Privacy Policy

Introduction and scope

This Privacy Policy explains how MultiForgeX Solutions Private Limited ("MultiForgeX Solutions", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you visit www.multiforgex.com (the "Website"), contact us, apply for a job, subscribe to our communications, or use a software product or platform operated by us (our "Products").

This policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as amended from time to time.

This policy does not apply to personal data that we process on behalf of our clients while building, hosting or maintaining their software, websites, applications or campaigns. In those cases our client is the Data Fiduciary and decides why and how that data is processed; we act only as a Data Processor under our agreement with that client (see Data we process for our clients). Please refer to the relevant client's own privacy policy.

By using the Website or submitting information to us, you confirm that you have read and understood this policy. Where we rely on your consent, we will ask for it clearly and you may withdraw it at any time.

Who we are

MultiForgeX Solutions Private Limited is a company incorporated in India with its registered office at Kathotiya Gali Chowk, Patna City, Sampatchak, Patna, Bihar 800008, India (CIN: U62011BR2025PTC077265). For personal data described in this policy, we are the Data Fiduciary. You can reach us at info@multiforgex.com or through our Grievance Officer.

Personal data we collect

Information you give us

• Enquiries and proposals: name, email address, phone number, company, designation, the service you are interested in, budget range and the details of your requirement.
• Job applications: name, contact details, location, resume/CV, work experience, current and expected compensation, notice period, portfolio or LinkedIn links and any information you include in your cover letter.
• Newsletter and events: your email address and communication preferences.
• Product accounts: name, work email, phone, organisation details, login credentials (stored in hashed form), billing contact and support communications.
• Contracts and payments: billing name, address, GSTIN, PAN and payment references. Card or bank details are processed by our payment partners; we do not store full card numbers.

Information collected automatically

• IP address, browser type, device type, operating system, referring URL, pages visited, date and time of visit and approximate location derived from the IP address.
• Campaign parameters (such as UTM tags) that tell us how you found the Website.
• Cookies and similar technologies, as explained in our Cookie Policy.
• For our Products: security logs, login history, audit logs and usage events needed to keep accounts secure and the service reliable.

Information from third parties

We may receive business contact information from referral partners, recruitment platforms, event organisers, professional networks (such as LinkedIn) or publicly available sources, only where it is lawful for them to share it with us.

We do not intentionally collect sensitive personal data such as health information, biometric data, financial account passwords, caste, religion or sexual orientation through the Website. Please do not send us such information unless we specifically request it for a lawful purpose.

How and why we use personal data

Purpose	Basis under the DPDP Act
Responding to enquiries, preparing proposals and estimates, and following up on your request	Your consent / your voluntary provision of data for this purpose
Entering into and performing contracts, invoicing, collecting payments and providing support	Consent and legitimate uses for the performance of a contract you requested
Evaluating job applications, conducting interviews and background verification (with notice)	Consent
Operating, securing and improving the Website and our Products, preventing fraud, spam and abuse	Legitimate uses, including security and the reasonable expectations of users
Sending newsletters, insights and event invitations	Consent (you can unsubscribe at any time)
Complying with tax, accounting and other legal obligations, responding to lawful requests and enforcing our agreements	Compliance with law and legitimate uses permitted under Section 7 of the DPDP Act

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

Cookies and analytics

We use essential cookies to make the Website work securely and, with your consent, analytics cookies to understand how it is used. You can accept or limit non-essential cookies through the banner shown on your first visit. Full details are in our Cookie Policy.

How we share personal data

We do not sell or rent your personal data. We share it only on a need-to-know basis with:

• Service providers (Data Processors) who help us operate our business — for example cloud hosting, email delivery, analytics, customer support, CRM, payment processing and recruitment tools — under contracts that require them to protect the data and use it only on our instructions.
• Professional advisers such as auditors, lawyers and accountants, under confidentiality obligations.
• Authorities where required by law, court order or lawful request of a government agency, or to protect the rights, property or safety of MultiForgeX Solutions, our clients, employees or the public.
• Business transfers: a buyer, investor or successor in connection with a merger, acquisition, restructuring or sale of assets, who will be bound to honour this policy.

Data we process for our clients

When we design, develop, host, maintain or market software, websites, apps or campaigns for a client, we may access personal data of that client's customers, employees or users ("Client Data"). For Client Data:

• the client is the Data Fiduciary and is solely responsible for having a lawful basis, giving notices, obtaining consents and responding to the rights of its users;
• MultiForgeX Solutions acts only as a Data Processor, processes Client Data solely to deliver the agreed services and in accordance with the client's documented instructions and our agreement;
• we apply reasonable security safeguards, keep Client Data confidential and return or delete it at the end of the engagement as agreed;
• requests from a client's users about their data should be directed to that client. If we receive such a request we will forward it to the client.

International data transfers

Our service providers may store or process data on servers located outside India. Any such transfer is made only to countries not restricted by the Government of India under Section 16 of the DPDP Act and with appropriate contractual safeguards.

How long we keep personal data

Category	Retention period
Enquiries and leads that do not become clients	Up to 3 years from the last interaction
Client contracts, invoices and related correspondence	8 years from the end of the financial year, as required by tax and company laws
Job applications (unsuccessful candidates)	Up to 12 months, unless you ask us to keep it longer for future roles
Newsletter subscriptions	Until you unsubscribe
Product account data	For the life of the account and up to 90 days after closure, unless longer retention is required by law
Security, login and audit logs	Up to 1 year (minimum 180 days where required by CERT-In directions)

When data is no longer needed we delete or anonymise it, unless we must retain it to comply with law, resolve disputes or enforce our agreements.

How we protect personal data

We maintain reasonable security practices proportionate to the data we hold, including encryption in transit (HTTPS/TLS), hashed passwords, role-based access control, two-factor authentication for administrative access, audit logging, session controls, secure software development practices, regular backups and staff confidentiality obligations.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the Data Protection Board of India as required by law and take prompt steps to contain it.

Your rights

Subject to the DPDP Act and applicable law, you have the right to:

• Access a summary of the personal data we process about you and the processing activities;
• Correct, complete or update inaccurate or incomplete personal data;
• Erase personal data that is no longer necessary, unless we must keep it by law;
• Withdraw consent at any time — this does not affect processing already done, and some services may no longer be available to you;
• Grievance redressal through our Grievance Officer; and
• Nominate another person to exercise your rights in the event of your death or incapacity.

To exercise these rights, email info@multiforgex.com from the address registered with us. We may need to verify your identity. We aim to respond within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.

Children's data

The Website and our services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data of children. Where any of our Products is used by an institution (for example, a school) to manage students' data, the institution is the Data Fiduciary and is responsible for obtaining verifiable consent from parents or lawful guardians as required by Section 9 of the DPDP Act.

Marketing communications

We send marketing emails only to people who have subscribed or with whom we have an existing business relationship. Every email contains an unsubscribe link, or you can write to us at any time. We do not send unsolicited commercial SMS or calls to numbers registered on the National Do Not Call registry, except for transactional or service messages.

Third-party websites and services

The Website may link to or embed third-party services (for example Google Maps, LinkedIn or WhatsApp). Their use of your data is governed by their own privacy policies; we are not responsible for their practices.

Changes to this policy

We may update this policy to reflect changes in law, technology or our business. The updated version will be posted on this page with a new effective date. If the changes are material, we will provide a more prominent notice or, where required, seek your consent again.

Grievance Officer and contact

In accordance with the DPDP Act and the Information Technology Act, 2000, the details of our Grievance Officer are:

Ankit Raj, Grievance Officer
MultiForgeX Solutions Private Limited
Kathotiya Gali Chowk, Patna City, Sampatchak, Patna, Bihar 800008, India
Email: info@multiforgex.com

We acknowledge grievances within 48 hours and resolve them within 30 days of receipt.