Privacy Policy & Data Protection
This Privacy Policy outlines how Kusha.io processes, protects, and governs personal and proprietary technical data across our website, discovery consultations, software engineering contracts, and client portals.
1. Data Controller & Legal Entity
Under the European Union General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable member state data protection legislations, the designated Data Controller responsible for your personal data is:
Business Entity registered in the Netherlands
Chamber of Commerce Registration (KVK): 98986708
Governing Law: Netherlands / European Union
Official Data Protection Inquiry Desk: info@kusha.io
Kusha.io operates a structured global model comprising European legal headquarters in the Netherlands for governance, contracting, and client stewardship, paired with a specialized engineering center in India for technical delivery.
2. Information We Collect
We collect personal information to scope prospective projects, provide software engineering services, execute confidentiality agreements, and maintain high-quality communications. We only process data that is relevant and strictly necessary.
- Full Name and Professional Title
- Business Email Address
- Company Name and Location/Country
- Technical Project Briefs and Requirements
- Mutual NDA & Contractual Preferences
- Preferred Engagement Models (Fixed-Price, Pod, etc.)
- IP Address and approximate geographic location
- Browser user-agent, operating system, and screen resolution
- Referring URL, timestamp, and session duration
- Telemetry via Google Tag Manager (GTM-M77HWJ4W) and GA4
- API request timestamps for IP rate-limiting protection
3. Legal Basis for Processing (GDPR Art. 6)
We process your personal information strictly under lawful bases recognized by Article 6 of the GDPR:
4. How We Use Your Data
Kusha.io uses collected information solely for legitimate enterprise and software engineering objectives:
- Initial Scoping & Discovery: Reviewing project briefs and technical architectures to assess feasibility and prepare discovery roadmaps within 24 business hours.
- Contractual Execution: Executing Statements of Work (SOW), Master Services Agreements (MSA), and bilateral Non-Disclosure Agreements (NDA).
- Customer Service: Responding to inquiries submitted through our contact forms or email at
info@kusha.io. - Security & Resilience: Identifying and mitigating malicious traffic, automated scrapers, and spam abuse.
5. Security & Technical Safeguards
We implement state-of-the-art organizational and technical security measures aligned with ISO/IEC 27001 and GDPR Article 32 guidelines:
- Encryption in Transit: All website traffic, API calls, and form submissions are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: Database records and backups are encrypted using standard AES-256 protocols.
- Role-Based Access Control (RBAC): Access to client data is strictly restricted to designated solution architects and project leads with a legitimate need-to-know basis.
- DDoS & Rate Limiting: Public submission endpoints enforce automated IP rate-limiting (5 requests per minute per IP) to mitigate unauthorized automated spam and resource exhaustion.
- Secure Development Lifecycle: Code commits undergo static vulnerability scanning and peer reviews before deployment to production environments.
6. International Transfers & Global Hub
Kusha.io operates a Netherlands-registered legal headquarters alongside a software engineering center in India. Where client inquiries or project delivery require collaboration across these entities:
- Transfers between our European and Indian delivery pods are governed by European Commission Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46.
- Our Indian engineering center operates under strict confidentiality protocols, zero local storage of production client databases without explicit consent, and European GDPR data protection standards.
- All European client contracts are executed under Netherlands jurisdiction with direct legal enforceability.
7. Data Retention Policy
We do not retain personal data longer than necessary for the purposes for which it was collected:
| Data Category | Retention Period | Purpose |
|---|---|---|
| Project Inquiries & Scoping | 24 months from last contact | Follow-up proposals & architecture alignment |
| Executed Contracts & SOWs | 7 years post-contract completion | Dutch statutory tax & commercial law compliance |
| Security Logs & IP Tokens | 30 to 90 days | Abuse detection & rate limit enforcement |
8. Your Rights Under GDPR
Under European Union data protection regulations, you possess enforceable legal rights regarding your personal data:
To exercise any of these rights, email our team directly at info@kusha.io. We respond to all verified requests within 30 days without fee.
You also have the right to lodge a formal complaint with the Dutch Data Protection Supervisory Authority: Autoriteit Persoonsgegevens (AP) at autoriteitpersoonsgegevens.nl.
10. Data Protection Officer & Inquiries
If you have questions, feedback, or requests regarding this Privacy Policy or our security practices, our dedicated compliance desk is at your disposal: