Privacy Policy.

01Scope and applicability

This Policy applies to all personal data processed by 500x Tech Labs, a company incorporated in India with its principal place of business in Mumbai, Maharashtra, in connection with the website at 500xlabs.com (the "Site") and any related digital interfaces.

500x processes personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000 and rules made thereunder (including the SPDI Rules, 2011), and other applicable laws of the Republic of India. Where you access the Site from outside India, we make commercially reasonable efforts to honour applicable local data-protection requirements.

This Policy does not apply to engagements governed by a separately executed Statement of Work or Master Services Agreement between 500x and a client; those engagements are governed by the data-protection clauses contained in the relevant contract.

02Data we collect

We collect the following categories of personal data:

• Contact and identification data — the name, email address and organisation you enter into the enquiry form at 500xlabs.com/contact, together with the enquiry category you select, or the equivalent details you send us by email.
• Communication content — the body of any message you send to us, including attachments and metadata.
• Server access logs — our web server records the IP address, request time, page requested, referring URL, and browser user-agent string for each request, as any web server does. These logs are used for security and diagnostics.

What we do not collect. The Site sets no cookies, uses no analytics or tracking service, embeds no advertising or social-media pixels, and stores nothing in your browser. There is no account to create and nothing to log in to. The only personal data that reaches us is what you choose to type into the enquiry form or send us by email.

We do not knowingly collect sensitive personal data such as government-issued identification numbers, financial account details, biometric data, or health information through the Site. Please do not transmit such information to us through the Site.

03Purposes of processing

We process personal data for the following purposes:

• To respond to enquiries, schedule introductory conversations, and progress prospective engagements;
• To operate, maintain, secure, and analyse the performance of the Site;
• To prevent, detect, and address fraud, abuse, or technical attack;
• To comply with applicable laws, regulations, court orders, and lawful requests from public authorities;
• To pursue our legitimate business interests where such interests are not overridden by your fundamental rights and freedoms.

04Lawful basis

We process personal data on one or more of the following lawful bases:

• Consent — provided when you voluntarily submit an enquiry or write to us;
• Performance of a contract — or steps preparatory to entering into a contract with you or the entity you represent;
• Compliance with a legal obligation to which 500x is subject;
• Legitimate business interests — including improving our services, securing our systems, and conducting customary business operations.

You may withdraw consent at any time by contacting our Grievance Officer (see Section 13). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

05Data sharing

500x does not sell personal data. We disclose personal data only to the following categories of recipients and only to the extent necessary for the stated purpose:

• Enquiry-form delivery — the contact form is delivered by EmailJS. When you press Send, the fields you completed are transmitted to EmailJS, which relays them to us as an email. It receives that data only at the moment you submit it. If you would rather not use the form, write to hello@500x.tech directly.
• Hosting — the Site runs on infrastructure operated by Amazon Web Services in the Mumbai region.
• Professional advisors — including legal counsel, auditors, and insurers, where reasonably required.
• Acquirers and successors — in connection with a merger, acquisition, financing, reorganisation, or sale of all or substantially all of our assets, subject to confidentiality undertakings.
• Public authorities — where required by law, regulation, valid court order, or lawful demand.

Each processor is bound by a written agreement requiring the processor to process personal data only on our documented instructions and to maintain appropriate security measures.

Apart from the enquiry form, which transmits only what you type and only when you press Send, loading a page on this Site sends your data to no one. Typefaces, scripts, stylesheets, and images are all served from this Site's own servers. Earlier versions of this Policy disclosed that typefaces were loaded from Google Fonts, which revealed each visitor's IP address to Google; that is no longer the case, and the fonts are now served here.

06International transfers

Some of our service providers operate, store, or process data in jurisdictions outside India, including the United States and the European Economic Area. Where personal data is transferred outside India, we rely on contractual safeguards such as standard contractual clauses or equivalent legal mechanisms, and we undertake reasonable due diligence on the recipient's security practices.

07Data retention

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected and to meet our legal, accounting, or reporting obligations. Specific retention periods are summarised below:

• Contact and enquiry data — up to thirty-six (36) months from the date of last interaction, after which the record is anonymised or deleted.
• Server access logs — up to twelve (12) months in identifiable form; aggregated and anonymised derivatives may be retained indefinitely.
• Records required by law — for the period specified by the applicable statute.

You may request earlier deletion in accordance with Section 8.

08Your rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Right to access — to obtain confirmation of whether and how we process your data and to receive a copy of such data;
• Right to correction — to have inaccurate or incomplete data corrected or updated;
• Right to erasure — to have your data deleted where it is no longer necessary or where you withdraw consent;
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing;
• Right to grievance redressal — to escalate complaints to our Grievance Officer and, ultimately, to the Data Protection Board of India established under the DPDPA;
• Right to nominate — to appoint a representative to exercise these rights in the event of your death or incapacity.

To exercise any of these rights, contact our Grievance Officer at privacy@500x.tech. We will respond within the timelines prescribed by the DPDPA and applicable law.

09Security

We implement reasonable technical, administrative, and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit, access controls on a need-to-know basis, periodic security reviews, and employee confidentiality undertakings.

No method of transmission over the internet and no method of electronic storage is fully secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee absolute security. In the event of a personal-data breach affecting your data, we will notify you and the Data Protection Board of India in accordance with applicable law.

10Cookies and tracking

This Site sets no cookies. It uses no analytics service, no advertising or social-media pixels, and no browser storage of any kind. Nothing about your visit is written to your device, and nothing follows you to another site.

The Site also makes no third-party request when a page loads. Every asset, typefaces included, comes from the Site's own servers, so no external provider is told that you visited. Refusing cookies in your browser will not limit anything here, because there is nothing to refuse.

11Children

The Site and the Services are not directed at, marketed to, or intended for use by persons under the age of eighteen (18) years. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor without verifiable consent from a parent or lawful guardian, we will take reasonable steps to delete such data.

12Changes to this Policy

We may revise this Policy from time to time to reflect changes in law, technology, or our practices. The "Effective date" at the top of this Policy indicates the date of the most recent revision. Material changes will be communicated by prominent notice on the Site and, where appropriate, by direct communication.

Your continued use of the Site after the revised Policy takes effect constitutes your acceptance of the revised terms.

13Grievance officer and contact

In compliance with the Information Technology Act, 2000 and the DPDPA, 500x has designated a Grievance Officer to address questions, requests, and complaints relating to the processing of personal data.

If you remain dissatisfied with the response of the Grievance Officer, you may approach the Data Protection Board of India in accordance with the procedure prescribed under the DPDPA.