At Sphinx Worldbiz Limited (“we,” “our,” “us”), a public limited company duly incorporated and registered under the laws of India, specifically under the provisions of the Companies Act, 2013, we are unequivocally committed to safeguarding the privacy and security of your personal data. As a company engaged in the provision of Information Technology (IT) services, software development, business process outsourcing, engineering solutions, and other technological services to clients globally, we understand the critical importance of robust data protection practices. We ensure that any and all personal information entrusted to us is processed in compliance with stringent data protection standards as outlined by applicable legal and regulatory frameworks.

This Privacy Policy is intended to provide a detailed and exhaustive description of the manner in which we collect, process, store, disclose, and safeguard your personal data, in compliance with prevailing data protection laws, including but not limited to, the General Data Protection Regulation (“GDPR”) of the European Union specifically Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC), the Information Technology Act, 2000 (including the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011), and the Digital Personal Data Protection Act, 2023 (“DPDPA”) of India, in force from time to time.

By accessing our website, using our services, or providing us with your personal data, you consent to the practices described herein. You are further reminded that consent, as defined under the DPDPA, 2023 and the GDPR, must be informed, specific, and unambiguous, and you have the right to withdraw such consent at any time, subject to the legal limitations stipulated under applicable laws.

In accordance with applicable data protection laws, Sphinx Worldbiz Limited is the Data Controller in respect of the personal data that we collect from you, meaning that we determine the purposes and means of processing your personal data. In compliance with the Information Technology Act, 2000 and the GDPR, we take full responsibility for ensuring that your data is processed in accordance with applicable laws and regulations.

Should you have any queries regarding this Privacy Policy or if you wish to exercise any of your legal rights, please contact us at:

For matters related to European Union (EU) data subjects and GDPR, we have appointed a representative within the EU. You may contact our representative in Europe, Mr. Avishkar Surana, at the following email address:

Email: a.surana@sphinxworldbiz.de

We will promptly respond to your queries or concerns within the time frame prescribed by applicable data protection laws, including the DPDPA, 2023 and the GDPR.

This Privacy Policy applies to all personal data collected by us from individuals across the globe, including but not limited to:

The processing of personal data is subject to the applicable jurisdiction’s legal framework, including the General Data Protection Regulation (GDPR) for residents of the European Union and Digital Personal Data Protection Act, 2023 for residents of India.

In accordance with the GDPR and the DPDPA, 2023, we collect personal data only to the extent necessary to fulfill the specific purposes outlined in this Privacy Policy. The personal data we collect may include:

A. Automatically Collected Data: When you visit our website, we automatically collect certain technical information, including but not limited to:

This data is collected primarily for the purposes of improving the performance, security, and functionality of our website and services, as well as to tailor content to your preferences.

B. Data Provided by You Directly: In addition to the automatic data collection, we collect personal data that you voluntarily provide to us in the course of using our services, including but not limited to:

B. Special Categories of Data:We do not generally collect sensitive personal data unless specifically required by law or for the purposes of providing certain services. Sensitive personal data, as defined under the DPDPA, 2023 and GDPR, includes data such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, or trade union membership. Where we collect sensitive data, we will ensure that such collection complies with applicable laws and obtain explicit consent from the data subject, where required.

As a Data Controller, we process your personal data based on one or more of the following lawful bases, in compliance with the GDPR, DPDPA, 2023, and other applicable laws:

A. Consent

We may process your personal data where you have provided us with explicit, informed, and unambiguous consent to do so for specific purposes, such as receiving marketing communications, newsletters, or participating in surveys. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.

B. Performance of a Contract

We process personal data when necessary for the performance of a contract with you or to take steps prior to entering into a contract, such as providing IT services, software solutions, or consulting.

C. Legitimate Interests

We may process your personal data based on our legitimate interests, such as maintaining and improving the performance of our website, marketing, and business development activities. However, we will ensure that your fundamental rights and freedoms are not overridden by our legitimate interests. You may object to this processing at any time, as detailed below.

D. Compliance with Legal Obligations

We may process your personal data to comply with legal obligations, including under the Information Technology Act, 2000, DPDPA, 2023, and the GDPR, for example, to comply with record-keeping, tax, and financial reporting obligations, or in response to lawful requests from authorities.

E. Public Interest or Official Authority

Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. (AP, Adv.)

We process your personal data for the following purposes, in compliance with DPDPA, 2023, GDPR, and other applicable legal frameworks:

We will not sell, rent, or trade your personal data to any third party. However, we may share your personal data in the following circumstances:

a. Service Providers and Data Processors: We may disclose your personal data to third-party service providers, data processors, and subcontractors who perform services on our behalf, including

b. Legal and Regulatory Disclosures: We may disclose your personal data to regulatory authorities, law enforcement agencies, or other government bodies where required to comply with legal obligations or in response to a valid legal request, including court orders, summon(s) / subpoena(s), or other legal processes. This disclosure may also occur in response to legitimate requests to protect our legal rights, prevent fraud, or cooperate in investigations.

c. Business Transfers: In the event of a merger, acquisition, or sale of our business, your personal data may be transferred as part of the transaction. We will ensure that appropriate safeguards are in place to protect your data during such transfers, in compliance with the applicable laws.

We will retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, or as required by applicable law. The retention period depends on the nature of the personal data and the purposes for which it is processed.

a. General Data Retention Periods: Personal data will be retained for the duration of our business relationship and for a period of time thereafter as required or permitted under applicable laws. For example, data related to contracts, transactions, and billing will generally be retained for a minimum of 6 years in accordance with Indian tax laws and accounting practices.

b. Retention Based on Legal and Regulatory Requirements: In certain cases, we are required to retain personal data for longer periods to comply with specific legal obligations, such as those related to anti-money laundering laws, cybersecurity regulations, and statutory audits under the applicable Indian laws, Goods or other regulatory requirements specific to our industry

c. Data Anonymization: In some cases, we may anonymize your personal data to such an extent that it can no longer be attributed to you. Once anonymized, this data may be retained indefinitely for research, statistical, or analytical purposes, but will not be used to identify or contact you.

d. Right to Request Deletion or Restriction of Processing: In certain cases, if you request the deletion or restriction of processing of your personal data (and if there are no overriding legal or contractual reasons for retention), we will comply with such a request as required by applicable law.

a. Right to Access: You have the right to request access to the personal data we hold about you. This means you can ask us to confirm whether we are processing your data, and if so, you have the right to request a copy of that data. We will provide you with this information within a reasonable timeframe and at no charge, unless your request is unfounded or excessive.

b.Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you. If we have shared your incorrect data with third parties, we will also inform them of the correction, where possible

c. Right to Erasure: You have the right to request the deletion of your personal data in certain circumstances. This includes situations where:

However, please note that in certain cases, we may not be able to fulfill your request for erasure, such as when processing is required for legal obligations, contract performance, or for legal claims.

d.Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data in specific situations, including:

e. Right to Data Portability: You have the right to request the transfer of your personal data to another data controller, where technically feasible, in a structured, commonly used, and machine-readable format. This right applies to personal data you have provided to us based on consent or contract.

f. Right to Object to Processing:: You have the right to object to the processing of your personal data in certain cases. This includes where:

g. Right to Withdraw Consent: Where you have provided consent for the processing of your personal data, you have the right to withdraw that consent at any time. If you wish to withdraw your consent, please contact us using the contact details below. Please note that withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Please note that your rights may be subject to certain limitations under the Indian IT laws and GDPR. We may refuse or restrict your requests on the grounds, including but not exclusively, if they are excessive, manifestly unfounded, or if the processing is necessary for the establishment, exercise, or defense of legal claims

We may update this Privacy Policy periodically to reflect changes in our legal obligations, business practices, or technological advancements. We will notify you of significant changes by updating the “Last Updated” date provided in this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about how we are protecting your personal data.

This Privacy Policy has been reviewed and drafted in accordance with the highest standards of legal and regulatory compliance, including adherence to the relevant data protection laws such as the GDPR, the Information Technology Act, 2000 (and corresponding rules and regulations), and the Digital Personal Data Protection Act, 2023.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us using the following details