Legal & Compliance Hub | Xeta Tech Solutions

Section 1: Data Privacy & Protection

Data Collection Protocols

We collect essential operational data (Name, Email, IP Address, Device Info) required solely to operate platforms like Testify, HireWithUs, and Proctorix efficiently.

PII (Personally Identifiable Information) Handling

All PII provided by organizations or users is processed under strict Data Processing Agreements (DPA). Xeta Tech acts as a Data Processor for our enterprise clients.

Usage Data & Telemetry

We collect anonymized telemetry and application usage data to monitor server health, optimize UX, and prevent system degradation.

Cookie Policy

We use essential cookies for authentication and session management. Analytical cookies are optional and require explicit user consent upon first visit.

Third-Party Data Sharing

We do not sell user data. Data is only shared with authorized sub-processors (e.g., AWS, Stripe) strictly required for cloud hosting and payment processing.

Data Retention Limitations

Client data is retained only for the duration of the active contract. Upon termination, data is securely purged within 60 days unless legally required otherwise.

User Rights (GDPR & DPDP Act Alignment)

Users maintain the right to access, rectify, restrict processing, or request the complete deletion (Right to be Forgotten) of their personal data.

International Data Transfers

Data resides in the geographic region chosen during deployment (e.g., AWS AP-South-1). Cross-border transfers adhere to Standard Contractual Clauses (SCCs).

Section 2: Terms of Service

Account Creation & Authorization

Enterprise clients must provide accurate corporate information. Authorized admins are fully responsible for all activity occurring under their tenant credentials.

User Obligations

Users must utilize our platforms in compliance with local and international laws, ensuring no unauthorized access or disruption of services.

Prohibited Conduct

Reverse engineering, unauthorized vulnerability scanning, scraping proprietary content, or deploying automated bots against our APIs is strictly prohibited.

Intellectual Property Rights

All source code, UI/UX designs, algorithms, and AI models within the Xeta Tech ecosystem remain the exclusive intellectual property of Xeta Tech Solutions.

Service Modifications

We reserve the right to deploy updates, patches, and feature deprecations. Enterprise clients will receive a 30-day notice for any breaking API changes.

Account Suspension & Termination

Accounts found in violation of acceptable use or engaged in fraudulent activity will be immediately suspended without prior notice or refund.

Dispute Resolution

Any legal disputes arising from service agreements shall be governed by the laws of India, subject exclusively to the jurisdiction of the courts in Hyderabad, Telangana.

Section 3: Payments, Billing & Refunds

Subscription & Service Fees

Fees for SaaS products (e.g., E-Learn, Proctorix) are billed according to the agreed-upon tier. Custom engineering contracts require milestone-based invoicing.

Payment Processing & Security (PCI-DSS)

All fiat transactions are routed through certified, PCI-DSS compliant third-party gateways (e.g., Stripe, Razorpay). Xeta Tech does not store raw credit card data on its servers.

Refund & Cancellation Policy

SaaS subscriptions are non-refundable for the active billing cycle. Cancellations take effect at the end of the current cycle. Event platform (e.g., Udgama) refunds are managed by the event organizers, not Xeta Tech.

Taxes and Levies

All prices quoted are exclusive of applicable taxes (e.g., GST). Clients are responsible for any statutory taxes related to their purchase region.

Late Payments & Service Interruption

Invoices past due by 15 days will incur a 1.5% monthly late fee. Services may be temporarily suspended if accounts remain unpaid beyond 30 days.

Section 4: Security Infrastructure

Encryption Standards

Data is encrypted at rest using AES-256 and in transit using TLS 1.3 to ensure absolute confidentiality across all network requests.

Access Controls & Auth

We employ Zero Trust principles, utilizing OAuth 2.0, robust JWT validation, and strictly enforced Role-Based Access Control (RBAC) across all administrative tools.

Incident Response Plan (IRP)

In the event of a suspected breach, our automated IRP is triggered. Affected clients will be notified within 72 hours alongside remediation protocols.

Vulnerability Management

We conduct regular static (SAST) and dynamic (DAST) code analysis, adhering strictly to OWASP top 10 security standards to mitigate injection and XSS attacks.

Backup & Disaster Recovery

Database snapshots are taken every 12 hours and stored in geo-redundant, air-gapped AWS S3 buckets to guarantee business continuity.

Section 5: AI Ethics & Compliance

AI Transparency

Users interacting with platforms like Voxylet or automated grading in Testify will be explicitly notified when an AI agent is processing their request or evaluating their data.

Bias Mitigation in Recruitment

AI models utilized in HireWithUs for ATS resume screening are regularly audited against demographic bias to ensure fair, merit-based candidate evaluation.

Human-in-the-Loop (HITL) Oversight

Critical automated decisions, such as flagging a student for malpractice in Proctorix, require final verification by a human administrator. AI acts as an assistant, not a final judge.

Data for AI Training

We do not use sensitive client data to train public Foundation Models (like OpenAI). Private organizational data remains securely siloed for local RAG implementations only.

Algorithmic Accountability

Xeta Tech Solutions takes full responsibility for the operational parameters of our proprietary AI features and commits to updating algorithms that produce unintended operational outcomes.

Corporate Legal & Compliance Hub