Table of Contents
This Privacy Policy explains how Codygon Technologies Private Limited ("Codygon", "we", "us") collects, uses, shares and protects personal data when you visit codygon.com, contact us, apply for a job, or use our products, and the rights you have over that data.
It is written to meet the EU General Data Protection Regulation ("GDPR"), India's Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"), and India's Information Technology Act, 2000. If you would like this notice in another language listed in the Eighth Schedule to the Constitution of India, contact us.
1. Who We Are
Codygon Technologies Private Limited is the controller (under the GDPR) and the Data Fiduciary (under the DPDP Act) for the personal data described in this policy, except where Section 10 says we act on behalf of a customer.
Codygon Technologies Private Limited
74/II, 'C' Cross Road, Opp. Gate No. 2, Seepz, Chakala MIDC, Mumbai 400093, Maharashtra, India
Email: privacy@codygon.com
2. Personal Data We Collect
Data you give us
- Enquiries, demos and trials: your name, work email address, phone number, company, job title and the message you send through our contact forms or by email.
- Customers and product users: account details such as name, email address and role, billing contacts, and the communications we exchange with you.
- Job applicants: your CV and the information you include in your application.
- Partners: contact and business details you share through our partnership forms.
Data collected automatically
- Server logs kept by our hosting provider: IP address, browser and device type, pages requested and time of request.
- Usage data, only if you accept analytics cookies: pages viewed, time on page, traffic source, approximate location derived from your IP address, and interaction data such as clicks and scrolling.
- Advertising and company data, only if you accept marketing cookies: identifiers set by LinkedIn and Reddit, and the company associated with your IP address (Apollo.io).
Data from other sources
We may receive business contact details from our partners and resellers, from events, and from publicly available professional sources such as company websites and LinkedIn profiles.
We do not ask for sensitive or special category data (such as health, biometric or financial account data) through our website. Please do not send it to us.
3. How We Use Personal Data and Our Legal Bases
Under the GDPR, every use of personal data needs a legal basis. The table shows ours.
| Purpose | Data used | GDPR legal basis |
|---|---|---|
| Respond to enquiries, run demos and set up trials | Contact and enquiry details | Steps you ask for before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Provide our products and manage customer accounts and billing | Account, billing and communications data | Performance of a contract (Art. 6(1)(b)) |
| Run, secure and fix the website | Server logs, essential local storage | Legitimate interest in a secure, working website (Art. 6(1)(f)) |
| Understand how the website is used | Usage data from Google Analytics and Microsoft Clarity | Your consent (Art. 6(1)(a)) |
| Measure and target our advertising and identify interested companies | Data from LinkedIn, Reddit and Apollo.io | Your consent (Art. 6(1)(a)) |
| Send product news and event invitations to business contacts | Name and work email | Legitimate interest (Art. 6(1)(f)), or your consent where the law requires it. You can opt out at any time. |
| Consider job applications | Application data | Steps you ask for before a contract (Art. 6(1)(b)) |
| Meet legal, tax and accounting duties and defend legal claims | Records we must keep | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Under the DPDP Act, we process your personal data on the basis of your consent, or for the legitimate uses the Act permits, such as when you voluntarily give us data for a specified purpose (for example, to request a demo) and have not said you do not consent to its use for that purpose. We use your data only for the purposes described in this notice.
We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies and Third-Party Tools
Our website uses a small amount of browser storage that it needs to work. Analytics and marketing tools load only after you consent to them in our cookie banner, and you can change or withdraw your choice at any time through Cookie preferences in the website footer. Withdrawing consent is as easy as giving it, and it does not affect processing that took place before you withdrew it.
| Category | Provider | What it does |
|---|---|---|
| Essential (always on) | Codygon | Remembers your cookie choices, light or dark theme, preferred currency and dismissed banners, in your browser's local storage. Nothing is sent to us. |
| Essential (always on) | Netlify, Inc. (hosting) | Serves the website and keeps standard server logs (IP address, browser, pages requested, time) for security and reliability. |
| Essential (always on) | Adobe Fonts (Adobe Inc.) | Delivers the website's fonts. Your browser requests them from Adobe's servers, which receive your IP address. Adobe Fonts does not set cookies. |
| Analytics (with your consent) | Google Analytics 4 (Google) | Measures visits, traffic sources and how pages are used, so we can improve the website. |
| Analytics (with your consent) | Microsoft Clarity (Microsoft) | Produces heatmaps and session recordings of clicks, scrolling and mouse movement, so we can find usability problems. Text typed into form fields is masked. |
| Marketing (with your consent) | LinkedIn Insight Tag (LinkedIn) | Measures the results of our LinkedIn advertising and lets us show ads to people who visited our website. |
| Marketing (with your consent) | Apollo.io | Identifies the company a visit comes from, based on its IP address, to help our sales team understand which organisations are interested. |
| Marketing (with your consent) | Reddit Pixel (Reddit) | Loads only for visitors who arrive from a Reddit link, to measure our Reddit advertising. |
| Embedded content | YouTube (Google) | Plays our product videos in privacy-enhanced mode (youtube-nocookie.com). YouTube may store data when you play a video. |
| Embedded content | Zoho Forms (Zoho) | Hosts our contact form and receives what you submit. Zoho may set cookies needed for the form to work. |
You can also block or delete cookies in your browser settings. Blocking essential storage may stop parts of the website from working.
5. Who We Share Personal Data With
- Service providers who process data for us under contract, including the providers listed in Section 4, and the providers we use for email, customer relationship management, payments and cloud hosting of our products. They may use the data only to provide their services to us.
- Advertising and analytics platforms (Google, Microsoft, LinkedIn, Reddit, Apollo.io), only with your consent. Some of them also use the data for their own purposes under their own privacy policies.
- Partners and resellers, when you ask to buy through them or are referred by them.
- Professional advisers such as lawyers, auditors and insurers.
- Authorities, when the law requires it or to protect our rights, our users or the public.
- A buyer or successor if our business is reorganised, merged or sold, subject to this policy.
6. International Transfers
We are based in India, and several of our service providers process data in other countries, including the United States and the European Union.
- From the EU and the UK: when we transfer personal data to a country without an adequacy decision, including India, we use safeguards recognised by the GDPR, such as the European Commission's Standard Contractual Clauses, or rely on a provider's certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
- From India: we transfer personal data outside India only as the DPDP Act allows, and not to any country or territory the Central Government has restricted.
7. How Long We Keep Personal Data
- Enquiries and leads: up to three years after our last contact with you, unless you become a customer.
- Customer and billing records: for the length of the contract, then as long as Indian tax and company law requires (for accounting records, generally eight years).
- Job applications: up to twelve months after the hiring decision, unless you agree to a longer period.
- Analytics and advertising data: for the retention period configured in each tool, which we keep to what the purpose needs.
- Server and security logs: for as long as needed for security, and at least one year where Indian law requires us to keep them.
When the purpose has been met or you withdraw your consent, we delete or anonymise your personal data, unless the law requires us to keep it.
8. Your Rights
Under the GDPR (if you are in the EU, EEA or UK)
- Access your personal data and receive a copy.
- Correct data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten").
- Restrict how we use your data.
- Receive your data in a portable format.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw your consent at any time.
- Complain to your local data protection authority.
Under the DPDP Act (if you are in India)
- Obtain a summary of the personal data we process about you and the processing we carry out, and the identities of the other Data Fiduciaries and Data Processors we have shared it with.
- Have your personal data corrected, completed, updated or erased.
- Withdraw your consent at any time, as easily as you gave it.
- Use our grievance redressal process (Section 9).
- Nominate another person to exercise your rights if you die or become unable to do so.
- Complain to the Data Protection Board of India after using our grievance redressal process.
To use any of these rights, email privacy@codygon.com. We may ask you to confirm your identity before acting on a request, and we respond within 30 days.
9. Grievance Officer and Privacy Contact
Our Grievance Officer answers questions about this policy and handles complaints about how we process personal data, under the DPDP Act and the Information Technology Act, 2000.
James Jacob Kurian
Grievance Officer, Codygon Technologies Private Limited
74/II, 'C' Cross Road, Opp. Gate No. 2, Seepz, Chakala MIDC, Mumbai 400093, Maharashtra, India
Email: privacy@codygon.com
We acknowledge grievances promptly and resolve them within 30 days.
To report illegal content or misuse of our services, email abuse@codygon.com.
10. Our Products: Tower and Anode
When a customer uses Tower or Anode, the customer decides what data to connect and how to use it. For that customer data, we act as a processor (GDPR) or Data Processor (DPDP Act) on the customer's behalf, under our agreement with them. If your personal data is in a customer's systems, please send requests about it to that customer.
We are the controller or Data Fiduciary for the account, billing and support data we need to provide our products to the customer. This policy applies to that data. If a product lets you sign in with a third-party account, such as Google or Microsoft, we receive the basic profile details that you allow that provider to share.
11. Security
We protect personal data with reasonable security safeguards, including encryption in transit, access controls based on role, and contracts that require our service providers to protect it too. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the relevant authorities, including the Data Protection Board of India, and the people affected, as the law requires.
To report a security vulnerability, see our Security page or email security@codygon.com.
12. Children
Our website and products are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children, and we do not track, monitor the behaviour of, or target advertising at children. If you believe a child has given us personal data, contact us and we will delete it.
13. Links to Other Websites
Our website links to websites we do not operate, such as vendor documentation and social media. Their privacy practices are governed by their own policies.
14. Changes to This Policy
We may update this policy as our practices or the law change. We will post the new version here with a new "Last updated" date and, for significant changes, tell you through the website or by email. Where a change needs your consent, we will ask for it.
15. Contact Us
For any question about this policy or your personal data, contact us at privacy@codygon.com or write to Codygon Technologies Private Limited, 74/II, 'C' Cross Road, Opp. Gate No. 2, Seepz, Chakala MIDC, Mumbai 400093, Maharashtra, India.