Data Security and Confidentiality

Introduction

TrueCADD is a subsidiary of HitechDigital Solutions LLP, an ISO-certified, multidisciplinary company providing business process management, engineering, and digital solutions to a global clientele.

At TrueCADD, our top priority is to ensure the utmost protection of our clients’ sensitive information, reinforcing our commitment to privacy and trust.

We implement comprehensive security measures that safeguard data from unauthorized access, breaches, and misuse, all while maintaining strict compliance with globally recognized industry standards. Our approach to data protection is built on transparency, reliability, and cutting-edge security protocols, ensuring that our clients have complete confidence in how their information is managed.

As a leader in engineering services, we recognize the unique challenges of protecting not just traditional data assets but also models, drawings and derived insights. Our security framework extends to these specialized assets while maintaining our core commitment to data protection.

Transparency is at the core of our data security framework. We believe in open communication about how we handle, process, and secure data, ensuring that our clients always remain informed and in control. By upholding stringent confidentiality policies and best practices, we continuously reinforce trust and accountability in all our operations.

What Data We Collect and Why

As a leading global provider of engineering services, TrueCADD collects and processes data to improve service delivery, enhance user experience, and comply with legal requirements. Below is a breakdown of the data we collect and the purpose behind it:

Specific Data Points We Collect:

Personal Information: Name, email address, phone number, mailing address
Payment Information: Billing address, payment method details (processed securely through third-party providers)
Business Information: Company name, industry, service preferences
Website Data: Browsing history, cookies, IP addresses, device information
Communication Data: Emails, chat messages, and customer service interactions
Model Artifacts: Parameters, weights, and configurations

Purpose of Data Collection

Personal Information: To facilitate service requests, account creation, and direct communication
Payment Information: To securely process transactions and manage billing
Business Information: To customize services based on industry-specific needs
Website Data: To analyze user behavior, improve website experience, and enhance security
Communication Data: To provide customer support, respond to inquiries, and maintain service quality

Legal Basis for Data Collection

We comply with global regulations, including GDPR, CCPA, and other data protection laws. Our legal basis for collecting data includes:

Consent: We collect and process personal data with explicit user consent
Contractual Necessity: Data processing is required to fulfill contractual obligations to our clients
Legal Obligation: Some data collection is required by law for tax, fraud prevention, and compliance purposes
Legitimate Interest: Certain data is collected to enhance security, prevent fraud, and improve our services
Research and Development: Data collection necessary for improving our analytical models and algorithms

Data Protection Measures

TrueCADD employs a combination of technical, physical, and organizational security measures to ensure the confidentiality, integrity, and availability of client data. We implement robust security protocols to protect data at all stages:

Security Measures

Encryption: All data is encrypted using AES-256 for storage and SSL/TLS for transmission
Access Controls: Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) prevent unauthorized access
Data Masking & Anonymization: Sensitive data is anonymized or masked where necessary
Secure Storage & Backup: Regularly scheduled encrypted backups ensure data integrity and recovery in case of emergencies
Custom-Bonded Offices & Random Checks: All our offices and production facilities are custom-bonded, with random security checks conducted to ensure compliance
Data Minimization: We collect only the necessary data required for service functionality, ensuring minimal data exposure
Regular Security Audits & Penetration Testing: We conduct frequent security assessments to identify and mitigate vulnerabilities
Secure Storage: Data is stored on secure servers with robust security frameworks, including cloud storage providers with industry-leading safeguards

Physical Security Measures

Restricted Access to Facilities: Unauthorized personnel are strictly prohibited from entering Hi-Tech premises
On-Site Security Personnel: Adequate security staff are stationed to guard property and enforce security policies
Document Storage Protection: All sensitive document storage areas are well-secured and monitored
Controlled Movement Within Premises: Employee access is restricted to their designated work areas and is time-regulated
Secure Entry & Exit of Materials: No materials (physical or digital) may be brought into or removed from the premises without prior written permission
Secure Computing Facilities: Dedicated, access-controlled areas for high-performance computing and model training
Environmental Controls: Maintained temperature and humidity controls for computing equipment
Backup Power Systems: Uninterrupted power supply for critical computing infrastructure

Data Retention Policy

We retain data only for as long as it is necessary to fulfill our legal, contractual, and operational obligations:

Active Use: Data is actively maintained for operational and transactional purposes
Retention Period: Data retention policies align with industry standards and regulatory requirements
Secure Disposal: Once the retention period expires or data is no longer needed, we securely delete or anonymize it to prevent misuse
Analytical Results: Retention of analytical outputs based on contractual requirements and business needs

Third-Party Sharing

We prioritize client privacy and share data only with trusted third parties when necessary:

Third-Party Service Providers: This includes payment processors, analytics providers, and cloud hosting services
Strict Data Processing Agreements (DPAs): We have contractual agreements ensuring these partners adhere to the highest security standards
No Unauthorized Sharing: We do not sell or share client data with advertisers or unauthorized third parties
Legal Compliance: We will only share data with law enforcement or regulatory bodies when legally required and will notify clients where permissible
Computing Resources: Cloud computing providers are carefully selected and monitored for security compliance

Employee Training

Our employees undergo continuous security awareness and data privacy training to mitigate potential risks:

Regular Training Programs: Employees are educated on the latest data security threats and best practices
Access Management: Staff access is strictly regulated based on job roles to minimize exposure
Confidentiality Agreements: All employees sign confidentiality and non-disclosure agreements as part of our compliance strategy
Security Best Practices: Regular updates on emerging threats and protection measures

Compliance & Certifications

We adhere to internationally recognized data protection standards:

GDPR (General Data Protection Regulation): Ensuring compliance with European clients
HIPAA (Health Insurance Portability and Accountability Act): Protecting sensitive healthcare data
ISO/IEC 27001: Certifying our commitment to information security management
SOC 2 Compliance: Demonstrating secure handling of customer data
Cloud Security Certifications: Maintaining compliance for cloud-based operations

Confidentiality Policies

Our confidentiality framework includes:

Non-Disclosure Agreements (NDAs): Legally binding contracts to ensure confidentiality
Strict Data Ownership Rules: All data and information provided by a client remain strictly confidential and are solely the property of the client
Employee Security Training: Regular training programs to educate employees on security best practices
Third-Party Vendor Security: Thorough security assessments for all third-party service providers handling data
Defined Job Responsibilities: Clearly defined work responsibilities prevent unauthorized overlap and ensure accountability
Research Confidentiality: Protection of research methodologies and findings

Incident Response & Risk Management

We proactively mitigate security threats with:

Data Breach Response Plan: Rapid incident detection and response mechanisms
Threat Monitoring & Penetration Testing: Regular security audits and real-time monitoring
Advanced Firewall & Intrusion Detection Systems (IDS): Safeguarding networks from cyber threats

Client Data Handling & Retention

Data Lifecycle Management: Clear policies on data storage, processing, and deletion
Strict Data Disposal Policies: Once the data is approved, all raw and processed data are securely destroyed
Secure Data Disposal Methods: Permanent and secure deletion of outdated or redundant data to prevent leaks
Version Control: Maintained history of model versions and associated data
Client-Specific Models: Segregated storage and handling of client-specific algorithms

Transparency & Accountability

Clients can request access, modification, or deletion of their data
A dedicated Data Protection Officer (DPO) ensures compliance and security adherence
Regular Auditing: Periodic review of data handling practices

Security Awareness & Training

Employee Security Training: Frequent training to mitigate human error and insider threats
Cybersecurity Culture: Encouraging best security practices across the organization
Incident Response Training: Regular drills and updates on security procedures
Compliance Updates: Ongoing education about regulatory requirements

Contact Us:

Reach out for security concerns at privacy@hitechdigital.com.

Updates to the Policy

We may periodically update this Data Security and Confidentiality Policy to reflect changes in regulatory requirements, security enhancements, or operational improvements.

Notification of Updates:

Any significant changes to this policy will be communicated through our website and, where applicable, via email notifications
Clients will be informed in advance of any material modifications that impact data handling or security procedures
We review our policy annually or when regulatory changes occur
Model security updates will be specifically communicated
Algorithm protection measures will be regularly reviewed and updated

Effective Date:

This policy was last updated on 1st January 2025
The latest version of this document will always be available on our official website.