NDA & Confidentiality Policy

1. Scope

This policy explains how EthicsComputer LLP ("we", "us") protects the confidential information that clients, prospective clients and business partners share with us, and what we expect in return for the information we share. It applies from the first conversation, before any contract is signed.

If you and we have signed an NDA, or a contract with confidentiality terms, that document prevails where it differs from this policy, and this policy fills any gap. Personal data we collect for our own purposes is covered by our Privacy Policy, and the wider contract terms by our Terms of Service.

2. When we sign an NDA

• Before scoping: we sign an NDA before you share business plans, source code, database backups, system details or credentials with us, and before we scope or quote the work.
• Mutual: our standard NDA is mutual. It protects your information and ours, such as our pricing, methods and tools.
• Every project: every project is covered by a mutual NDA, together with a written specification, milestone sign-off and the source-code and IP handover described in our Terms of Service.
• Your own template: we are happy to review and sign your NDA instead of ours. If a clause does not suit both sides, we suggest a change before signing.
• Before an NDA is signed: anything confidential you share with us in an enquiry, a call or a meeting before the NDA is signed is still treated as confidential under this policy.

3. What counts as confidential

Confidential information is any non-public information that either side shares for the engagement, in any form (written, spoken, electronic or shown on screen), whether or not it is marked "confidential". For example:

• source code, databases, designs, system architecture and APIs;
• passwords, API keys, access tokens, server and VPN logins, and encryption keys;
• business plans, pricing, financial information, and customer and supplier lists;
• personal data of your customers, employees or users;
• security information: network diagrams, configurations, test results, vulnerability reports and incident details;
• product ideas, roadmaps and trade secrets;
• the terms of our proposal and contract with you;
• notes, copies and analyses made from any of the above.

4. What is not confidential

Information is not confidential if the party that received it can show that it:

• is public, or becomes public, other than through a breach by the receiving party;
• was already lawfully known to the receiving party before it was shared, without any duty of confidence;
• was received lawfully from someone else who was free to share it; or
• was developed independently, without using the confidential information.

A combination of details is not excluded just because some of the details are public. Disclosure that the law requires is covered in section 9.

5. How we use your information

• We use your confidential information only for the engagement: to scope, quote, deliver and support the services you asked for.
• We do not share it with anyone except as set out in section 6, we never sell it, and we do not use it to compete with you or to market to your customers.
• We do not use it to train AI models, and we do not put it into public AI tools that may store it or learn from it, unless you agree in writing.
• We make copies only when the work needs them.

6. Who can see your information

• Need to know: only the people working on your engagement can access your information.
• Staff and interns: every employee, intern and consultant signs a written confidentiality agreement before getting access, and the duty continues after they leave us. Training exercises for interns use sample data, never client production data.
• Subcontractors and CA professionals: we involve them only when the work needs it, and only under written confidentiality terms at least as protective as ours. We remain responsible for them. If your NDA requires your approval before we involve anyone outside our staff, we ask you first.
• Referring partners: if you came to us through one of our business partners, that partner can see in the partner portal your business contact details and the names, status, deadlines and invoice and payment status of your projects, so that they can support you and track their commission. They are not given your source code, credentials, data or security findings.

7. How we protect shared material

• We handle client information under our ISO/IEC 27001:2022 certified information security management system.
• Shared files, code and data are kept on access-controlled systems, in folders or repositories set up for your project and open only to the project team.
• We ask you to share passwords and keys through a secure method (for example a password manager's sharing feature, an encrypted file or our portal), not in plain chat or email. We store them encrypted and use them only for the agreed task.
• When a person leaves your project, or the engagement ends, we remove their access, and we ask you to change any passwords you shared with us.

More about our security practices is in our Security Policy.

8. Security testing findings

• Everything that comes out of a VAPT or security audit (vulnerabilities, evidence, screenshots, any data seen during testing and the report itself) is your confidential information.
• We share findings only with the contacts named in your written authorisation, and only through a secure channel.
• We access only the data needed to prove a finding, and do not copy or keep personal data beyond that.
• We never publish or discuss your vulnerabilities, or use them in marketing or case studies, without your written permission.
• If we find a flaw in a third-party product while testing, we agree with you how it will be reported to the vendor.
• Test data and evidence are deleted after the engagement as described in section 11. We keep a copy of the final report, under this policy, unless you ask us to delete it.

9. Disclosure required by law

If a law, a court, a regulator or another government authority requires us to disclose your confidential information, we:

1. tell you first, where the law allows it, so that you can object or ask for protection;
2. disclose only the part that is legally required; and
3. ask the authority to keep it confidential.

10. Personal data in your information

When your confidential information includes personal data (for example, your customers' records in a system we build, host or test), you decide why and how it is processed, and we act as your Data Processor under the Digital Personal Data Protection Act, 2023, as its provisions come into force. We process it only on your instructions, protect it with reasonable security safeguards, tell you without undue delay about any personal data breach affecting it so that you can meet your own legal duties, and return or delete it at the end of the engagement.

11. Returning or destroying information

• When the engagement ends, or earlier if you ask in writing, we return or securely delete your confidential information (files, repositories, credentials and test data) within 30 days and confirm this to you in writing.
• We may keep: (a) records that the law requires us to keep, such as invoices, contracts and accounts under GST and income-tax law; (b) copies held in routine backups that cannot be deleted one by one, which are overwritten in the normal backup cycle; and (c) where your NDA allows it, a copy of the deliverables and reports needed to support a warranty or answer a claim. Anything we keep remains confidential under this policy.
• We ask you to do the same with our confidential information, such as our pricing, tools and methods.

12. How long confidentiality lasts

• Confidentiality lasts for the period stated in the signed NDA.
• If no period is stated, the duty lasts throughout the engagement and for five years after it ends.
• Trade secrets, passwords and keys, personal data and security findings stay confidential for as long as they remain non-public, even after those five years.

13. Breach and remedies

• If we become aware that your information held by us has been accessed or disclosed without permission, we tell you without undue delay, explain what happened, act to contain it, and work with you on the next steps.
• Because money alone may not undo a disclosure, the affected party can ask a court for an injunction to stop or prevent it under the Specific Relief Act, 1963, as well as claim damages for its loss under the Indian Contract Act, 1872, within any limits agreed in the NDA or our Terms of Service.
• Disclosing personal information obtained under a contract, without consent and with intent to cause wrongful loss or gain, is also an offence under section 72A of the Information Technology Act, 2000.
• A member of our staff who breaches confidentiality faces disciplinary action, which can include dismissal, and legal action.
• Disputes follow the path in our Terms of Service: written notice, 30 days of good-faith discussion, then the courts at Rohtak, Haryana.

14. How to request an NDA

1. Write to info@ethicscomputer.in with the subject "NDA request", or use our contact page.
2. Include the legal name and registered address of your business, the name and designation of the person who will sign, a short description of the project you want to discuss, and whether you want our standard mutual NDA or would like us to sign yours.
3. We send our standard mutual NDA for signature, or review your NDA and reply with any comments.
4. The NDA can be signed electronically (Aadhaar eSign or a digital signature certificate, both recognised under the Information Technology Act, 2000) or on paper. Any stamp duty depends on the stamp law of the state concerned.
5. Each side keeps a signed copy.

Need an NDA for your own business, for example with your staff, vendors or investors? See our agreement drafting service.

Contact and grievance officer

We acknowledge every complaint within 48 hours and resolve it within one month of receiving it. Please include your name, phone number, the page or service concerned, and any order, invoice or transaction ID.