Who we are
Brixoll ("Brixoll", "we", "us") is a software engineering company registered in India at Unit 101, Oxford towers, 139/88 HAL Old Airport, H.A.L II Stage, Bangalore North, Bangalore- 560008, Karnataka. This policy explains what personal data we collect when you visit brixoll.in or engage us for services, why we collect it, and the choices you have.
We are the data fiduciary for the information described here. For questions or to exercise any right in this policy, write to info@brixoll.in.
This policy is written to align with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. Where we handle data belonging to people in the EU or UK on our own behalf, we also apply the GDPR standards set out below.
What we collect
We keep data collection deliberately small. We do not sell personal data, and we do not buy contact lists.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, work email, phone number, company name, job title | Emails you send us, calls and meetings |
| Enquiry content | What you tell us about your project, requirements, budget and timelines | You, directly |
| Contract and billing data | Billing address, GSTIN, PAN where required, purchase orders, invoices, payment references | You and our payment processor |
| Technical data | IP address, browser and device type, pages viewed, referring page, approximate location from IP | Our website and analytics, if enabled |
| Client system data | Data inside systems we build or maintain for you, which may include your own users' personal data | Your systems, under your instructions |
| Recruitment data | CV, work history, portfolio links | Applicants who write to us |
We do not knowingly collect data from children, and our services are not directed at people under 18.
Why we use it
We use personal data only for the purposes below, and for the legal basis shown against each.
| Purpose | Basis |
|---|---|
| Replying to your enquiry and preparing a proposal | Steps taken at your request before a contract |
| Delivering, supporting and invoicing the services you engaged us for | Performance of a contract |
| Keeping accounting, tax and statutory records | Legal obligation |
| Keeping our website and systems secure, and investigating misuse | Our legitimate interest in protecting our business |
| Occasional service updates to existing clients | Our legitimate interest, with an opt-out in every message |
| Analytics and marketing cookies, where used | Your consent, withdrawable at any time |
| Assessing job applications | Steps taken at your request before employment |
We do not use your data for automated decision-making that produces legal or similarly significant effects on you.
Data inside systems we build
When we develop, host or maintain software for a client, we may process personal data belonging to that client's own users. In that relationship the client is the data fiduciary or controller and Brixoll acts as a data processor.
- We process such data only on the client's documented instructions, as recorded in the services agreement or a separate data processing agreement.
- Access is limited to team members assigned to that engagement, under confidentiality obligations that survive the end of the engagement.
- We use access controls, encryption in transit, environment separation and least-privilege credentials as standard.
- On request or at the end of the engagement, we return or delete the data and any copies, except where law requires retention.
- We tell the client without undue delay if we become aware of a personal data breach affecting their data, and support their reporting obligations.
Wherever possible we work on anonymised or masked data rather than live production records.
Who we share it with
We share personal data only where it is needed to run the business, and only with recipients bound by confidentiality and data protection terms.
- Service providers. Cloud hosting, email, version control, project management, error monitoring, accounting and payment processing.
- Subcontractors. Vetted specialists we engage on a project, where the client's agreement permits it.
- Professional advisers. Auditors, lawyers and insurers, where necessary.
- Authorities. Where we are required to disclose by law, court order or a valid request from a government agency.
- A successor entity. If our business or part of it is merged, acquired or reorganised, under equivalent protections.
Some of these providers operate outside India. Where data is transferred abroad we rely on the transfer mechanisms permitted by applicable law and require contractual safeguards from the recipient. A current list of our processors is available on request.
How long we keep it
- Enquiries that do not become projects: up to 24 months from last contact.
- Client contracts, invoices and tax records: at least 8 years, as required by Indian tax and company law.
- Project and source code repositories: for the term of the engagement plus any agreed support period, then archived or deleted per the contract.
- Website and server logs: up to 12 months.
- Unsuccessful job applications: up to 12 months, unless you ask us to keep them longer.
When a retention period ends, we delete the data or irreversibly anonymise it.
How we protect it
We apply reasonable security practices proportionate to the sensitivity of the data, including encryption in transit over TLS, encryption at rest for stored backups, role-based access control, multi-factor authentication on business systems, endpoint protection, logging of administrative access, and periodic review of who can access what.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the relevant authority within the timelines the law requires, and tell you what happened and what to do next.
Your rights
Subject to the law that applies to you, you may:
- Ask for a copy of the personal data we hold about you and a summary of how it is processed.
- Ask us to correct data that is inaccurate, incomplete or out of date.
- Ask us to erase data we no longer have a lawful reason to keep.
- Withdraw consent where processing relies on consent, without affecting what was done before.
- Object to processing based on legitimate interests, or ask us to restrict it while a dispute is resolved.
- Ask for your data in a portable, machine-readable format, where that right applies.
- Nominate another person to exercise these rights on your behalf in the event of death or incapacity.
- Complain to us first, and then to the Data Protection Board of India or your local supervisory authority.
Write to info@brixoll.in with your request. We will verify your identity and respond within 30 days. If your request concerns data held inside a client's system, we will forward it to that client, who is the appropriate party to answer.
Cookies
Our website uses a small number of cookies and similar technologies. Non-essential cookies are set only after you agree. Full details, including how to withdraw consent, are in our cookie policy.
Grievance officer and contact
If you believe your data has been mishandled, contact our grievance officer:
- Name: Ankit Singh
- Email: info@brixoll.in
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
Changes to this policy
We update this policy when our practices or the law change. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you by email or a notice on this site before it takes effect. Continuing to use the site or our services after that date means the updated policy applies.