Privacy Policy & Data Protection Governance

1. Identity of Data Fiduciary & Scope of Policy

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), Ultrathon Electric acts as the Data Fiduciary that determines the purpose and means of processing personal data. Under the European Union’s General Data Protection Regulation (GDPR), Ultrathon Electric is the Data Controller.

• Corporate Entity: Ultrathon Electric
• Corporate Headquarters: ECO TOWER -1, TOWER E, CYBERWALK, SECTOR 8, IMT MANESAR, GURGAON, HARYANA – 122050, INDIA
• Official Contact: sales@ultrathonelectric.com | +91-124-4273124
• Data Protection Officer (DPO): privacy@ultrathonelectric.com

2. Categories of Personal Data We Collect

We collect personal data strictly necessary to fulfill engineering, commercial, and regulatory mandates:

3. Lawful Grounds for Processing

We process personal data only when substantiated by recognized legal grounds:

• Affirmative Consent (Section 6, DPDP Act 2023; Article 6(1)(a) GDPR): For optional analytics, technical newsletters, and marketing communications. Consent is free, specific, informed, unconditional, and unambiguous with clear affirmative action.
• Legitimate Uses / Voluntary Provision (Section 7(a), DPDP Act 2023; Article 6(1)(b) GDPR): When you voluntarily provide personal data to request technical sizing, proposal generation, engineering feasibility studies, or contractual execution.
• Compliance with Indian Law & Grid Regulations (Section 7(c), DPDP Act 2023; Article 6(1)(c) GDPR): For complying with Central Electricity Authority (CEA) Connectivity Regulations, CEIG approval submissions, state transmission utility (STU) filing obligations, and statutory taxation records under Indian law.
• Legitimate Interests (Article 6(1)(f) GDPR): Ensuring network cybersecurity, preventing denial-of-service disruptions, and maintaining infrastructure resilience.

4. Rights of Data Principals under DPDP Act, 2023 (India)

As a Data Principal residing in India whose digital personal data is processed, you hold explicit statutory rights under Chapter III of the DPDP Act, 2023:

5. Data Protection Officer & Grievance Redressal

In fulfillment of Section 8 and Section 13 of the DPDP Act 2023, Ultrathon Electric has appointed a dedicated Data Protection & Grievance Officer:

Turnaround Timelines: Grievance submissions are acknowledged within 48 business hours. A formal response, investigation findings, or resolution action will be completed within 30 calendar days.

Escalation to Data Protection Board of India (DPBI): If you do not receive a response within the prescribed timeline or are dissatisfied with the resolution, you have the statutory right to escalate your grievance to the Data Protection Board of India pursuant to Section 13(4) and Section 27 of the DPDP Act 2023.

6. European Union & UK GDPR Specific Provisions

For individuals located within the European Economic Area (EEA) and the United Kingdom, our processing aligns with the General Data Protection Regulation (Regulation (EU) 2016/679) and UK GDPR:

• Right of Access (Art. 15): Request confirmation and copy of personal data processed.
• Right to Rectification (Art. 16): Rectify inaccurate or incomplete personal records.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Obtain erasure of personal data under applicable grounds.
• Right to Restriction of Processing (Art. 18): Restrict processing under verification disputes.
• Right to Data Portability (Art. 20): Receive your personal data in structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority in the Member State of your habitual residence or place of alleged infringement.

7. Notice to California Residents (CCPA & CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures:

• Right to Know / Access: Know categories of personal information collected, sources, purposes, and specific pieces of information.
• Right to Delete: Request deletion of personal information collected, subject to statutory exceptions.
• Right to Correct: Correct inaccurate personal information maintained by us.
• Right to Non-Discrimination: We do not discriminate against any consumer for exercising CCPA/CPRA rights.

To submit a verifiable California Consumer Request, email privacy@ultrathonelectric.com with "CCPA Request" in the subject line.

8. Cookies & Tracking Technologies

Our website utilizes cookies and similar local storage technologies categorized as follows:

9. Security Safeguards & Data Breach Notification Protocol

Pursuant to Section 8(5) of the DPDP Act 2023 and ISO/IEC 27001 best practices, Ultrathon Electric enforces technical and organizational measures:

• Cryptographic Security: All web traffic enforced over TLS 1.3 encryption. Backups and database volumes protected with AES-256 encryption at rest.
• Perimeter Defense: Automated rate limiting, Web Application Firewalls (WAF), container isolation, and continuous vulnerability monitoring.
• Role-Based Access: Access to project inquiries and customer records strictly restricted to authorized engineering and leadership personnel under non-disclosure obligations.
• Statutory Breach Protocol: In the event of a personal data breach, Ultrathon Electric will promptly notify the Data Protection Board of India (DPBI) and each affected Data Principal in accordance with Section 8(6) of the DPDP Act and DPDP Rules.

10. Protection of Children & Minors (Section 9, DPDP Act)

Ultrathon Electric provides utility-scale industrial engineering services exclusively for commercial entities, IPPs, developers, and power utilities. We do not knowingly solicit, collect, or process personal data of individuals under 18 years of age. We do not engage in behavioral tracking or targeted advertising directed at children. If you believe a minor has submitted personal data without verifiable parental consent, please contact privacy@ultrathonelectric.com for immediate erasure.

11. Cross-Border Transfers & Data Retention

Cross-Border Data Transfers: Personal data is stored on secure servers located in India and certified cloud facilities. Any international transmission complies strictly with Central Government notifications under Section 16 of the DPDP Act 2023 and Standard Contractual Clauses (SCCs) under GDPR Article 46.

Retention Schedules: Personal data is retained only for as long as necessary to fulfill the specific engineering purpose or project life cycle, satisfy tax and financial record requirements under Indian law (Companies Act / GST Act), or defend against potential legal claims. Upon expiration of the retention schedule, records are irreversibly anonymized or cryptographically purged.