Global Privacy Policy

1. Policy Overview & Regulatory Scope

Quinxta (operated by My Paper Genie, Bengaluru, India, "Quinxta", "we", "us") is committed to protecting the privacy, confidentiality, and security of personal information collected from website visitors, clients, partners, and corporate representatives. This Privacy Policy details our transparent data practices across all digital properties, including quinxta.com and client portals.

Our data processing operations strictly comply with the European Union General Data Protection Regulation (EU GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), India's Digital Personal Data Protection Act 2023 (DPDP Act), and Brazil's Lei Geral de Proteção de Dados (LGPD).

2. Information We Collect & Legal Basis

We collect information only necessary to fulfill business inquiries, execute software projects, and provide secure cloud services:

• Direct Form Submissions: Name, work email address, company name, phone number, and project scope submitted through our lead capture, quote request, meeting, and newsletter forms.
• Technical Metadata: IP address, browser type, operating system, time zone, and referral URLs collected automatically via essential cookies for security auditing.
• Client Account Data: Billing addresses, authorized user credentials, and contractual communication records processed under contractual necessity.
• Legal Basis: We process personal data under one or more of the following bases: your consent, performance of a contract, our legitimate business interests (e.g. fraud prevention, service improvement), and compliance with a legal obligation.

3. How We Process & Protect Personal Data

Quinxta processes personal data strictly for legitimate business purposes:

1. Responding to project proposals, RFQs, meeting requests, and technical inquiry submissions.
2. Executing contract SOWs, processing payments, and maintaining technical support SLAs.
3. Sending transactional confirmation emails and, where you have opted in, newsletter communications you may unsubscribe from at any time.
4. Detecting, preventing, and mitigating cyber threats, DDoS attacks, and unauthorized system access.
5. Fulfilling statutory tax, legal governance, and corporate reporting requirements.

4. Cookies & Tracking Technologies

We use strictly necessary cookies to maintain session state, security tokens (including CSRF anti-forgery tokens), and administrative authentication. We do not currently deploy third-party advertising or cross-site tracking cookies. Where analytics cookies are introduced in the future, this policy will be updated and consent will be requested where required by applicable law (e.g. the EU ePrivacy Directive).

We do not currently respond to browser "Do Not Track" signals, as no industry-wide standard for interpreting them exists; this Section will be revisited as that standard matures.

5. Data Retention & International Transfers

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including satisfying legal, accounting, or reporting requirements. Lead and inquiry form submissions are generally retained for up to thirty-six (36) months from last contact unless a contractual relationship requires longer retention; client contractual records are retained per statutory limitation periods applicable to tax and corporate law in India.

Our infrastructure is primarily hosted in India. Where personal data is transferred internationally (e.g., to process a payment or communicate with an overseas client), we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions, or your explicit consent, consistent with GDPR Chapter V and equivalent frameworks.

6. European Union (GDPR) & UK Data Subject Rights

If you reside in the European Economic Area (EEA) or United Kingdom, you possess guaranteed data subject rights under Articles 15-22 of the GDPR:

7. United States Consumer Privacy (CCPA / CPRA)

California residents have specific rights under the CCPA/CPRA to request disclosure of personal data categories collected, know whether personal data is disclosed to service providers, request deletion, correction, and opt out of any future "sale" or "sharing" of personal information (Quinxta does not currently sell or share personal data), and request non-discrimination for exercising privacy rights. Submit CCPA requests to dpo@quinxta.com.

8. India DPDP Act 2023 & Brazil LGPD

As an Indian head-quartered entity , we process personal data of Data Principals in accordance with the DPDP Act 2023. Data Principals have rights to access processing summary details, correct inaccurate data, withdraw consent, and register grievances with our appointed Data Protection Officer, who will respond within the statutory timeline.

Where applicable, Brazilian data subjects ("titulares") are afforded equivalent rights of access, correction, anonymization, portability, and deletion under the LGPD, exercisable via the same DPO contact.

9. Children's Privacy

Our services are directed at businesses and professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly upon verification. Parents or guardians who believe a minor has provided us personal data may contact dpo@quinxta.com for removal.

10. Technical Data Security, Breach Notification & Intellectual Property

Quinxta enforces rigorous technical and organizational measures (TOMs) to safeguard data:

• Encryption: RSA + AES-256 bit hybrid encryption for sensitive form submissions in transit, AES-256 encryption for stored databases, and TLS 1.3 encryption for HTTPS web transit.
• Access Control: Strict Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) required for all engineering staff.
• Audit Logging: Centralized immutable log monitoring to detect unauthorized data access attempts immediately.
• Breach Notification: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, we will notify affected individuals and applicable supervisory authorities without undue delay, consistent with GDPR Article 33/34 and equivalent obligations under other frameworks.

This Privacy Policy governs the handling of personal data only. It does not grant any license to, or transfer any right in, Quinxta's underlying software, source code, architecture, or Site Content — all of which remain the exclusive intellectual property of Quinxta / My Paper Genie under the Terms of Service, including any patents, copyrights, and trade secrets embodied therein.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be indicated by an updated "Effective Date" above and, where required by law, communicated directly to affected data subjects.