Legal
Privacy & GDPR
1. Who is responsible
The controller is Phyto Evolution Private Limited, trading as Gyrus Tech Labs (GST 33AAOCP5431D1ZL; Udyam UDYAM-TN-34-0054374), India. Contact: info@gyrustech.com. EU representative (GDPR Art. 27): to be completed.
2. What we collect and why
| Where | Data | Purpose & legal basis |
|---|---|---|
| Contact / brief form | Name, company, email, enquiry type, message, and the visitor IP address (used for spam checking) | To answer your enquiry — steps at your request before a contract (GDPR Art. 6(1)(b)) and our legitimate interest in handling business enquiries (Art. 6(1)(f)). |
| Anti-spam check | Cloudflare Turnstile receives technical signals and your IP address | Protecting the form from abuse (Art. 6(1)(f)). |
| Signing a document or approving a proposal (clients only) | Your typed name, email, signature text, IP address and time | Evidencing that an agreement or approval was given (Art. 6(1)(b) and (f)). |
| Client / admin areas | Login details and a session cookie | Keeping you signed in (strictly necessary). |
| Client onboarding (invited members only) | Name, email and, if you choose to give them, PAN and Aadhaar numbers. These are stored encrypted and shown to our admins only in masked form. | Your consent (Art. 6(1)(a)), given by ticking the box on the signup form; you can withdraw it at any time. |
| AI-assisted drafting (admins only) | Text that our admins type into the AI assistant or the document-drafting tool. It is not used for visitors’ data unless an admin pastes it. | Our legitimate interest in drafting documents efficiently (Art. 6(1)(f)). Requests go through a Cloudflare Worker to the AI provider Groq (US). |
| Team email | Our administrators can read the company mailboxes of staff (a read-only oversight console). Staff are informed of this. | Security and business continuity (Art. 6(1)(f)). |
| Server logs | IP address, request time, page requested | Security and reliability (Art. 6(1)(f)). |
We do not run advertising or analytics trackers on this website, and we do not sell personal data.
3. Who processes it for us
- Cloudflare — hosting, CDN and Turnstile (a US company; transfers rely on its standard contractual clauses / the EU–US Data Privacy Framework).
- Our application server — a VPS hosted by OVH SAS (France) running the enquiry database and our mail server. Server location: to be completed.
- Groq — AI provider used only by our admins for drafting (US); see the table above.
- Google Fonts — this site loads its typefaces from fonts.googleapis.com, so your IP address is sent to Google when a page loads. We intend to self-host the fonts to remove this.
Enquiries are received by our team and emailed to our sales mailbox. We disclose data to authorities only where legally required.
4. Retention
- Enquiries: kept for 24 months after our last contact with you, then deleted.
- Signed documents and approvals: kept for as long as the contract or the law requires.
- Server logs: kept for a short rolling period only.
5. Transfers outside the EU/EEA
We are based in India and use Cloudflare (US). Where personal data of people in the EU/EEA is transferred to a country without an adequacy decision, we rely on standard contractual clauses or an equivalent safeguard. Adequacy status and safeguards: to be completed.
6. Your rights
You may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest, by writing to info@gyrustech.com. You can also complain to your local data-protection authority.
7. Cookies
We set no cookies on the public pages. Cloudflare’s anti-spam check on the contact form may set its own technical cookie. The client and admin areas use one strictly necessary session cookie, which does not need consent.
8. Changes
We will update this page when what we do changes and revise the date above.