Effective Date: 01 Jan 2026

Last Updated: 01 Nov 2026

This Privacy Policy explains how Cemetrix (“we,” “us,” or “our”) collects, uses, discloses, and safeguards your personal information when you visit our website (cemetrix.com), engage with our enterprise IT and Business Solutions, or interact with us in a business-to-business (B2B) capacity.

As a global provider of Global Capability Center (GCC) setups, AI/ML solutions, and enterprise digital infrastructure, we are committed to maintaining the highest standards of data privacy and aligning our practices with international data protection regulations, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and applicable regional laws.

1. Our Role in Data Processing

• As a Data Controller: When you visit our website, subscribe to our insights, or communicate with us regarding our services, Cemetrix acts as a Data Controller determining the purposes and means of processing your personal data.
• As a Data Processor: When we provide enterprise IT services, cloud infrastructure, or managed GCC operations to our corporate clients, we act as a Data Processor. In these instances, we process data strictly in accordance with our clients’ documented instructions and Data Processing Agreements (DPAs). This Privacy Policy applies to our activities as a Data Controller.

2. Information We Collect

We collect information directly from you, automatically through your interaction with our digital platforms, and from third-party B2B sources.

A. Information You Provide to Us

• Business Contact Information: Name, job title, company name, email address, physical business address, and phone number when you request a consultation, download whitepapers, or utilize our “Contact Us” portals.
• Account & Authentication Data: Credentials and profile information if you access our secure B2B client portals or support dashboards.
• Communication Records: Transcripts, emails, and details of your inquiries regarding our SAP integrations, IT modernization, or GCC services.

B. Information Collected Automatically

• Device & Technical Data: Internet Protocol (IP) address, browser type, operating system, and device identifiers.
• Usage Telemetry: Pages viewed, interaction with our digital motion assets (e.g., Lottie animations, customized UI blocks), time spent on site, and referring/exit pages.
• Cookies & Tracking Technologies: We utilize cookies, web beacons, and similar tracking technologies to analyze trends, administer the website, and track user movements around our platform.

3. How We Use Your Information

We utilize your personal data to deliver world-class enterprise services and optimize our digital presence:

• Service Delivery & Operations: To provide, operate, and maintain our B2B IT platforms, respond to your inquiries, and fulfill contractual obligations.
• Business Communication: To send administrative information, technical notices, security alerts, and updates regarding your enterprise architecture or managed services.
• Marketing & Insights: To deliver tailored insights, thought leadership, and promotional materials related to industry-specific IT solutions (subject to your consent where required by law).
• Analytics & Improvement: To analyze website telemetry and user behavior, allowing us to continuously optimize our digital interfaces, frontend engineering, and content architecture.
• Security & Compliance: To enforce our Zero-Trust security protocols, detect and prevent fraud, monitor against cyber threats, and comply with legal obligations.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using your personal information depends on the context:

• Performance of a Contract: Processing is necessary to fulfill our service agreements with your enterprise.
• Legitimate Interests: Processing is necessary for our legitimate B2B interests (e.g., direct marketing, network security, and website optimization) that do not override your fundamental rights.
• Consent: Where you have expressly opted in to receive marketing communications or the use of non-essential cookies.
• Legal Obligation: Where processing is required to comply with applicable laws.

5. Data Sharing and Third-Party Disclosures

We do not sell your personal data. We only share information with trusted parties under strict confidentiality agreements:

• Service Providers & Sub-processors: Cloud hosting providers (e.g., AWS, Azure), CRM platforms, and data analytics tools that assist in our business operations.
• Corporate Affiliates: Between Cemetrix subsidiaries and regional operating entities for operational synchronization.
• Legal & Regulatory Authorities: When required by law, subpoena, or to protect the vital interests, safety, or intellectual property of Cemetrix, our clients, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred to the acquiring entity.

6. International Data Transfers

Cemetrix operates globally, with core operational and capability centers situated in South Asia (including Karachi, Pakistan) and other international tech hubs. Your information may be transferred to, stored, and processed in countries outside of your region of residence.

When we transfer personal data originating from the EEA, UK, or other regulated regions to countries not deemed to provide an adequate level of data protection, we implement robust safeguards, including Standard Contractual Clauses (SCCs) approved by relevant regulatory bodies, and supplementary technical measures like encryption and micro-segmentation.

7. Data Security and Retention

We protect your data with the same rigor we apply to our enterprise IT solutions. Cemetrix implements industry-standard Zero-Trust network principles, encryption in transit (TLS) and at rest, and strict Identity and Access Management (IAM) controls to protect your personal information against unauthorized access, alteration, or destruction.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, resolve disputes, enforce our agreements, or as mandated by statutory retention requirements.

8. Your Global Privacy Rights

Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA), you possess specific rights regarding your personal data:

• Right to Access & Portability: Request a copy of the personal data we hold about you in a structured, machine-readable format.
• Right to Rectification: Request corrections to inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request the deletion of your personal data under certain conditions.
• Right to Restrict or Object: Object to our processing of your data, particularly for direct marketing or where based on legitimate interests.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
• California Privacy Rights: California residents have the right to request information regarding the disclosure of personal information to third parties for direct marketing purposes and to opt out of the “sharing” of personal information for cross-context behavioral advertising.

To exercise these rights, please contact our Data Privacy Officer using the details below. We will respond to your request within the timeframe stipulated by applicable law.

9. Third-Party Links

Our website may contain links to industry partners, technology vendors, or external portals. We are not responsible for the privacy practices or the content of these third-party sites. We encourage you to review their respective privacy policies upon navigating away from Cemetrix platforms.

10. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data governance practices, please contact us:

Cemetrix

• Attention: Data Privacy Officer / Legal Counsel
• Email: privacy@cemetrix.com