1. About this policy
This policy explains how Volyan Labs (“Volyan Labs”, “we”, “us”, “our”) handles personal data. It covers two different things, which are treated differently below: (a) our website at volyanlabs.com and our business communications, and (b) the V-Attest software we license to organisations.
We aim to comply with the data-protection laws that apply to you, including the Digital Personal Data Protection Act, 2023 (India), the EU and UK General Data Protection Regulation (GDPR), and the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (PDPL), and we apply whichever protections are relevant to you.
2. Our commitments
- We never sell your personal data — to anyone, for any purpose.
- We do not share your personal data with third parties for their own marketing or profiling.
- We collect only what we need, keep it only as long as we need it, and protect it with appropriate security.
3. V-Attest runs on your own infrastructure
V-Attest is deployed and operated inside the customer's own infrastructure (on-premises or in the customer's private cloud). The documents sealed and verified through V-Attest, and any personal data they may contain — for example the details of recipients, signers or document subjects — are stored on, and controlled by, the customer. They are not sent to, collected by, or stored on Volyan Labs' systems.
For that product data the customer organisation is the data controller (the “Data Fiduciary” under the DPDP Act). Volyan Labs does not have routine access to it and does not process it for its own purposes. If, during support, a customer chooses to share specific data with us to diagnose an issue, we use it only for that purpose, on the customer's instructions, and delete it when the issue is resolved.
4. Data we collect through the website
For the website and our business dealings, Volyan Labs is the controller. We collect only:
- Enquiry form details — your name, organisation, work email, country, the product you are interested in, and the message you send, so that we can respond to you.
- Business correspondence — the information you provide when you email or speak with our sales or support teams.
- Basic technical data — our hosting may process limited information such as IP address and request time to keep the site secure and available. We do not use advertising or cross-site tracking cookies.
Please do not send sensitive or special-category personal data through the enquiry form. We do not knowingly collect it through the website.
5. Why we use it, and our legal bases
We use website and business-contact data to respond to enquiries, arrange demonstrations, provide and support the product, meet our legal obligations, and keep our services secure. Depending on the law that applies to you, we rely on one or more of these bases: your consent; taking steps at your request before entering a contract, or performing one; our legitimate interests in responding to and running our business; and compliance with a legal obligation.
6. Sharing and disclosure
We do not sell personal data and do not share it for third-party marketing. We use a small number of service providers (for example, email and website hosting) who process data strictly on our behalf, under contract, only to provide those services to us. We may disclose data where we are legally required to, or to protect the rights, safety and security of people and our services.
7. International transfers
We serve customers in India, the EU/EEA, the UK, the UAE and elsewhere. Where we transfer personal data across borders, we use a lawful transfer mechanism and appropriate safeguards (such as standard contractual clauses or an equivalent approved mechanism). Because V-Attest runs on the customer's own infrastructure, the location where product data is stored is determined by the customer, not by us.
8. How long we keep it
We keep website and enquiry data only as long as needed to handle your enquiry and any resulting relationship, after which we delete or anonymise it. Retention of data held inside a V-Attest deployment is configured and controlled by the customer within their own environment.
9. Security
We apply appropriate technical and organisational measures to the data we hold. V-Attest itself gives the documents it issues strong protection — digital signatures, QR sealing, encrypted secrets, access controls and audit logging — all operating within the customer's environment.
Securing the underlying infrastructure on which a customer runs V-Attest (servers, operating systems, databases, networks, certificates, backups, and physical and personnel security) is the customer's responsibility. Protecting that infrastructure is not a function of the product. This is set out further in our Terms of Service.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or updated, to have it erased, to restrict or object to how we use it, to withdraw consent, to receive a copy in a portable form, to nominate another person to exercise your rights (DPDP), and to complain to your data-protection authority.
For data we hold about you through the website or our business dealings, contact us using the details below. For personal data held inside a customer's V-Attest deployment, please contact that organisation, which is the controller of that data; we will support them in responding to you.
11. Children
Our website and V-Attest are intended for organisations and their staff. They are not directed at children, and we do not knowingly collect children's personal data.
12. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “last updated” date above and, where appropriate, tell you.
13. How to contact us
For any privacy question or to exercise your rights, email support@volyanlabs.com. We will respond within the timeframes required by the law that applies to you. The name and contact details of our grievance / data-protection contact are available on request.