01. GDPR Commitment Overview
The General Data Protection Regulation (Regulation (EU) 2016/679) sets the benchmark for individual privacy and data sovereignty. VyomAI adheres to all seven core principles articulated in Article 5:
02. Controller vs. Processor Roles
VyomAI as Data Controller
When you browse our website (vyomai.com), submit discovery inquiries, subscribe to our research newsletters, or apply for engineering vacancies, VyomAI acts as the Data Controller.
VyomAI as Data Processor
When enterprise clients engage VyomAI to build bespoke AI systems, configure client VPC databases, or architect data pipelines, the Client acts as the Data Controller and VyomAI acts as the Data Processor under a binding Article 28 Data Processing Addendum (DPA).
03. Lawful Basis for Processing
Under Article 6 of the GDPR, VyomAI relies on the following lawful bases:
- Contractual Necessity (Art. 6(1)(b)): To execute engineering statements of work, deliver software milestones, and provide SLA-backed maintenance.
- Explicit Consent (Art. 6(1)(a)): For research publication subscriptions and discovery inquiries.
- Legitimate Interests (Art. 6(1)(f)): For cybersecurity telemetry, DDoS prevention, and safeguarding infrastructure resilience.
- Legal Obligations (Art. 6(1)(c)): To fulfill statutory corporate and taxation requirements.
04. Data Subject Rights (Articles 15–22)
As an EU/EEA data subject, you hold statutory rights under Chapter III of the GDPR. We guarantee prompt execution without undue delay and at the latest within one month of receipt:
Right of Access
You have the right to obtain confirmation from VyomAI as to whether personal data concerning you is being processed and receive a structured copy.
Right to Rectification
You have the right to request the rectification of inaccurate personal data or completion of incomplete personal information.
Right to Erasure ('Forgotten')
You have the right to request cryptographic deletion of your personal data when no longer necessary for original processing purposes.
Right to Restriction
You have the right to request limitation of data processing while accuracy disputes or legitimate interest evaluations are pending.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON/CSV).
Right to Object
You have the right to object at any time to processing of personal data concerning you based on legitimate interests or direct communications.
Automated Decision-Making & AI
You have the right not to be subject to a decision based solely on automated processing or AI profiling producing legal effects without human oversight.
05. AI Ethics & Algorithmic Transparency (Art. 22)
EU AI Act & GDPR Harmonization
VyomAI designs cognitive AI platforms that comply with Article 22 GDPR restrictions on purely automated decision-making:
06. International Transfers & Standard Contractual Clauses (SCCs)
Where personal data is transferred outside the European Economic Area (EEA), VyomAI implements:
- The European Commission's Standard Contractual Clauses (SCCs) adopted under Implementing Decision (EU) 2021/914.
- Transfer Impact Assessments (TIAs) evaluating local legal regimes against European standards.
- Supplementary technical measures, including end-to-end encryption with client-held encryption keys (BYOK).
07. Approved Sub-Processors
Under Article 28(2), VyomAI maintains a strict vetting protocol for all infrastructure vendors. Enterprise clients receive at least thirty (30) days prior notification before onboarding new sub-processors.
08. How to File a Data Subject Access Request (DSAR)
To submit an access, erasure, or portability request under GDPR, email our Data Protection Office at dpo@vyomaisolutions.com. Please include:
• Your full legal name and email address associated with your account or inquiry.
• The specific GDPR right you wish to exercise (e.g. Article 17 Erasure, Article 15 Access).
• Proof of identity (we will verify your identity via secure challenge before releasing records).
• We will respond and provide a verifiable resolution within 30 calendar days at zero cost.
09. 72-Hour Breach Notification Protocol
In the unlikely event of a personal data security incident, VyomAI activates an emergency response protocol pursuant to Article 33. We notify relevant Supervisory Authorities and affected Data Controllers without undue delay and within 72 hours of becoming aware of the breach.
10. Data Protection Officer & EU Inquiries
Our designated Data Protection Officer coordinates all compliance operations and DSAR fulfillment:
VyomAI Data Protection Officer (DPO)
VyomAI Solutions Pvt. Ltd. • Greater Noida, Ghaziabad, Uttar Pradesh 201009, India
Direct DPO Email: dpo@vyomaisolutions.com / privacy@vyomaisolutions.com
Supervisory Authority Recourse: EU residents also possess the statutory right to lodge a complaint with their local Data Protection Authority (DPA) in their member state of habitual residence.
