Laysan Technologies Pvt. Ltd.

Effective Date: 13 October 2026
Last Updated: 13 October 2026

1. Introduction

Laysan Technologies Pvt. Ltd. ("Laysan Technologies", "Company", "we", "us", or "our") is committed to protecting the privacy, security, and confidentiality of personal data.

This Privacy Policy explains how we collect, use, process, store, share, retain, and protect personal data when individuals interact with our website, products, software applications, and services.

Our website is accessible at https://www.laysantechnologies.com/.

This policy has been prepared with reference to applicable Indian laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, as their relevant provisions become applicable.

2. Scope and Applicability

This Privacy Policy applies to personal data processed in connection with:

• Our corporate website and enquiry forms.

• Software development and IT consulting services.

• Website development, hosting, and maintenance services.

• LaysanX and associated software products.

• AI-powered applications, chatbots, and automation solutions.

• Enterprise, educational, and business management applications.

• Customer support and business communications.

• Recruitment and career applications.

Where Laysan Technologies processes personal data on behalf of a customer under a service agreement, the customer may act as the Data Fiduciary and Laysan Technologies as a Data Processor, depending on their respective roles.

Separate contractual terms and product-specific privacy notices may apply.

3. Personal Data We Collect

We collect personal data relevant to the services requested and the purposes communicated to individuals.

Category	Personal Data	Purpose
Contact details	Name, email address, phone number	Responding to enquiries and providing support
Business information	Company name, designation, business requirements	Preparing proposals and delivering services
Website information	IP address, browser, device and usage data	Security, troubleshooting and analytics
Recruitment information	CV, qualifications, work experience, contact information	Recruitment and candidate evaluation
Customer account information	Account identifiers, authorized user details	Account administration and service delivery
Service information	Documents, uploaded files and authorized business records	Delivering contracted software functionality
Communication records	Enquiry messages, emails and support requests	Communication, issue resolution and recordkeeping

We seek to limit collection to personal data reasonably necessary for the specified purpose.

Additional categories may be collected through particular products or services, subject to appropriate notices and applicable agreements.

4. Purposes and Lawful Processing

We process personal data only for lawful purposes and on a basis permitted under applicable law, including valid consent or applicable legitimate uses recognized under the DPDP Act.

The purposes may include:

• Responding to enquiries initiated by individuals.

• Providing requested software products and professional services.

• Managing customer accounts and contractual relationships.

• Providing technical support and service notifications.

• Maintaining application and network security.

• Processing recruitment applications.

• Meeting applicable legal obligations.

• Sending marketing communications where appropriately authorized.

• Operating optional analytics and website improvement features where permitted.

Personal data will not be used for an unrelated purpose without an appropriate lawful basis and any additional notice or consent required by law.

5. Notice and Consent

Where consent is required, Laysan Technologies will seek consent through a clear and understandable notice.

The notice will identify the relevant categories of personal data, the specific processing purposes, and the associated services or functionality.

Consent requests will be presented in a manner intended to enable free, specific, informed, unconditional, and unambiguous agreement through clear affirmative action.

Consent will not be inferred merely from silence, inactivity, or preselected checkboxes.

Where applicable, individuals will be provided with an accessible mechanism to withdraw consent.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

6. Withdrawal of Consent

Individuals may request withdrawal of consent for processing activities based on consent.

Requests may be submitted through our official contact page or designated privacy communication channel.

Where consent withdrawal applies, we will stop the relevant processing and arrange for applicable processors to do the same, unless continued processing is permitted or required by law.

Withdrawal may affect our ability to provide services that depend on the relevant personal data.

We aim to make withdrawal of consent as accessible as the method used to provide consent.

7. Data Principal Rights

Subject to applicable provisions of the DPDP Act and their commencement, individuals may exercise rights relating to their personal data, including:

Right to Access Information

Request information concerning personal data being processed and relevant processing activities.

Right to Correction and Erasure

Request correction, completion, updating, or erasure of personal data, subject to applicable legal requirements.

Right to Grievance Redressal

Raise a complaint regarding personal data processing or the exercise of privacy rights.

Right to Nominate

Nominate another individual to exercise applicable rights in the event of death or incapacity, in accordance with the law.

Individuals may submit requests through the contact details provided in this policy.

We may take reasonable steps to verify the identity or authorization of a requester before processing a request.

8. Data Retention and Erasure

We retain personal data only for as long as necessary to fulfil the specified processing purposes or to meet applicable legal requirements.

Retention depends on the nature of the data, the service involved, applicable contractual obligations, and legal requirements.

When the relevant purpose is completed, consent is withdrawn, or erasure is otherwise required under applicable law, we will take appropriate steps to erase the personal data, unless retention is legally authorized or required.

Where applicable, erasure obligations will also be communicated to relevant Data Processors.

Backup and security-log retention will be managed in accordance with applicable requirements and documented retention procedures.

9. Data Security

We implement appropriate technical and organizational safeguards designed to protect personal data from unauthorized access, disclosure, alteration, destruction, or loss.

Depending on the service and processing activity, these safeguards may include:

• Encryption during data transmission.

• Authentication and access management.

• Role-based access restrictions.

• Secure software development practices.

• Protection against common application vulnerabilities.

• Logging and monitoring of relevant security events.

• Security updates and vulnerability management.

• Backup and recovery arrangements.

• Restricted access to authorized personnel.

• Appropriate security obligations for service providers.

Security measures are reviewed and updated based on the nature of processing and applicable legal requirements.

No electronic system can be guaranteed to be completely free from security risks.

10. Personal Data Breaches

We maintain procedures intended to identify, investigate, contain, and respond to personal data breaches.

Where a personal data breach occurs, we will assess the incident and provide notifications to affected individuals and the Data Protection Board of India where required by applicable law.

Notifications will contain the information required under the applicable rules and will be provided within the legally prescribed timelines.

We will also take appropriate remedial measures to reduce the risk of further unauthorized processing.

11. Data Sharing and Third-Party Processors

We may engage authorized third-party service providers for activities such as:

• Web hosting and cloud infrastructure.

• Email delivery and communication services.

• Technical support and software maintenance.

• Website analytics.

• AI model and application infrastructure.

• Security monitoring.

• Other services required for authorized business operations.

Personal data will be shared only where appropriate for the relevant purpose and permitted by applicable law.

Where required, Data Processors will be engaged under appropriate contractual arrangements containing relevant data protection and security obligations.

We do not sell personal data to third parties.

12. AI-Powered Products and Services

Laysan Technologies develops AI-powered software products, including chatbots, content automation tools, AI-assisted applications, and enterprise solutions.

Depending on the functionality selected, these systems may process text, documents, enquiries, and other authorized information.

For AI-related processing:

• Personal data will be processed for identified and authorized purposes.

• Appropriate notices and lawful processing arrangements will apply.

• Third-party AI service providers may be involved where necessary.

• Customer-specific data handling requirements may be governed by separate service agreements.

• Access controls and safeguards will be applied as appropriate to the system.

The use of customer information for model training, model improvement, or unrelated secondary purposes, if any, must be separately disclosed and supported by an appropriate lawful basis.

13. Children's Personal Data

Under the DPDP Act, a child generally means an individual below 18 years of age.

Our corporate website is primarily intended for business and professional users.

Where a service involves processing children's personal data, we will apply the requirements applicable to that processing, including obtaining verifiable parental or lawful guardian consent where required.

We will not undertake processing prohibited by applicable children's data protection provisions,