Overview & Data Controller
Scope, organizational identity, and foundational principles
Welcome to PMDG Technologies ("PMDG", "we", "us", or "our"). We are committed to safeguarding the privacy, confidentiality, and integrity of the personal data and enterprise information entrusted to us by our clients, website visitors, partners, and job applicants.
This Privacy Policy outlines how PMDG Technologies acts as both a Data Controller (regarding visitors to our website, corporate inquiries, and marketing communications) and a Data Processor / Service Provider (when delivering bespoke software development, AI solutions, data engineering, and automation infrastructure on behalf of our enterprise clients).
Information We Collect
Categories of personal, professional, and technical data processed
We collect information to deliver seamless services, respond to technical inquiries, and ensure the security of our digital platforms. The categories of information we collect include:
| Category | Specific Data Elements | Source |
|---|---|---|
| Direct Contact Data | Full name, business email address, direct phone number, company name, job title, country of residence. | Web consultation forms, contact forms, email inquiries, demo requests. |
| Technical & Device Data | IP address, browser type and version, operating system, screen resolution, referral URL, time zone, ISP. | Automated server logs, telemetry, and web analytics tools. |
| Usage & Behavioral Data | Pages viewed, navigation flow, session duration, clickstream paths, feature interactions. | Cookies, Google Analytics 4, Smartlook session telemetry. |
| Enterprise Project Data | Technical specifications, architectural diagrams, API endpoints, workflow mockups, sample business records provided under NDA. | Client onboarding, master service agreements (MSAs), statements of work (SOWs). |
| Recruitment Data | Resume/CV, educational background, employment history, certifications, portfolio links. | Careers portal and direct employment submissions. |
How We Collect Data
Direct submissions, automated interactions, and third-party sources
We gather data through three primary channels:
- Direct Interaction: When you submit our contact forms, schedule a consultation, request an enterprise quote, subscribe to our technical newsletter, or speak with our sales and technical consultants.
- Automated Telemetry & Cookies: As you navigate through our digital assets, our infrastructure automatically records standard HTTP request headers, device attributes, and anonymous interaction metrics.
- Third-Party Business Channels: Verified professional networks (e.g., LinkedIn B2B services), business directories, or authorized partners who introduce corporate clients with mutual consent.
Purposes & Legal Bases for Processing
Alignment with GDPR Article 6 and international privacy laws
Under global privacy frameworks including the General Data Protection Regulation (GDPR) and the India Digital Personal Data Protection (DPDP) Act, we only process your data when we have a verified legal basis:
| Processing Purpose | Legal Basis (GDPR Art. 6 / Global Equivalents) |
|---|---|
| Responding to contact requests, scheduling technical demos, and evaluating software requirements. | Performance of a Contract or steps taken prior to entering a contract at your request. |
| Delivering enterprise application development, cloud hosting, and automation integrations. | Contractual Necessity (fulfilling our obligations under signed MSAs and SLAs). |
| Monitoring website infrastructure, preventing DDoS attacks, detecting fraudulent submissions, and debugging. | Legitimate Interests (protecting corporate assets, network integrity, and client safety). |
| Sending product roadmaps, whitepapers, and promotional technology newsletters. | Consent (freely given, specific, and revocable at any time via one-click unsubscribe). |
| Maintaining statutory accounting, tax, corporate filings, and compliance with court orders. | Compliance with Legal Obligations. |
AI Models & Client Data Isolation
Our strict policy on Artificial Intelligence, LLMs, and client IP protection
As a leader in enterprise automation, predictive analytics, and AI customer service solutions, PMDG Technologies adheres to a rigorous Zero-Leakage AI Governance Standard:
- Isolated VPC Enclaves: AI pipelines, Retrieval-Augmented Generation (RAG) vector embeddings, and machine learning inference engines run inside tenant-isolated Virtual Private Clouds (VPC) with customer-managed encryption keys.
- Stateless API Inference: When leveraging certified enterprise AI model APIs (e.g., Azure OpenAI Service, AWS Bedrock), all calls are routed via zero-data-retention (ZDR) enterprise tiers where prompt and completion logs are not persisted by upstream providers.
- Synthetic Testing: Development, unit testing, and sandbox QA are performed using cryptographically synthesized datasets to prevent accidental exposure of production PII.
Data Sharing & Third-Party Sub-Processors
Vetted service providers, confidentiality agreements, and zero data brokerage
We do not monetize, rent, or sell your personal data. We disclose personal data solely to authorized third-party sub-processors who assist us in operating our business and delivering contracted services:
- Cloud Infrastructure Providers: ISO 27001 and SOC 2 certified data centers (e.g., Amazon Web Services, Microsoft Azure, Google Cloud Platform) providing secure server hosting and database storage.
- Communications & Mail Infrastructure: Certified transactional email providers (e.g., PHPMailer SMTP relays) to send quote confirmations, security alerts, and system notifications.
- Web Analytics & Performance: Google Analytics (configured with IP anonymization) and Smartlook (session analytics with strict PII masking) for aggregate diagnostic telemetry.
- Legal Authorities: Regulatory bodies, courts, or law enforcement only when strictly mandated by enforceable law or subpoena.
International Cross-Border Data Transfers
Safeguards for global data flows between India, Malaysia, and overseas clouds
PMDG Technologies operates across international borders with engineering facilities in India and corporate offices in Malaysia. When client data or personal information is transferred across international jurisdictions, we implement legally recognized transfer mechanisms:
- Standard Contractual Clauses (SCCs): Incorporating European Commission approved Model Clauses in all sub-processor contracts involving European Economic Area (EEA) subjects.
- Data Transfer Impact Assessments (DTIAs): Evaluating local legal frameworks to ensure equivalent levels of protection for cross-border flows.
- Data Localization Options: For clients with strict sovereign data storage mandates (e.g., healthcare HIPAA, defense, or banking), we deploy dedicated dedicated on-premise or in-region sovereign cloud instances.
Your Legal Privacy Rights
Exercising your statutory rights under GDPR, CCPA/CPRA, and DPDP
Depending on your jurisdiction, you possess specific legal rights regarding the personal data we hold about you:
Right to Access
You can request a complete copy of the personal data we maintain about you in a clear, machine-readable format.
Right to Rectification
You can request correction of any inaccurate, incomplete, or outdated personal information without delay.
Right to Erasure
Also known as the "Right to be Forgotten", you can request the permanent deletion of your data when retention is no longer justified.
Right to Restrict Processing
You can restrict the processing of your data while the accuracy or legitimate grounds of our processing are under review.
Right to Data Portability
You may request the structured transfer of your personal data directly to another service provider where technically feasible.
Right to Object
You have the absolute right to object to any direct marketing communications or processing based on legitimate business interests.
Cookies & Tracking Technologies
How we utilize cookies, pixels, and session diagnostics
Cookies are small text files placed on your device to ensure smooth website navigation, preserve session security, and analyze aggregate traffic patterns.
| Cookie Type | Purpose | Default Status |
|---|---|---|
| Strictly Necessary | Essential for core platform operations, CSRF protection, and load balancing across servers. | Always Active |
| Performance & Analytics | Google Analytics (G-LBZBG2G1XT) to measure visitor counts, bounce rates, and traffic sources anonymously. | Optional / Consent-Based |
| Diagnostic Telemetry | Smartlook to identify UX bottlenecks and client-side JavaScript rendering bugs with masked keystrokes. | Optional / Consent-Based |
| Marketing & Conversion | Google Ads conversion tracking (AW-18530876977) to assess marketing campaign efficacy. | Optional / Consent-Based |
You can manage or disable cookies at any time via your browser settings (Chrome, Safari, Firefox, Edge). Please note that disabling strictly necessary cookies may degrade certain interactive features on our portal.
Data Retention & Decommissioning
Retention timeframes, archival policies, and cryptographic sanitization
We retain personal information only for as long as necessary to fulfill the purposes for which it was originally collected, including the satisfaction of legal, accounting, or reporting mandates:
| Data Record Type | Retention Period | Post-Expiry Action |
|---|---|---|
| General website contact form submissions & inquiries | 24 months from last communication date | Secure database purging |
| Client contract records, MSAs, and statements of work | 7 years following contract termination | Legal archiving under encrypted cold storage |
| Server access logs & security event telemetry | 90 to 180 days | Automated rolling log deletion |
| Job candidate resumes and application files | 12 months (or immediate deletion on request) | Secure shredding from HR records |
Security Safeguards & Encryption Standards
Technical, physical, and administrative measures defending your data
Security is woven into every layer of PMDG Technologies' infrastructure. We apply defense-in-depth principles:
- Data in Transit: 100% of network traffic between your browser and our servers is secured with TLS 1.3 encryption using modern cipher suites.
- Data at Rest: Sensitive client configurations, database records, and backups are encrypted using industry-standard AES-256 encryption.
- Access Controls & Zero-Trust: Strict Role-Based Access Control (RBAC), mandatory Multi-Factor Authentication (MFA), and least-privilege architectural segregation across all staging and production environments.
- Vulnerability Management: Continuous automated vulnerability scanning, quarterly third-party penetration testing, and immediate patching protocols.
- Incident Response: Formalized Security Incident Response Plan (SIRP) with guaranteed notification to affected clients and supervisory authorities within 72 hours of a confirmed breach as required under GDPR Art. 33.
Children's Privacy
Protection of minors under international digital safety standards
PMDG Technologies provides enterprise business-to-business (B2B) digital engineering, automation, and consulting services. Our platforms and marketing initiatives are not directed toward children under 16 years of age (or the relevant age threshold under local law). We do not knowingly collect personal data from minors.
If we discover that an individual under 16 has submitted personal data through our website without verified parental consent, we will promptly delete that information from our servers. Parents or guardians who believe their child has provided data can alert us at privacy@pmdgtech.com.
Policy Updates & Version History
Notice of modifications and transparent revision tracking
We may update this Privacy Policy periodically to reflect technological advancements, new service offerings, or evolving international regulatory requirements. When material revisions occur, we will update the "Last Updated" timestamp at the top of this document and post a visible notice on our primary portal.
View Recent Version Changelog
- Version 2.4 (October 2026): Added explicit Enterprise AI Data Isolation clauses, updated sub-processor list, and incorporated India DPDP Act 2023 compliance provisions.
- Version 2.2 (March 2025): Enhanced cookie transparency disclosures for Smartlook and Google Ads remarketing tags.
- Version 2.0 (January 2024): Comprehensive restructuring for GDPR Standard Contractual Clauses (SCCs) and California Privacy Rights Act (CPRA).
Data Protection Officer & Contact Info
Reach our privacy team and global offices directly
For inquiries regarding this Privacy Policy, subject access requests, or vendor data processing agreements (DPAs), please contact our Data Protection Officer:
Attn: Legal & Privacy Governance Team
Email: privacy@pmdgtech.com | General: business@pmdgtech.com
Direct Phone: +91-9940133346