GDPR Compliance

Abhinav DigiCompSoft Services Pvt. Ltd., registered in Pune, India (CIN: U72900PN2012PTC142358), represented by Dr. Deepika Jagtap, Managing Director.

We act as controller for enquiries and website visitors, and as processor for personal data we handle on behalf of clients during a project engagement.

Before any project begins, we provide a signed Data Processing Agreement (DPA) governing how we process personal data on your behalf. Our DPA covers:

• The subject matter , duration, nature, and purpose of processing, and the types of personal data and categories of data subjects involved
• Our obligation to process personal data only on your documented instructions
• Confidentiality obligations for anyone authorised to process the data
• The security measures described in Section 5 below
• The conditions under which we engage sub-processors, including your right to object to new sub-processors (see Section 4)
• Our obligation to assist you with data subject requests and with your own GDPR compliance obligations (impact assessments, consultations with supervisory authorities)
• Our obligation to notify you of a personal data breach without undue delay
• Deletion or return of personal data at the end of the engagement, and deletion of existing copies unless we are legally required to retain them.

Download the DPA

Client systems and data are hosted with CSpace, a company established in Tallinn, Estonia, which operates its own EU fibre ring connecting Europe to India. CSpace also hosts this website.
CSpace's data centre footprint:
For EU engagements we host your data exclusively in CSpace's EU/EEA data centres — Tallinn, Amsterdam and Stockholm — pinned to the EU. Dallas and Mumbai form part of CSpace's global network and are not used for EU client data unless you specifically request or agree to a different arrangement, such as a disaster-recovery configuration spanning additional regions.
Where a client agreement does involve data leaving the EU/EEA, that constitutes an international transfer. We put an appropriate safeguard in place — Standard Contractual Clauses — before it occurs, and disclose it in your DPA.

We notify clients of any intended addition or replacement to this list, with a reasonable opportunity to object, as set out in our DPA.

We apply technical and organisational measures appropriate to the risk, including:
• Hosting on EU-based infrastructure with role-based access control on a need-to-know basis
• Encrypted transmission of data (TLS)
• logging of support access to client systems
• confidentiality obligations on staff and contractors, reinforced by NDAs signed as a matter of course before detailed project discussions
• source code escrow for client projects, so continuity does not depend on our own business continuity
• defined incident response and breach notification procedures (section 6).

If we become aware of a personal data breach affecting your data, we notify you without undue delay so that you can meet your own obligation under Art. 33 GDPR to notify your supervisory authority within 72 hours where required.
Our notification includes, so far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

If we hold your personal data — because you contacted us or booked a call — you have the right to access it, have it corrected or erased, restrict our processing of it, receive it in a portable format, object to processing based on our legitimate interests, and withdraw consent at any time where processing rests on consent.
Full detail is in our Privacy Policy. To exercise any of these rights, write to europe@abhinavdcs.com.
If you believe we have not handled your data properly, you may lodge a complaint with your local supervisory authority.

Two situations fall outside the EU-pinned hosting described in section 3.

Support access - Where a client requests support or reports an issue, named personnel in India may access data in that client's system to diagnose and resolve it. This access is triggered by a client request rather than routine or continuous, limited to what the issue requires, restricted to authorised personnel, and logged.

Enquiry data - Personal data you send us directly — through the contact form, by email, or when booking a call — is accessible to our team in India so that we can respond and manage the relationship.

In both cases we rely on the European Commission's Standard Contractual Clauses, supported by a transfer impact assessment and supplementary technical and organisational measures.

If you are assessing us as a vendor and need something not covered here — a completed security questionnaire, a copy of our DPA ahead of a call, or confirmation of a specific data centre location: