Privacy Policy

Last updated: 1 October 2026. This policy is written to comply with the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act").

1. Who we are

MYTHCON SHM ("MYTHCON", "we", "us", "our") is an engineering and infrastructure technology company operating from offices in Kolkata and Chennai, India. For the purpose of the DPDP Act, MYTHCON is the "Data Fiduciary" in respect of the personal data described in this policy.

[Registered legal entity name and company registration number (CIN/LLPIN, if applicable) — TBD. This policy currently refers to the trading name "MYTHCON SHM" and will be updated to include the full registered entity details before this page is relied on as a final, signed-off legal document.]

This policy applies to personal data collected through https://mythcon.vedicdevs.com — including the contact enquiry form and the careers / job application pages — and explains your rights as a "Data Principal" under the DPDP Act.

2. Data we collect

We only collect personal data that you choose to give us, through the following forms:

Contact enquiry form

• Full name and email address (required)
• Phone number and company / organisation name (optional)
• The asset type you select and the project details you type into the message field
• Your IP address and submission timestamp, recorded automatically for spam and security purposes

Careers / job application form

• Full name, email address, phone number and current location (required)
• Total experience, and — if you choose to share them — current company, notice period, current CTC and expected CTC
• LinkedIn or portfolio link, and a short note about yourself (optional, except where a role requires it)
• Your resume file (PDF, DOC or DOCX), which we scan to verify it is a genuine document of the type you claim before it is stored
• Your IP address and submission timestamp, recorded automatically for spam and security purposes

We do not knowingly collect any special category of personal data (such as health, biometric or financial account data) through either form.

3. Cookies

This website does not use any analytics, advertising or tracking cookies. The only cookie set is a strictly necessary, session-only cookie used to keep the contact and application forms secure (CSRF protection); it is deleted automatically when you close your browser and is never used to identify or track you across visits or other sites.

4. Why we collect it

We use the personal data described above only for the following purposes:

• Responding to your enquiry and corresponding with you about your project
• Evaluating your job application against the role you applied for, or against future vacancies if you submit a general application
• Verifying submissions are genuine and preventing spam or abuse of our forms
• Keeping records we are legally required to keep, and defending or exercising legal claims
• Improving this website and our services

We do not use your personal data for automated decision-making, profiling or targeted advertising.

5. Legal basis for processing

Under the DPDP Act, we process your personal data on the following bases:

• Your consent (Section 6) — given through the consent checkbox on the contact and careers forms, for the specific purposes described in this policy.
• Certain legitimate uses (Section 7) — for example, where you have voluntarily provided your data for a specified purpose (such as a job application) and have not indicated that you do not consent to its use for that purpose.

6. Your consent

Before you submit the contact or careers form, we ask you to tick a clear, unticked-by-default checkbox confirming that you have read this policy and consent to our processing of the personal data you have entered, for the specific purpose stated next to the checkbox. You may withdraw your consent at any time by writing to us (see Contact us) — this will not affect the lawfulness of anything we did with your data before you withdrew consent, and may mean we can no longer progress your enquiry or application.

7. Sharing & processors

We do not sell personal data. We share it only with service providers who process it on our behalf, under our instructions, strictly to operate this website:

• Cloudinary — stores uploaded resume files
• Our web hosting provider — hosts the website and database
• Our email service — delivers notification emails when a form is submitted

We may also disclose personal data where required by law, regulation, court order or a lawful request from a government authority.

8. Cross-border transfer

Some of the service providers listed above may process or store data on servers located outside India. The DPDP Act (Section 16) permits such transfers except to countries the Central Government specifically restricts by notification. We only transfer personal data to processors as needed to provide this website and our recruitment process, under contractual terms that require them to protect it appropriately.

9. Retention

[Exact retention periods are a business decision for MYTHCON to confirm — the figures below are a reasonable starting point, not yet finalised.]

• Contact enquiries: retained for up to 24 months from your last interaction with us, then deleted or anonymised.
• Job applications: retained for up to 24 months from submission (or longer with your consent, so we may consider you for future roles), then deleted or anonymised, unless you ask us to delete it sooner.

We may retain data for longer where required to comply with a legal obligation, resolve a dispute or enforce our agreements.

10. Security

We take reasonable technical and organisational measures to protect your personal data, including:

• Encrypted transmission (HTTPS) between your browser and our servers
• Database queries built exclusively with parameterised statements, to prevent injection attacks
• Content-based verification of every uploaded resume, so a file cannot disguise its real type
• Restricted, role-based access to submitted data within our admin panel
• CSRF protection and spam-prevention checks on every form

No method of transmission or storage is completely secure; if we become aware of a personal data breach that is likely to affect you, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act.

11. Children's data

This website and our recruitment process are not directed at, and we do not knowingly collect personal data from, individuals under 18 years of age. If you believe a minor has provided us with personal data, please contact us (see Contact us) so we can delete it.

12. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed
• Correct, complete or update inaccurate or outdated personal data
• Erase personal data that is no longer necessary for the purpose it was collected, unless we are required to keep it by law
• Withdraw consent at any time, as easily as you gave it
• Grievance redressal — raise a complaint with us about how we have handled your personal data (see below)
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity

To exercise any of these rights, write to us using the contact details in Contact us. We will respond within a reasonable time and in line with our obligations under the DPDP Act.

13. Grievance redressal

[A named Grievance Officer, as required by the DPDP Act, has not yet been formally designated — TBD. Until confirmed, grievances will be handled by the contact below.]

Grievance contact: Krishnendu Mandal, Kolkata office — B-G-4, Om Moy, 4th Floor, BA-22, P Kanan, Kolkata 700101, West Bengal, India. Email krishnendu@mythcon-shm.com. We aim to acknowledge grievances promptly and resolve them within the timelines prescribed under the DPDP Act.

14. Complaints to the Data Protection Board of India

If you are not satisfied with how we have resolved your grievance, you have the right to file a complaint with the Data Protection Board of India, established under the DPDP Act.

15. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our practices or in applicable law. We will post the revised policy on this page with an updated "Last updated" date.

16. Contact us

For any question about this policy or your personal data, write to us:

• Kolkata office — B-G-4, Om Moy, 4th Floor, BA-22, P Kanan, Kolkata 700101, West Bengal, India, krishnendu@mythcon-shm.com
• Chennai office — 327, Ramaniyam Magnum, Venkataswara, Nehru Nagar, Perungudi, Chennai 600096, Tamil Nadu, India, sriram@mythcon-shm.com

Or email krishnendu@mythcon-shm.com.