Privacy Policy

1. Introduction

Brighto Credit Information Pvt. Ltd. (“Brighto India”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your personal information in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), Information Technology Act, 2000, and other applicable Indian data protection laws.

By using our website (www.brightoindia.com) and services, you consent to the collection and use of your personal data as described in this policy.

2. Data Fiduciary

For the purposes of the DPDP Act, 2023, Brighto Credit Information Pvt. Ltd. is the Data Fiduciary responsible for processing your personal data.

Registered Address: C-83, 1st Floor, Sector-2, Noida, India
Email: Support@brightoindia.com
Phone: 9311463901

3. Personal Data We Collect

We collect the following categories of personal data based on your interaction with us:

4. Purpose and Lawful Basis for Processing

We process your personal data only for specific, explicit, and legitimate purposes:

• Service Delivery: To respond to your enquiries and provide requested verification and risk management services.
• Contractual Necessity: To perform our obligations under any contract or agreement with you.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations under Indian law.
• Legitimate Interest: To improve our website, services, and customer experience (with appropriate safeguards).
• Recruitment: To process job applications and manage the hiring process (for applicants).
• Consent: For any marketing communications or non-essential cookies (obtained via explicit opt-in).

5. Consent and Your Rights

Under the DPDP Act, 2023, you have the following rights as a Data Principal:

• Right to Access: You may request a summary of the personal data we process about you.
• Right to Correction: You may request correction or updating of inaccurate personal data.
• Right to Erasure: You may request deletion of your personal data where processing is no longer necessary or consent is withdrawn.
• Right to Grievance Redressal: You may file a complaint regarding the processing of your personal data.
• Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, please contact our Data Protection Officer at Support@brightoindia.com. We will respond within 72 hours as required under the DPDP Act.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact Form Submissions: Retained for 24 months from the date of submission, then securely deleted.
• Job Applications: Retained for 12 months from the date of application, then securely deleted unless you are hired.
• Resume Files: Stored securely in encrypted cloud storage (AWS R2) and deleted after the retention period.
• Usage/Analytics Data: Anonymized after 12 months and retained in aggregate form only.
• Security Logs: Retained for 12 months for security auditing purposes.

7. Data Security Measures

We implement industry-standard technical and organisational security measures to protect your personal data, including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• ISO 27001 certified information security management
• SOC 2 Type II audited controls
• Role-based access controls with least-privilege principle
• Regular security audits and penetration testing
• Secure file upload with type and size validation

8. Data Sharing and Third Parties

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

• Authorised Team Members: Data is shared only with authorised employees who need it to respond to your enquiry or process your application.
• Service Providers: We use trusted third-party service providers who are contractually bound to protect your data:

Legal Requirement: We may disclose personal data if required by law, court order, or governmental authority under applicable Indian law.

9. Cross-Border Data Transfer

Some of our service providers may process data outside India. In such cases, we ensure that appropriate safeguards are in place as required under Section 16 of the DPDP Act, 2023, including contractual obligations ensuring equivalent data protection standards.

10. Cookies and Tracking

Our website uses cookies in the following categories:

• Strictly Necessary Cookies: Essential for website functionality (session management, security). These cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our website. These are only enabled with your explicit consent.

We do not use advertising or marketing cookies. You can manage your cookie preferences at any time through our cookie consent banner.

11. Children's Data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The “Last Updated” date at the top indicates the most recent revision.

13. Grievance Redressal

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, the name and contact details of our Grievance Officer are provided below:

14. Contact Us

If you have any questions about this Privacy Policy or our data processing practices, please contact us at:

Brighto Credit Information Pvt. Ltd.
C-83, 1st Floor, Sector-2, Noida, India
Email: Support@brightoindia.com
Phone: 9311463901