction or update of inaccurate corporate records • Request permanent deletion of non-essential contact data • Withdraw consent for non-essential communications at any time To exercise any of these rights, please contact our Data Protection Office at info@cyberatrix.com