Privacy Policy

Invield ("Invield", "we", "us", "our") is a cybersecurity services provider with its registered office in New Delhi, India and corporate headquarters in Gurugram, Haryana, offering VAPT, cloud security, 24/7 SOC monitoring, incident response, dark web monitoring and infrastructure security under the Invield 360 program. For the purposes of the DPDP Act, Invield acts as the Data Fiduciary for personal data collected through this website.

• Email: info@invield.com
• Phone: +91-8929181181
• Registered Office: New Delhi, India
• Corporate Office (HQ): Tower C, Unitech Cyber Park, Sector 39, Gurugram, Haryana 122022, India

We collect only what is needed to respond to your enquiry and improve the security and performance of this website.

We do not knowingly collect any special category or sensitive personal data (e.g. financial account credentials, health data) through this website's enquiry form.

We do not use your data for any purpose beyond what is stated above and what you were informed of at the point of collection, and we do not sell your personal data to any third party.

Where our processing relies on your consent, that consent is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action — we do not use pre-ticked boxes, bundled consent, or dark patterns. On our enquiry forms, you must open and review this Privacy Policy before the consent checkbox becomes available to you, and the form cannot be submitted until you have both viewed this policy and affirmatively agreed.

You may withdraw your consent at any time, as easily as you gave it, by emailing info@invield.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and may mean we are unable to continue providing certain services to you.

This site uses a minimal set of technologies to function and to measure advertising performance:

• Strictly necessary: a local preference flag that remembers your light/dark theme choice on this device.
• Strictly necessary — security (isd_vid, 1 year): recognises a browser that has misused the website chat. No tracking or advertising. Set without consent because it is needed to keep the chat secure.
• Advertising attribution: URL parameters (UTM, gclid, fbclid) captured at form submission, and Google Ads conversion events fired only when you successfully submit a form, so we can measure which campaigns generate genuine enquiries.

We do not currently run non-essential analytics or advertising cookies beyond the above. If that changes, this policy and an on-page cookie banner will be updated accordingly, with the ability for you to accept or decline non-essential cookies before they are set.

We share personal data only with the following categories of recipients, and only to the extent needed for them to perform their function:

We do not sell, rent or trade your personal data to third parties for their own marketing purposes.

Some of our service providers (for example, our cloud database and email infrastructure) process data on servers located outside India. As of the date of this policy, the Central Government has not notified any list of countries or territories to which transfer of personal data is restricted under Section 16 of the DPDP Act, so such transfers are presently permitted. We nonetheless require our processors to maintain appropriate technical and organisational safeguards, and we will update this section immediately if restricted-country notifications are issued.

We retain personal data collected through this website only for as long as reasonably necessary for the purposes described in Section 4, typically:

• Enquiries that do not convert into a client relationship: up to 24 months from your last contact with us, after which the data is deleted or anonymised, unless you ask us to delete it sooner.
• Active client relationships: for the duration of the engagement plus any period required by applicable tax, accounting or contractual record-keeping obligations.
• Marketing attribution data: up to 24 months, used solely in aggregate for campaign reporting.

You may request earlier erasure at any time — see Section 11.

As an ISO 27001 certified organisation, we apply layered technical and organisational safeguards, including encrypted transmission (HTTPS/TLS) of all form submissions, access controls restricting who within Invield can view enquiry data, spam/bot filtering on our forms, and the same 24/7 monitoring and incident response discipline we provide to our clients. No method of transmission or storage is 100% secure, but we work to industry-recognised standards to minimise risk.

Security and fraud prevention. To protect our website chat from abuse, we check the IP address of chat visitors against IP reputation services (such as AbuseIPDB) and keep a one-way coded (hashed) record of IP addresses and browsers that misuse the chat. These records are kept only while a block is active and deleted within 30 days after it ends.

Subject to the DPDP Act and Rules, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correct inaccurate or incomplete personal data.
• Erase personal data that is no longer necessary for the purpose it was collected for.
• Withdraw consent at any time, as easily as it was given.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint with us directly (Section 13) before approaching the Data Protection Board of India.

To exercise any of these rights, email info@invield.com with your request. We may need to verify your identity before actioning it.

This website and Invield's services are directed at businesses and professionals, not at children. We do not knowingly collect personal data from individuals under 18 years of age. Where processing of a child's personal data is ever required, we will obtain verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, as required under the DPDP Act.

If you have a concern about how your personal data has been processed, please contact our Grievance Officer first. We aim to acknowledge grievances promptly and resolve them within the timeline prescribed under the DPDP Rules, 2025.

If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India, established under the DPDP Act, 2023.

We may update this policy from time to time to reflect changes in our practices or in applicable law, including further rules notified under the DPDP Act. The "Last updated" date at the top of this page will always reflect the latest revision, and material changes will be highlighted on this website.