Privacy Statement

1. Overview & Scope

Deepotics ("Company", "we", "us", or "our") designs, develops, and delivers autonomous aerial platforms, all-terrain ground robotics, and mission-critical coordination software. This Privacy Statement governs the processing of personal and organizational data collected through our digital interfaces, corporate website (https://deepotics.com), and direct inquiry channels.

We are dedicated to safeguarding information in accordance with prevailing global data protection frameworks, including the Digital Personal Data Protection Act (DPDPA), General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), and the California Consumer Privacy Act as amended by the CPRA.

2. Legal Bases for Data Processing (GDPR & Global Compliance)

For visitors, institutional partners, and defense or enterprise clients subject to the GDPR, UK Data Protection Act, or equivalent international data privacy legislation, Deepotics processes personal data exclusively under the following lawful bases set forth in Article 6 of the GDPR:

• Contractual Necessity & Pre-Contractual Steps (Art. 6(1)(b)): Processing is necessary to review operational inquiries, evaluate mission specifications, provide customized system capability dossiers, and take required steps prior to entering into formal procurement or pilot contracts.
• Legitimate Business & Operational Interests (Art. 6(1)(f)): Processing is conducted to maintain network and operational infrastructure security, investigate unauthorized access attempts, prevent fraudulent inquiries, and preserve the integrity and intellectual property of Deepotics autonomous platforms.
• Explicit Consent (Art. 6(1)(a)): Provided when you proactively submit contact details through our "Contact Us" or "Talk to Our Team" dialogs, authorizing our engineering and sales teams to communicate with you.
• Legal & Regulatory Obligations (Art. 6(1)(c)): Processing required to ensure strict compliance with applicable statutory mandates, aerospace regulations, and dual-use or defense export controls.

Notice to California Residents (CCPA/CPRA): We do not sell personal data, nor do we share personal data for cross-context behavioral advertising. We collect only identifiers (name, business email, message contents) for direct business engagement.

3. Categories of Information Collected

We restrict data collection strictly to information essential for mission discussions and technical evaluations:

• Direct Inquiries: First name, last name, organizational/corporate email address, message inquiries, and specified platform interests (e.g., Aquila, Burrow, Flock, Eyrie).
• Automated Telemetry & Server Traffic: Non-personally identifiable diagnostic headers, IP addresses (stored solely in ephemeral access logs for threat mitigation), browser type, and navigation timestamps necessary for site reliability.

4. Operational Subprocessors & Essential Vendors

To deliver a highly available, resilient, and secure digital platform, Deepotics utilizes select trusted third-party operational service providers ("Subprocessors"). These subprocessors touch web traffic and inquiry transmissions strictly on our documented instructions:

All operational vendors act solely as Data Processors bound by strict non-disclosure obligations, industry-standard security certifications, and statutory data handling clauses. None of our subprocessors are permitted to use, aggregate, or commercialize your information for independent marketing.

5. Transmission & Routing to info@deepotics.com

All submissions made through our website contact dialogs are immediately packaged into encrypted payloads and routed directly to our designated corporate intake mailbox at info@deepotics.com.

Submissions are never exposed on public boards, exposed via unauthenticated endpoints, or shared across external marketing lists.

6. Defined Data Retention Schedules

Deepotics enforces proactive retention thresholds to eliminate indefinite data hoarding:

• Inquiry & Communication Records: Information submitted via contact forms is retained for an active operational window of twenty-four (24) months from the date of last communication. Following this period, records are systematically reviewed and purged or permanently de-identified, unless an active enterprise contract, pilot engagement, or statutory audit requirement necessitates continued archival.
• Server & Access Diagnostic Logs: Web server security logs and CDN traffic logs (recording connection IP, user-agent, and status codes) are maintained on a rolling retention cycle of ninety (90) to one hundred eighty (180) days for intrusion detection and threat monitoring, after which they are permanently overwritten.
• Deletion Requests: Where an authorized data subject requests erasure, personal records are permanently expunged within thirty (30) business days of identity verification.

7. Cookie & Tracking Disclosures

This website employs strict, minimal telemetry designed to preserve privacy while ensuring optimal platform stability:

• Strictly Necessary / Functional Cookies: Session tokens, CSRF tokens, and local dialog state flags (e.g., preserving submission status or dismissing transient prompts). These are essential for website operation and cannot be disabled.
• Diagnostic Telemetry: Anonymized performance indicators (such as CDN cache hit ratios, asset load latency, and response code health) collected in aggregate without identifying individual users.
• Third-Party Tracking Pixels: Deepotics does NOT deploy invasive third-party tracking pixels, advertising retargeting cookies (such as Meta Pixel or Google Ads tracking), or cross-site fingerprinting scripts.

Managing Cookies: You can configure your web browser (Chrome, Edge, Firefox, Safari) to reject or delete cookies at any time via your browser security settings. Doing so will not restrict your access to core Deepotics product and capability content.

8. Non-Sale & Non-Disclosure Commitment

Deepotics maintains a zero-tolerance policy against data monetization. We have never sold, rented, leased, or traded personal data, and we will never sell personal or organizational data to third parties, data aggregators, or advertising networks under any circumstances.

9. Technical & Operational Security Measures

We deploy robust defense-in-depth security standards to protect all transmitted data:

• Enforced HTTPS transport encryption using Modern TLS (Transport Layer Security 1.3).
• HTTP Security Headers including Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy: strict-origin-when-cross-origin.
• Bot mitigation, input length validation, and honeypot validation on all form endpoints.
• Principle of Least Privilege (PoLP) and multi-factor authentication (MFA) restricting internal access to operational correspondence.

10. Your Data Subject Rights & How to Exercise Them

Depending on your geographic location and applicable law (such as GDPR, DPDPA, or CCPA/CPRA), you possess distinct legal rights regarding your personal data:

• Right of Access: Request confirmation of whether your data is processed and obtain a copy of retained information.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your inquiry records from our systems.
• Right to Restriction or Objection: Object to processing carried out under legitimate interest grounds.
• Right to Non-Discrimination: We will never discriminate against you for exercising your lawful privacy rights.

To exercise any of these rights, please contact our Data Protection Team at info@deepotics.com. We will acknowledge and process your request within thirty (30) days.

11. Governing Law & Jurisdiction

This Privacy Statement, including all matters relating to website access, data privacy disputes, and contractual or non-contractual claims, shall be governed by and construed in accordance with the laws of the Republic of India, without giving effect to any principles of conflicts of law.

Any legal action, proceeding, or dispute arising out of or relating to this Privacy Statement or our data processing activities shall be subject to the exclusive jurisdiction of the competent courts located in Hyderabad, Telangana, India. Nothing herein prevents Deepotics or any data subject from seeking emergency injunctive relief or enforcing lawful regulatory orders before appropriate statutory authorities where required by mandatory local law.