Data Protection & Customer Data Policy

1Scope, role, and authority

This policy applies to personal data and business information handled through the Partner Portal, email, messaging, documents, calls, demonstrations, quotations, and other approved business channels. Partners must act within the authority granted by Qubimyst and follow its instructions about customer information.

This policy does not determine the legal controller or processor role for every activity; that must be assessed for the relevant service and applicable law.

2Data minimization

• Collect and use only what is reasonably needed for sales, support, onboarding, delivery coordination, billing, or another approved purpose.
• Do not collect passwords, card PINs, CVVs, OTPs, private keys, or payment-authentication credentials.
• Do not request sensitive information merely because it may be useful later. Collect optional information only when there is a legitimate business reason.

3Lawful and appropriate collection

• Collect information fairly, transparently, and through appropriate channels; follow the applicable consent or other legal-basis process where required.
• Do not scrape personal information from restricted sources contrary to law or platform rules, or mislead anyone about why their information is collected.
• Do not sell, rent, trade, or monetize Qubimyst customer information.

4Permitted use

• Sales follow-up for a registered opportunity.
• Preparing approved quotations and proposals.
• Coordinating demonstrations or requirements.
• Supporting onboarding and project communication.
• Other purposes expressly authorized by Qubimyst.

5Prohibited use

• Personal marketing unrelated to Qubimyst or sharing customer lists with competitors or unrelated businesses.
• Uploading customer information to unauthorized AI tools, cloud drives, CRMs, or personal applications.
• Using customer contacts for political, religious, personal, or unrelated solicitation.
• Copying Portal data to build a private database of Qubimyst customers.

6Storage and devices

• Use approved Qubimyst systems where available. Protect devices with screen locks, strong passwords, and current security updates.
• Do not expose customer documents on shared or public computers. Avoid local storage when Portal access is sufficient.
• If local storage is necessary, apply reasonable access controls and delete information when no longer required.

7Sharing and disclosure

• Share information only with authorized people who need it for an approved business purpose and are subject to appropriate confidentiality obligations.
• Do not forward customer documents to personal email without a legitimate need or post customer information in public groups or social media.
• Verify recipients before sending sensitive business documents.

8Payment data

Never request or store card numbers, CVV, PIN, OTP, banking passwords, or payment-gateway authentication credentials. Customers must complete payment through the official Qubimyst payment process.

9Accuracy, retention, and deletion

Make reasonable efforts to keep customer information accurate and promptly report material corrections. Do not retain personal information indefinitely: keep only what is needed for legitimate business, contractual, tax, audit, dispute, or legal purposes, and securely delete unnecessary copies.

10Data incidents and cooperation

If customer data is lost, exposed, misdirected, stolen, accessed by an unauthorized person, or sent to the wrong recipient, notify Qubimyst promptly through the designated security or management channel. Do not conceal the incident or delete evidence.

Cooperate with Qubimyst on containment, investigation, required customer communication, evidence preservation, and remediation. Do not issue public statements about an incident unless authorized.

11Confidentiality, third-party tools, and access

• Customer information is also subject to the NDA and Partner Agreement.
• Do not transfer customer data to external services or jurisdictions, or use third-party processing tools, unless Qubimyst authorizes it and applicable requirements permit it.
• Never share Portal credentials or store them in unsecured notes or chats. Report suspected compromise promptly and use multi-factor authentication where available.

12Customer requests

Route requests for access, correction, deletion, consent withdrawal, complaints, or other privacy rights through the designated Qubimyst process. Partners must not independently promise or resolve these requests.

13Enforcement and legal review

Violations may result in access restriction, suspension, termination, contractual remedies, or reporting to authorities where appropriate, subject to applicable law and the Partner Agreement.

The source policy describes itself as a business-policy draft, not legal advice, and calls for Indian privacy/legal review before final adoption, including assessment under the Digital Personal Data Protection Act, 2023 and applicable rules as they become effective and relevant.

14Partner acknowledgement

Partners acknowledge that customer data is entrusted information and agree to use it only for authorized Qubimyst business purposes and protect it throughout the relationship.