Who we are and what this notice covers
YTT SECUNET PRIVATE LIMITED (CIN U46599TN2026PTC198461) is a private limited company incorporated in India, with its registered office at Plot No. 1611-B G1 Reuben, Ram Nagar South 6th Cross, Madipakkam, Kanchipuram, Saidapet, Tamil Nadu 600091, India, and a customer engineering team in Frankfurt am Main. This notice explains what personal data we collect when you visit yttsecunet.com, request a trial or an architecture demo, subscribe to our updates, apply for a role, or sign in to the YTT Secunet console, and what we do with that data.
For that data we are the controller. Our Data Protection Officer is reachable at dpo@yttsecunet.com, and general privacy questions can go to privacy@yttsecunet.com. Our services are sold to organisations and are not directed at children.
Prompt traffic is different: there we are your processor
When a customer sends inference requests through a YTT Secunet gateway, the prompts, completions and any personal data inside them are that customer's data. The customer is the controller and YTT Secunet acts as its processor under the Data Processing Agreement (DPA), which sets out the Article 28 terms, the transfer mechanisms and our security measures. This notice does not govern that processing.
If you are an end user of one of our customers and want to exercise a right over something you typed into their AI feature, contact that customer. If you write to us instead, we pass the request to them and help them answer it.
Prompts and completions stream through memory in the regional data plane and are never written to disk or used for training. We keep configuration, policy decisions and signed residency receipts, and a receipt carries a SHA-256 hash of the request, not its content.
What we collect
We collect the categories below, and only the fields the form or feature in front of you asks for.
- Contact and lead data: name, work email, company, role, jurisdictions, expected request volume, the plan you are considering and your message, when you start a trial, ask for a demo, download a DPIA template or send us a residency risk calculator result.
- Subscription data: your work email and the lists you joined, such as product updates, regulatory dispatches or subprocessor change notices.
- Console account data: name, work email, organisation, role, the identifiers your identity provider passes to us over SAML SSO or SCIM, multi-factor authentication status, and the labels and creation dates of API keys you create.
- Security and audit logs: IP address, user agent, timestamps and the action taken when you sign in to the console or change a policy, an endpoint or a key.
- Billing data: billing contact, company address, tax identifiers and invoice history. Card details are entered with our payment processor and are not stored on YTT Secunet systems.
- Support data: the content of tickets, emails and calls. Support never needs prompt content, and we ask you not to paste any into a ticket.
- Website usage data: pages viewed, referrer, browser type and approximate country, measured in aggregate by cookieless analytics. The Cookie Policy explains the details.
- Applicant data: your CV, the answers in your application, interview notes and any references you give us.
Why we use it, and our lawful bases
Each purpose below has a lawful basis under Article 6(1) of the GDPR and the UK GDPR. Where we rely on legitimate interests we have balanced them against your rights, and you can ask for that assessment.
- To open and run your console account, deliver the subscription, invoice and provide support: performance of a contract, Art. 6(1)(b), with you or with the organisation you work for (in which case our legitimate interest in serving that organisation, Art. 6(1)(f)).
- To secure the console, detect abuse and keep an audit trail of who changed which policy: legitimate interests, Art. 6(1)(f), in protecting the service and our customers' evidence.
- To answer a trial, demo or contact request and follow up on it: steps taken at your request before entering into a contract, Art. 6(1)(b), or legitimate interests in responding to business enquiries.
- To send product updates and regulatory dispatches: consent, Art. 6(1)(a). You can withdraw it with the link in every email or on our unsubscribe page.
- To send service notices and subprocessor change notices to customers: performance of the contract and of our DPA commitments.
- To keep invoices, tax and accounting records and to answer binding requests from authorities: legal obligation, Art. 6(1)(c).
- To learn which pages are useful, in aggregate: legitimate interests, using analytics that set no cookies and do not identify you.
- To assess a job application: steps before a contract and legitimate interests in hiring.
Things we do not do
We do not sell personal data. We do not share it for cross-context behavioural advertising, and the website carries no third-party advertising trackers. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not use console, support or lead data to train AI models.
How long we keep it
When a period ends we delete the data or reduce it to aggregate figures that identify no one.
- Lead and contact data: 24 months after our last interaction, unless you become a customer.
- Subscription data: until you unsubscribe. We then keep only your email address on a suppression list so we do not write to you again.
- Console account data: for the life of the account and 90 days after it closes.
- Security logs: 12 months. Audit records of policy and endpoint changes follow the receipt retention of your plan, 90 days on Growth and 7 years on Enterprise, because they form part of the same evidence.
- Billing records: for the period tax and accounting law requires in the country where the record is kept.
- Support tickets: 3 years after the ticket closes.
- Applicant data: 12 months after the hiring decision, or longer if you agree to stay in our talent pool.
Who receives it
We share personal data only with these recipients, and only what each needs.
- Subprocessors for hosting, email delivery, support ticketing and payments, listed by category and location on our Subprocessors page and bound by written contracts that limit them to our instructions.
- Auditors who assess us against SOC 2 Type II, ISO 27001 and ISO 27701, and our lawyers and accountants, under duties of confidentiality.
- Public authorities, where law requires disclosure. We check each request, challenge requests that are overbroad, and tell the affected customer unless the law forbids it.
- A successor if YTT Secunet is merged or acquired, bound to protect the data as this notice describes.
International transfers and safeguards
Our console and control plane run in Frankfurt am Main with a standby in Paris, on EU-headquartered infrastructure. Our staff work from Chennai and Frankfurt am Main, and YTT SECUNET PRIVATE LIMITED is an Indian company. Personal data about you can therefore be accessed from India and held by an Indian legal entity even while it is stored in the EU, and we treat both situations as transfers.
For data leaving the EEA we rely on an adequacy decision where one exists and otherwise on the European Commission's 2021 standard contractual clauses (Commission Implementing Decision (EU) 2021/914), backed by a transfer impact assessment and supplementary measures: TLS 1.3 in transit, AES-256 at rest, access limited to named staff by role, and logging of every administrative access. For UK data we add the ICO's International Data Transfer Addendum, and for Swiss data we apply the SCCs with the adaptations the FDPIC requires. Ask dpo@yttsecunet.com for a copy of the safeguards that apply to you.
Because YTT SECUNET PRIVATE LIMITED is an Indian company, Indian authorities can require access to information it holds under section 69 of the Information Technology Act, 2000, and a foreign authority, including a US one, could also direct a request to it. We do not claim to be immune from either. We limit what such a request could reach: prompts and completions are never stored, so there is no copy of them to produce, and Sovereign Dedicated customers run the data plane in their own environment with signing keys held in their own HSM.
Your rights
Your rights depend on where you live and which law applies. We answer every request on its merits.
- EEA and UK (GDPR and UK GDPR): access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interests and to direct marketing at any time. Where we rely on consent you can withdraw it without affecting processing before the withdrawal. You can complain to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office.
- Switzerland (revised Federal Act on Data Protection, in force since 1 September 2023): access, rectification, erasure, objection and data portability, and a complaint to the Federal Data Protection and Information Commissioner (FDPIC).
- India (Digital Personal Data Protection Act, 2023): as a Data Principal you can ask for a summary of the personal data we process and the processing activities, request correction, completion, updating and erasure, use our grievance process, and nominate another person to exercise your rights if you die or become incapacitated. If we do not resolve a grievance, you can approach the Data Protection Board of India.
- United States: residents of states with comprehensive privacy laws, California among them, generally have rights to know what we collect and to access, correct and delete it, and to opt out of sale, of sharing for targeted advertising and of certain profiling. We do none of those three. We will not treat you differently for exercising a right, and we honour Global Privacy Control signals as an opt-out request.
How to make a request
Email dpo@yttsecunet.com or privacy@yttsecunet.com, or write to the Data Protection Officer, YTT SECUNET PRIVATE LIMITED, at the registered office address above. We acknowledge requests within 72 hours and answer within one month. For complex or numerous requests GDPR Article 12(3) allows a further two months, and we will tell you within the first month if we need it.
We may ask for information to confirm your identity before we disclose or delete anything, and no more than we need. An authorised agent can act for you with proof of that authority.
Security
Console data, configuration and receipts are encrypted with AES-256 at rest and with TLS 1.3 in transit. Access is restricted by role, SAML SSO and SCIM are available on Enterprise, and our controls are audited under SOC 2 Type II, ISO 27001 and ISO 27701. If you find a vulnerability, report it to security@yttsecunet.com and we will acknowledge it within 24 hours.
Changes to this notice
Every version carries the date at the top of this page. We publish material changes here at least 30 days before they take effect and email console administrators.