Effective date and version: September 20, 2026 (Version 1.0). This document is available in English only and forms part of, and shall be read together with, the Terms of Service and the Privacy Policy.
1. Purpose and Meaning
1.1 This Policy expands Section 14 of the Privacy Policy. A “personal data breach” means any unauthorised processing of Personal Data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data, that compromises its confidentiality, integrity or availability.
2. Reporting Inside the Company
2.1 Every member of staff and every service provider shall report a suspected personal data breach to the Data Protection Officer at dpo@khypri.com immediately on becoming aware of it. Any person may also report a suspected breach to the same address.
3. Response Process
3.1 The Company shall follow this process:
- Containment: identify and contain the breach as soon as it is discovered, including by disabling affected access, credentials or integrations.
- Assessment: establish what happened, which data and which individuals are affected (with particular attention to children’s data), the likely consequences, and whether the breach is continuing.
- Notification: notify affected users and relevant statutory authorities—including the Data Protection Board of India under the DPDP Act 2023, and the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000 within six (6) hours for reportable cybersecurity incidents—within statutory timeframes (not exceeding seventy-two (72) hours of discovery), describing the nature and extent of the breach, when it occurred, the data involved, the likely consequences, the measures taken and the steps the individual can take to protect themselves. Where full detail is not yet known, the Company shall notify what is known and supplement it as established.
- Remediation: take corrective action to prevent recurrence and, where appropriate, offer affected users guidance on protective steps.
- Review and record: record every breach, its cause, the data affected, the notifications made and the corrective action taken, and review the response afterwards.
3.2 The Company maintains an immutable incident log of all containment, assessment, and notification steps taken during any security event for statutory audit and regulatory reporting purposes.
4. Limits of This Policy
4.1 The Company notes that this Policy describes its procedure. It does not promise that a breach will never occur, and nothing in it limits the rights of any person under the Act or other applicable law.