SECTION 1: PURPOSE & SCOPE

Kaishi Innovations ("we," "our," or "us") is an end-to-end technology, business advisory, and compliance-driven software integration firm. This Global Privacy Policy establishes our firm commitment to data privacy, transparency, and security, fully aligning with international regulatory benchmarks (including GDPR equivalent frameworks and ISO/IEC 27001 data governance standards).

This policy governs all data processing and business operations conducted through our official website, digital channels, client interactions, software delivery pipelines, physical/hybrid office operations, and our integrated ISO-compliance systems.

SECTION 2: CATEGORIES OF DATA COLLECTED

To deliver our full-spectrum services—spanning custom software engineering, business development advisory, UI/UX design, marketing system integration, and ISO standard compliance—we collect and process the following categories of data:

SECTION 3: LAWFUL BASES & PURPOSES OF PROCESSING

We process collected information strictly under internationally recognized professional and lawful bases:

• Contractual Necessity: Processing client data, business strategies, and technical assets required to execute software development, business advisory, marketing integrations, and ISO-compliant system setups according to signed Statements of Work (SOW).
• Legal & ISO Quality Management: Retaining operational logs, access controls, process documentation, and audit trails to satisfy ISO 9001 and ISO 27001 audit requirements.
• Legitimate Business Interests: Managing client relationships, protecting intellectual property rights, securing both remote and physical corporate workflows, and advancing our proprietary engineering and advisory methodologies.

SECTION 4: DATA SECURITY & HYBRID GOVERNANCE (ISO 27001 ALIGNED)

Given our operations spanning remote/distributed teams as well as physical/hybrid corporate office environments, Kaishi Innovations enforces multi-layered technical, physical, and organizational security controls:

• Encryption Standards: All data in transit is protected using TLS 1.3 protocols, and data at rest (including client repositories, corporate databases, and backups) is encrypted using advanced AES-256 standards on secure cloud infrastructure (AWS/Azure).
• Role-Based Access Control (RBAC): Internal access to client codebases, strategic files, and cloud resources is strictly regulated on a need-to-know basis, enforced via Multi-Factor Authentication (MFA).
• Hybrid & Remote Device Governance: All personnel—whether operating remotely or from our physical offices—must maintain encrypted local storage, secure screen-lock policies, and active enterprise endpoint security software.
• Automated Auditing & System Traceability: Built-in audit logs and automated daily database backups are embedded into all systems we build to ensure full ISO traceability and compliance readiness.

SECTION 5: DATA RETENTION & DESTRUCTION PROTOCOLS

• Operational Retention: Client project files, source codes, advisory documents, and personal data are retained only for the duration of the active service agreement or as required to support ongoing maintenance and compliance retainers.
• Post-Project Handling: Upon formal project completion and full financial settlement, core intellectual property and custom source code transfer entirely to the client. Kaishi Innovations purges temporary development caches while retaining statutory compliance, quality management, and ISO audit logs as mandated by framework requirements.

SECTION 6: THIRD-PARTY SHARING & PROCESSORS

We do not sell, rent, or monetize personal or business data. Data sharing is strictly limited to:

• Vetted Enterprise Personnel: Internal software engineers, system architects, business advisors, marketing strategists, and QA leads bound by strict binding confidentiality agreements (NDAs) and corporate security protocols.
• Accredited ISO Inspection Partners: Accredited audit partners who review our internal quality management frameworks and client ISO-ready systems during official compliance inspections, under strict non-disclosure terms.
• Legal Authorities: Regulatory or judicial bodies only when mandated by binding legal processes to protect corporate rights or comply with statutory obligations.

SECTION 7: DATA SUBJECT & CLIENT RIGHTS

Subject to applicable data protection laws, individuals and corporate clients hold the following rights regarding their data:

• Right of Access: Request a comprehensive report of all personal, advisory, or project data processed by Kaishi Innovations.
• Right to Rectification: Request the immediate correction of inaccurate, incomplete, or outdated information.
• Right to Erasure ("Right to be Forgotten"): Request the deletion of data, subject to legal or contractual retention limits (such as ISO audit trail requirements).
• Right to Restriction of Processing: Limit how we process data under specific contested circumstances.