Privacy Policy

Version 2.0. This policy is a draft prepared for review by qualified legal counsel. It applies to www.bionergyx.com and to enquiries you send us through it.

At a glance

• We are Bionergyx Private Limited, a company incorporated in India. We decide how the data described here is used.
• The website sets no analytics, advertising or tracking technology. Fonts are served from our own domain, so no third party sees your IP address through this site.
• We process what you send us through the contact form or by email, plus technical server log data needed to deliver and secure the pages.
• Data reaches India, because our team is there. For transfers out of the EEA, the UK or Switzerland we rely on Standard Contractual Clauses.
• You can ask for access, correction, deletion, restriction, portability, and you can object or withdraw consent. You can also complain to a supervisory authority.
• Cookie choices can be changed at any time via Cookie settings in the footer.
• Questions and requests: info@bionergyx.com.

1. Controller and contacts

Bionergyx Private Limited
Flat No. 204, Building 47, Sector 54/56/58
Seawood, Darave, Thane
Maharashtra 400706, India
CIN: U86909MH2025PTC459565 · GSTIN: 27AAOCB0577E1ZL
Email: info@bionergyx.com
Phone: +41 41 520 68 73

We are the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR, the controller under the Swiss Federal Act on Data Protection (revFADP), the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and a business under the California Consumer Privacy Act as amended (CCPA/CPRA).

EU representative (Art. 27 GDPR)

As a controller established outside the EU that offers services to people in the EU, we are required to designate a representative in the Union.
[PLACEHOLDER: full legal name, postal address in an EU member state, and email address of the appointed Art. 27 GDPR representative. Until this is appointed, this obligation is unmet.]

UK representative (Art. 27 UK GDPR)

[PLACEHOLDER: full legal name, UK postal address and email of the UK representative, or a documented assessment that the site does not target the UK market.]

Swiss representative (Art. 14 revFADP)

[PLACEHOLDER: name, Swiss address and email of the Swiss representative, required where we process data of people in Switzerland on a large scale or regularly in connection with offering goods and services there. Note that we publish a Swiss telephone number, so this should be assessed.]

Data Protection Officer

We have assessed the criteria in Art. 37 GDPR and section 10 of the DPDP Act. This website does not carry out large-scale processing of special category data and does not monitor behaviour systematically, and we do not currently qualify as a Significant Data Fiduciary, so no statutory Data Protection Officer is appointed. Data protection questions are handled by [PLACEHOLDER: name and role of the person accountable for data protection], at info@bionergyx.com. [PLACEHOLDER: confirm this assessment with counsel; a DPO becomes mandatory if our processing changes.]

Grievance Officer (India, DPDP Act and IT Rules). [PLACEHOLDER: name, designation, postal address, email and telephone of the Grievance Officer.] This appointment and the publication of these details are mandatory under Indian law.

2. Processing activities in detail

Special categories (Art. 9 GDPR). We do not seek health, genetic, biometric or similar sensitive data through this website, and the form warns against sending it. If your enquiry concerns a clinical matter, we agree a secure channel and a separate legal basis with you first, typically Art. 9(2)(a) explicit consent or Art. 9(2)(j) for research, under contract.

Is providing data mandatory? No. It is voluntary. Without a name, email address and message we cannot answer an enquiry.

3. Recipients and processors

We do not sell personal data and do not disclose it for anyone else's advertising. Processors act only on our instructions under written agreements:

Beyond that we disclose data only to professional advisers bound by confidentiality, and to authorities or courts where the law compels us.

4. International transfers

Our team is in India, and India has no EU adequacy decision. Data you send us therefore reaches a third country. Public authorities in the recipient countries may have access powers that differ from those in the EEA.

For transfers from the EEA, the UK or Switzerland we rely on the safeguards in Chapter V GDPR, in practice the European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK International Data Transfer Addendum and the Swiss addendum where relevant, supported by a transfer impact assessment and technical measures such as encryption in transit and access control. [PLACEHOLDER: confirm which mechanism each hosting and email contract actually uses.]

You can request a copy of the relevant safeguards, with commercial terms redacted, at info@bionergyx.com. If you would rather not send data to India, tell us and we will agree an alternative route.

5. Your rights

Under the GDPR, UK GDPR and revFADP you can ask us to give you access to your data, rectify it, erase it, restrict its use, or provide it in a portable format. You can object to processing based on legitimate interests, and withdraw consent at any time, which does not affect processing already carried out lawfully.

You may also complain to a supervisory authority. For visitors in the EEA this is normally the authority of your residence or workplace; because we are established outside the Union, the competent authority is generally the one in the member state of our Art. 27 representative: [PLACEHOLDER: name and website of that supervisory authority]. In the UK: the Information Commissioner's Office (ico.org.uk). In Switzerland: the Federal Data Protection and Information Commissioner (edoeb.admin.ch). In India: the Data Protection Board of India.

To exercise a right, write to info@bionergyx.com. We answer within one month and tell you if we need longer. We may ask for information to confirm your identity before acting.

6. India, Digital Personal Data Protection Act, 2023

This policy also serves as the notice required under section 5 of the DPDP Act: it states the personal data we process, the purposes, how to exercise rights, and how to complain to the Data Protection Board of India. Where we rely on consent, that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and may be withdrawn at any time with the same ease.

As a Data Principal you have the right to a summary of your personal data and our processing, to correction, completion, updating and erasure, to nominate another person to exercise your rights in the event of death or incapacity, and to a readily available grievance redressal mechanism. You also have duties under section 15, including not filing false or frivolous complaints.

Consent Manager. The Act allows consent to be given, managed and withdrawn through a Consent Manager registered with the Board. We do not currently use one; if we register with a Consent Manager we will name it here. [PLACEHOLDER: confirm whether a Consent Manager will be used.]

Grievance Officer. [PLACEHOLDER: name, designation, address, email and phone , required by the DPDP Act and by Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules where applicable.] Grievances are acknowledged promptly and resolved within the period the law prescribes.

7. Switzerland, revFADP

For visitors in Switzerland, processing follows the revised Federal Act on Data Protection. You have the rights of access, rectification, erasure, objection, and data portability, and may lodge a report with the Federal Data Protection and Information Commissioner. Our Swiss representative, where required by Art. 14 revFADP, is named in section 1.

8. California, CCPA/CPRA

In the past twelve months we have collected the following categories of personal information through this website: identifiers (name, email address, IP address), professional or employment information (company name, role you mention), and internet activity information limited to server log data. Sources: you, and your browser. Purposes: answering your enquiry and operating the site securely.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for inferring characteristics. You have the right to know, to delete, to correct, and to non-discrimination for exercising those rights; requests go to info@bionergyx.com and may be made by an authorised agent. We honour the Global Privacy Control signal as an opt-out of any analytics and marketing category, as described in the Cookie Policy.

9. Children

This website addresses business contacts. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 (or under the age of majority that applies to them). If you believe a child has sent us data, contact us and we will delete it.

10. No automated decision-making

We make no automated decisions about you and carry out no profiling with legal or similarly significant effects within the meaning of Art. 22 GDPR. Where technology supports research and drafting in our client work, a qualified person reviews the output, and no decision affecting an individual is taken by a system alone. We do not pass website enquiries to third-party systems for model training.

11. Security

We use measures appropriate to the risk: TLS for the entire site, a restrictive content security policy, HTTP Strict Transport Security, access control and authentication on our systems, least-privilege access, and confidentiality obligations for everyone who handles data. No internet transmission is entirely secure, so please do not send sensitive material by ordinary email.

12. Cookies

Storage on your device, the consent categories, and how to withdraw consent are described in the Cookie Policy.

13. Changes and changelog

We update this policy when our processing changes. The current version is always published here with its version number and date. Material changes are flagged on the site.

• Version 2.0, [PLACEHOLDER: date]: layered structure, per-activity table, representative and DPO sections, transfers, DPDP Act, revFADP and California sections, consent records added.
• Version 1.0, first publication.

Contact

Bionergyx Private Limited
info@bionergyx.com
+41 41 520 68 73