Privacy & Data Protection Policy

1. Who we are and how to contact us

Drona VR is a brand operated by VB Engineering India Private Limited ("Drona VR", "we", "our", "us"), a company incorporated in India with its registered office in Hyderabad, Telangana. Drona VR provides enterprise immersive industrial training (VR, AR, MR) software and services. We act as the data fiduciary under the India DPDP Act 2023 and as data controller under the EU GDPR and the UK GDPR for the personal data described in this policy.

Data Protection Contact: info@dronavr.com
Postal: VB Engineering India Pvt Ltd, Hyderabad, Telangana, India
USA Office: 633 E Fernhurst Dr, Unit #1001, Katy, Texas 77450, United States

2. Scope of this policy

This policy applies to personal data we collect when you:

• Visit dronavr.com or any country subfolder (/in/, /us/, /ae/, /sa/, /sg/)
• Submit a form on the website (contact, demo request, ROI calculator, pricing request, lead-magnet downloads)
• Communicate with us by email, WhatsApp (via Interakt), telephone, or in person
• Engage with us as a prospect, customer, vendor, partner, candidate or visitor

This policy does not apply to processing performed by our customers using the Drona VR platform on behalf of their own employees or contractors — that processing is governed by the relevant Master Services Agreement and Data Processing Addendum between Drona VR and the customer.

3. Personal data we collect

We collect only the personal data we need for the purposes described in section 4. Categories include:

• Identity and contact data: name, work email address, phone number, job title, employer name, country of residence or operation
• Professional context data: industry, plant size, training requirements, procurement timeline, declared budget tier
• Communications data: content of emails, WhatsApp messages, demo recordings (with consent), call notes
• Technical data: IP address, device and browser type, operating system, referring URL, pages visited, time-on-page, screen resolution
• Marketing data: preferences, content downloads, event attendance, campaign attribution (UTM parameters)
• Cookies and similar technologies: see our Cookies Policy

We do not intentionally collect special-category or sensitive personal data (DPDP Section 2(36) / GDPR Article 9) through the website. If you submit such data voluntarily in a free-text field, we will process it only as needed to respond to your enquiry.

4. Purposes and lawful bases

We rely on the following lawful bases under DPDP, GDPR and equivalent laws:

Purpose	Lawful basis
Responding to enquiries, demos, RFPs, contracts, and account management	Contract / steps prior to contract; legitimate interest
Lead qualification, marketing analytics, sales pipeline management	Legitimate interest in conducting and growing our business
Direct marketing emails, newsletters, event invitations	Consent (where required) or legitimate interest with opt-out
Website analytics, performance, security and fraud prevention	Legitimate interest
Compliance with tax, accounting, anti-money-laundering and other legal obligations	Legal obligation
Defending and pursuing legal claims, disputes and enforcement actions	Legitimate interest; legal claim
Service improvement, product research, anonymised analytics	Legitimate interest

Where we rely on consent (e.g. non-essential cookies, certain marketing), you may withdraw it at any time by emailing info@dronavr.com or via the cookie banner. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

5. Who we share data with

We share personal data only with carefully selected third parties for the purposes set out above:

• Service providers acting on our instructions: Bitrix24 (CRM and lead management), Interakt (WhatsApp Business API), Google (Tag Manager and Analytics), Cloudflare (CDN, security and DNS), AWS (cloud hosting), Microsoft 365 (email and collaboration), our payment processors, and our marketing-automation tools. Each is bound by data processing terms.
• Professional advisers: auditors, lawyers, accountants, insurers — bound by professional confidentiality.
• Affiliated entities of VB Engineering India Pvt Ltd for legitimate business operations.
• Channel partners and resellers — only with your prior consent or where strictly necessary to fulfil your enquiry.
• Authorities, courts, regulators when legally required (DPDP Section 17, GDPR Article 6(1)(c)) or in response to valid legal process.
• Acquirers in the event of a merger, acquisition, restructuring or sale of all or part of our business.

We do not sell personal data. We do not share personal data with third-party advertising networks for cross-context behavioural advertising as defined under CCPA.

6. International transfers

Drona VR operates globally. Personal data may be transferred to and stored in jurisdictions including India, the United States, Singapore, the United Arab Emirates, the United Kingdom and the European Union. We rely on the following safeguards:

• For transfers from the EU / UK: Standard Contractual Clauses (Commission Implementing Decision 2021/914 and the UK addendum), supplementary measures where required, and adequacy decisions where available
• For transfers from India: mechanisms permitted under DPDP Section 16, including transfers to jurisdictions notified by the Central Government
• For transfers from California: contractual safeguards and CCPA-compliant data-sharing notices

You may request a copy of the relevant safeguard documentation from info@dronavr.com.

7. Retention

We retain personal data only for as long as necessary for the purposes set out in this policy and for the maximum period permitted by applicable law. Indicative retention periods:

Category	Retention period
Active prospect records (CRM)	While engagement is active and for 7 years after last contact for legitimate-interest follow-up and statutory record-keeping
Customer records (post-contract)	For the duration of the contract and 8 years after termination (Indian Companies Act, tax statutes, limitation periods)
Marketing list (newsletter, campaigns)	Until unsubscribe; suppression list retained indefinitely to honour opt-out
Website analytics (aggregated, pseudonymised)	Up to 26 months (Google Analytics default)
Cookies (non-essential)	As declared in the Cookies Policy
Communications and email correspondence	10 years for legal, accounting and dispute-resolution purposes
Records of consent	3 years after consent is withdrawn

8. Security

We implement administrative, technical and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure or destruction. Measures include access controls, encryption in transit (TLS 1.2+), encryption at rest where appropriate, logging and monitoring, periodic vulnerability assessments, employee training, and incident response procedures. See our Security page for further detail.

Despite our measures, no internet transmission or storage system is 100% secure. To the maximum extent permitted by applicable law, we disclaim liability for unauthorised access or use that occurs despite the implementation of these safeguards.

9. Your rights as a data principal / data subject

Subject to the conditions and exceptions in applicable law, you have the following rights:

• Access — to ask for a summary of personal data we process about you (DPDP Section 11; GDPR Article 15)
• Correction — to ask us to correct inaccurate or incomplete data (DPDP Section 12; GDPR Article 16)
• Erasure — to ask us to delete your data when no longer necessary (DPDP Section 12; GDPR Article 17), subject to legitimate exceptions
• Restriction and objection — to ask us to restrict or object to certain processing (GDPR Articles 18 and 21)
• Portability — to receive your data in a structured, machine-readable format where applicable (GDPR Article 20)
• Withdrawal of consent — at any time, where consent is the lawful basis (DPDP Section 6; GDPR Article 7)
• Nomination — to nominate another individual to exercise these rights on your death or incapacity (DPDP Section 14)
• Lodge a complaint — with the Data Protection Board of India, your local supervisory authority (e.g. ICO in the UK, DPAs in EU member states), or California Privacy Protection Agency for California residents

To exercise any of these rights, email info@dronavr.com with the subject line "Data rights request". We respond within 30 calendar days as required by law. We may require identity verification before fulfilling a request. We may refuse, in whole or in part, requests that are manifestly unfounded, excessive, or that conflict with our legal obligations or legitimate interests, in each case to the extent permitted by applicable law.

10. Children's data

Drona VR is an enterprise B2B service. We do not knowingly collect personal data from individuals under 18 years of age. If we learn that we have inadvertently collected such data, we will delete it promptly.

11. Cookies and similar technologies

See our standalone Cookies Policy for the full list of cookies, categories, retention and opt-out controls.

12. Changes to this policy

We may update this policy from time to time. The Last updated date at the top of the policy reflects when changes were made. Material changes will be communicated by website notice or email where appropriate. Continued use of the website after the effective date of any changes constitutes acceptance of the updated policy.

13. Grievance redressal

In compliance with the DPDP Act 2023 (Section 13) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (Rule 5(9)), our designated grievance officer is:

Grievance Officer — Drona VR
VB Engineering India Pvt Ltd
Hyderabad, Telangana, India
Email: info@dronavr.com (subject: "Grievance — Privacy")
Response time: within 30 calendar days as required by law.

This policy constitutes a binding agreement between you and VB Engineering India Pvt Ltd governing the processing of personal data described above. By using the dronavr.com website or any service offered by Drona VR, you confirm that you have read, understood and agree to this policy.