Privacy, Data Protection & Cookie Policy.

This Policy explains how WayFonix collects, uses, stores, shares, and deletes personal data across our primary website (https://www.wayfonix.com), SkillForge, Vleo, FixPulse, bespoke engineering engagements, and the WayFonix Employee & Intern Portal. It must be read together with our Terms of Service.

We process personal data in conformity with the Information Technology Act, 2000, the SPDI Rules, 2011, and the progressive framework of the Digital Personal Data Protection Act, 2023. As statutory provisions under the DPDP Act come into force in phases pursuant to Central Government notifications, statutory rights and obligations apply from their respective effective commencement dates, while transitional and existing rules continue to apply where relevant. Nothing in this Policy removes any statutory right that cannot be waived under Indian law.

We practice strict data minimization and collect only personal data reasonably necessary for the designated operational purposes. We do not collect all categories for every user.

Certificate Verification Ledger: The public certificate ledger displays strictly the verified learner name, certificate ID, programme track, and issue date. It never exposes contact details, individual test scores, private feedback, or internal files. WayFonix erases a learner's verification ledger entry upon a verified statutory erasure request.

Zero Unrelated Use: WayFonix never repurposes collected personal data for undisclosed commercial purposes, advertising brokers, or unauthorized third-party profiling. Any new purpose requires a prior, distinct statutory notice or consent.

Where processing relies on consent, we obtain affirmative consent through an explicit action, such as an unticked checkbox at registration, onboarding, or checkout. The request specifies the purpose and categories of personal data collected, and consent is never bundled with unrelated terms. Silence, pre-ticked checkboxes, or merely visiting the website does not constitute consent. Where statutory provisions recognize legitimate uses (such as contract fulfillment requested by the user, or legal compliance), we process data on that lawful basis.

A Data Principal may withdraw consent at any time as easily as it was given, by emailing grievance@wayfonix.com with the subject line "Consent Withdrawal". Withdrawal does not affect lawful processing conducted prior to receipt. If the data is strictly necessary to maintain an active software subscription or training sandbox, withdrawal may result in service discontinuation, of which the user will be notified in advance.

WayFonix does not sell, lease, or monetize personal data to third parties. We share data strictly on a need-to-know basis with trusted infrastructure and service partners:

• Cloud Infrastructure Providers: High-security cloud hosting and database backends (including Oracle Cloud Infrastructure / OCI and vetted cloud facilities);
• Application Backends: Application servers running Django-based API microservices and secure database clusters;
• Payment Aggregators: RBI-regulated payment aggregators (including PhonePe Payment Gateway). WayFonix never receives, captures, or stores credit/debit card numbers, CVVs, or UPI PINs on its servers. We store only transaction references, timestamps, and settlement amounts;
• Transactional Communications: Encrypted email, SMS, or notification relays necessary to deliver system alerts and transactional receipts;
• Statutory Authorities: Law enforcement, judicial tribunals, or regulatory bodies when mandated by applicable Indian law;
• Corporate Restructuring: A lawful corporate successor in the event of an acquisition or business restructuring, bound by identical protective obligations.

Cross-Border Transfers: We operate primarily from India. Where cloud infrastructure routes or stores encrypted backups across international nodes, we ensure strict compliance with country restrictions and regulations notified by the Central Government of India under the DPDP Act.

Strictly Essential Cookies Only: WayFonix deploys strictly essential technical cookies necessary for session state management, security validation, and Cross-Site Request Forgery (CSRF) protection. These cookies are required for the website and portals to function securely and cannot be switched off in our systems.

Third-party integrated service providers (such as RBI-regulated payment gateways during transaction processing or cloud hosting nodes) may set necessary session tokens and security identifiers for fraud prevention and payment verification. Users can manage or clear cookies through browser settings, though disabling technical cookies may impact portal authentication and checkout functions.

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as mandated by statutory accounting, tax, and cybersecurity enactments:

Operational Realism & Erasure Requests: Retention schedules reflect applicable statutory recordkeeping rules under Indian law. Operational retention periods are maintained in accordance with actual cloud server configurations and statutory limitation periods. Upon a verified erasure request under Section 8, live records are securely overwritten or anonymized, while residual backup snapshots age out naturally in accordance with the 30-day rolling rotation schedule.

WayFonix applies reasonable administrative, technical, and organizational safeguards suited to the sensitivity and nature of processed data. Our systems utilize authenticated APIs, role-based access controls (RBAC), and standard security controls:

• Data Transmission Security: Enforced HTTPS across website forms, client interfaces, and REST API endpoints;
• Credential Security: Secure cryptographic password hashing and token-based API authentication;
• Role-Based Access: Production access is restricted to authorized operational personnel strictly on a need-to-know basis;
• System Maintenance: Periodic security updates, vulnerability patching, and access monitoring.

Phased DPDP Compliance & Incident Response: Statutory compliance obligations under the Digital Personal Data Protection Act, 2023 apply in accordance with the phased notification and enforcement timeline notified by the Central Government. In the event of a confirmed cybersecurity breach affecting personal data, WayFonix shall initiate appropriate containment measures and make notifications to CERT-In and other competent authorities, including the Data Protection Board of India, where required by applicable law and the relevant provisions in force. No online system can be guaranteed to be completely impenetrable, and WayFonix disclaims liability for unauthorized intrusions where baseline reasonable security practices have been maintained.

As the statutory provisions and implementing rules of the Digital Personal Data Protection Act, 2023 come into effect through phased notification by the Central Government of India, Data Principals are entitled to exercise the following statutory rights (in addition to existing rights under prevailing Indian privacy regulations):

• Right to Access Information: Request a summary of personal data being processed, details of processing activities, and identities of Data Processors with whom data has been shared;
• Right to Correction & Completion: Request correction of inaccurate, misleading, or out-of-date personal data, and completion of incomplete records;
• Right to Erasure: Request deletion of personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law;
• Right of Grievance Redressal: Have grievances registered and addressed through our designated Grievance Officer;
• Right to Nominate: Nominate an individual to exercise your data protection rights in the event of death or incapacity.

Where specific DPDP implementing rules governing particular request modalities have not yet been formally notified, WayFonix continues to facilitate data access, correction, and grievance resolution in good faith under applicable SPDI Rules and contractual commitments.

WayFonix provides the following grievance contact details and service commitments for privacy, data protection, and service-related complaints. Applicable statutory grievance-handling obligations will be followed to the extent required by the laws and rules governing the relevant service. Obligations under the Digital Personal Data Protection Act, 2023, apply from the commencement dates of the relevant provisions. WayFonix has designated the following contact for receiving and handling grievances:

We may periodically revise this Policy to reflect operational developments, cloud infrastructure upgrades, or statutory notifications under the DPDP Act. When updates are published, the "Last Updated" date at the top of this Policy will be revised. Material changes will be communicated via website notice or direct electronic communication where required by law.

If any provision of this Policy is determined to be invalid, unlawful, or unenforceable by a competent court or tribunal, such provision shall be severed, and the remainder of this Policy shall continue in full force and effect. This Policy is governed entirely by the laws of the Republic of India. Without prejudice to mandatory statutory forums (including the Data Protection Board of India or competent Consumer Commissions) or legal rights that cannot lawfully be waived or restricted under Indian law, the competent courts at Ghazipur, Uttar Pradesh, India shall possess exclusive jurisdiction over legal matters arising hereunder.