Privacy Policy & Global Data Protection Notice

This Privacy Policy governs the collection, processing, and protection of personal data by Rochon ("Rochon", "we", "us", or "our"), an independent AI research and engineering laboratory headquartered in India and operating globally via remote and on-premise infrastructure. This notice applies to visitors of our website (rochon.in), technical inquiry submissions, and business contacts evaluating custom AI models, zero-egress runtimes, and embedded edge systems.

Depending on your location, Rochon operates as a "Data Fiduciary" under the Indian Digital Personal Data Protection Act, 2023 (DPDPA), and as a "Data Controller" under the European Union General Data Protection Regulation (EU GDPR), United Kingdom General Data Protection Regulation (UK GDPR), California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), UAE Federal Decree-Law No. 45 of 2021, and the Saudi Arabian Personal Data Protection Law (KSA PDPL).

Rochon is engineered on the principle of minimal data surface. Our public website does not load third-party behavioral trackers, advertising pixels, invasive session recording scripts, social network SDKs, or cross-site tracking cookies.

We do not use advertising cookies, nor do we participate in behavioral data broker networks. We honor automated browser-level privacy signals, including the Global Privacy Control (GPC) and Do Not Track (DNT) headers, in full compliance with the EU ePrivacy Directive (Directive 2002/58/EC as amended) and California Civil Code § 1798.135.

We collect only personal information that you voluntarily furnish to us when initiating an engineering assessment or submitting an enquiry:

• Commercial Identification: Name, professional work email address, company/organization name, and geographic region. • Technical Workload Specifications: Deployment targets, target silicon (e.g., Jetson, NXP, RTX, L40S), latency constraints, model architectures, and data residency criteria. • Server Telemetry: Standard, ephemeral web server access logs (IP address, HTTP request method, user agent, and timestamp) captured solely for network integrity, DDoS defense, and infrastructure reliability.

Our legal bases for processing include: 1. Consent & Legitimate Interests (GDPR Art. 6(1)(a),(f); DPDPA § 4): Reviewing technical feasibility, responding to inquiries, and scoping prospective engineering contracts. 2. Contractual Necessity (GDPR Art. 6(1)(b)): Preparing bilateral non-disclosure agreements (NDAs) and engineering Statements of Work (SOWs). 3. Legal Compliance: Retaining statutory financial, tax, and corporate audit records under applicable Indian and international commercial laws.

For individuals located in India, your data is processed in strict accordance with the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and the Information Technology Act, 2000 along with the Reasonable Security Practices Rules (SPDI Rules 2011):

• Data Principal Rights: You hold the right to obtain a summary of personal data processed by Rochon, the right to correction and completion of inaccurate data, the right to erasure of personal data that is no longer necessary for the purpose for which it was collected, and the right to readily accessible grievance redressal. • Legitimate Uses & Consent: Any collection through our intake forms is grounded in explicit, informed notice. Data is used solely for the specified commercial purpose under Section 7 of the DPDPA. • Grievance Officer: In accordance with Indian legal requirements, our designated Data Grievance Officer can be contacted at contact@rochon.in. Inquiries will be acknowledged within 48 hours and addressed within 30 days. • CERT-In Compliance: We maintain operational security standards aligned with Indian Computer Emergency Response Team (CERT-In) cybersecurity directions regarding incident containment and reporting.

If you reside within the European Economic Area (EEA) or the United Kingdom, your rights are governed by the EU GDPR (Regulation (EU) 2016/679) and UK GDPR / Data Protection Act 2018:

• Data Subject Rights: You are entitled under Articles 15 through 22 of the GDPR to: (i) access your personal data; (ii) rectify inaccurate data; (iii) request erasure ("right to be forgotten"); (iv) restrict processing; (v) obtain data portability in a structured, machine-readable format; and (vi) object to processing founded upon legitimate interests. • International Data Transfers: Where communication involves cross-border transfer of preliminary business contact details from the EEA/UK to our operational base in India, we implement approved transfer mechanisms, including European Commission Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTA), alongside rigorous technical encryption standards. • Supervisory Authority Complaints: You have the right to lodge a formal complaint with your competent National Data Protection Authority (e.g., CNIL, BfDI, DPC) or the UK Information Commissioner's Office (ICO).

This section provides supplementary disclosures for residents of California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq.), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Texas (TDPSA):

• No Sale or Sharing of Personal Information: Rochon has not sold, rented, or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months, and will never do so. • Consumer Rights: Eligible US residents may submit requests to know what personal information has been collected, request deletion of personal information, correct inaccurate records, and obtain a portable copy of their data. • Non-Discrimination: We will never discriminate against you, deny access to technical benchmarks, or adjust response timelines because you exercised statutory privacy rights. • FTC Act Section 5 Compliance: In compliance with Federal Trade Commission transparency mandates, Rochon guarantees that contact and technical enquiry submissions are never used to train public generative models or commercial AI classifiers.

For enterprise partners and individuals in the GCC and MENA region, we align operations with regional data protection statutes:

• United Arab Emirates (UAE): Compliance with Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE PDPL), the Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020, and Abu Dhabi Global Market (ADGM) Data Protection Regulations. Data subjects maintain the right to access, rectify, restrict, and mandate erasure of personal records. • Kingdom of Saudi Arabia (KSA): Compliance with the Personal Data Protection Law (KSA PDPL, Royal Decree No. M/19) and the regulatory directives of the Saudi Data & AI Authority (SDAIA). Rochon adheres to strict purpose limitation, data minimization, and statutory controls governing cross-border data transfer, guaranteeing that sensitive national or commercial information remains bounded within agreed local jurisdictions. • Consent & Data Destruction: Data subjects in the UAE and Saudi Arabia may withdraw consent at any time, prompting the verified destruction of contact records.

We apply rigorous administrative, physical, and technical safeguards (TOMs) to secure all information:

• Cryptographic Controls: All web transmissions are encrypted in transit via Transport Layer Security (TLS 1.3). Stored communication records are protected with AES-256 encryption at rest. • Retention Timeline: Commercial inquiry records and technical scoping documents are retained for a maximum duration of twenty-four (24) months following the date of last communication. Following this period, records are purged via automated database scripts. • Security Breach Notification: In the event of a confirmed security incident impacting personal data, Rochon will notify affected data subjects and appropriate supervisory bodies in accordance with statutory timelines (including CERT-In guidelines, GDPR Article 33 72-hour notifications, and DPDPA requirements).

To exercise any statutory right under the DPDPA, GDPR, CCPA/CPRA, UAE PDPL, KSA PDPL, or other applicable privacy legislation, or to submit a formal privacy grievance, please submit a written request to:

Rochon AI Research & Engineering Lab Attention: Privacy & Compliance Office Email: contact@rochon.in Geographic Location: India · Remote Operations

We acknowledge all verified requests within forty-eight (48) hours and deliver a formal resolution within thirty (30) calendar days, free of charge.