The Constant Company, LLC ("Vultr”, “we”, “us”, or “our”) believes it is important that you understand how Vultr collects, stores, shares, and uses information from and about our Site (as defined below) visitors, subscribers, customers and vendors (“you”, or “your”).
This Privacy Notice (“Notice”), our cookie policy and other legal notices posted on this website, www.vultr.com (“Site”) describe our collection, use and disclosure of personal data.
(i) collected through the Site, or
(ii) when you subscribe to, or otherwise use our online services (“Services”), or
(iii) in the course of our business activities conducted elsewhere.
This Notice describes our activities that are governed by the laws of India, including the Digital Personal Data Protection Act, 2023 (“DPDPA”) and the Information Technology Act, 2000 (“IT Act”). Vultr acts as a data fiduciary and a data processor under the DPDPA, and as an intermediary under the IT Act.
This Notice does not apply to the information collected, stored, shared, or distributed by: (i) third-party websites; and (ii) our customers. When Vultr processes personal data on behalf of a customer in connection with the Services, Vultr acts as a data processor and an intermediary. The customer retains responsibility for ensuring that such processing has a lawful basis and for compliance with the applicable laws.
Vultr is the data fiduciary for personal data that Vultr collects directly from you in connection with your use of our Site or Services, or the relationship between Vultr and you. For the purposes of this Notice, personal data means any data about an individual who is identifiable by or in relation to such data.
When you visit our Site, or use our Services, our servers automatically collect certain browser or device generated information, including but not limited to:
Where this information constitutes personal data, except as specified in this paragraph below, we will not: (i) use this automatically collected information to try to identify you by name; or (ii) associate this personal information with the information you provide voluntarily, as detailed below. However, we may use such automatically collected data: (i) without your consent for legitimate use cases and purposes permitted under applicable laws, such as providing and securing the Services, detecting and preventing fraud or misuse, and understanding usage patterns; (ii) if required or permitted to do so under the applicable laws; or (iii) if instructed to do so by you or someone acting on your behalf, such as to diagnose and resolve technical issues.
In order to access or use certain portions of the Site or Services, or enjoy the full functionality of the Site or Services, or otherwise in conducting business with us or seeking to conduct business with us, you may be prompted to provide certain personal data to us in the following ways:
This personal data is required to enter into a contract with you (such as in anticipation of a supply agreement, or to learn about our Services) or to perform a contract with you (such as to provide Services), and failure to provide any information may result in our inability to provide requested Services or products.
We may also obtain fraud and risk-scoring data about you from third parties, namely MaxMind and Kount. We process such data as permitted “legitimate uses” under the DPDPA in order to detect and prevent fraud, abuse or security incidents, and we do not use it for unrelated profiling or marketing.
If these third parties act as our data processors, they will process personal data only on our instructions and are subject to contractual obligations to implement appropriate security safeguards and to assist us in meeting our obligations under the DPDPA and other applicable laws, including with respect to deletion and incident response. In cases where these third parties act as independent Data Fiduciaries as per the DPDPA, they shall be governed by their own privacy policies which we suggest you to separately be aware about.
Our Site uses cookies. Cookies or similar technologies that are not strictly necessary for the operation of the Site or for providing a service expressly requested by you will be used only after obtaining your explicit consent, which shall be sought through a clear notice specifying the purpose of such cookies and the categories of data collected. More information about our use of cookies can be found in our cookie policy.
All processing and use of your personal data are done in accordance with the provisions of DPDPA. We process your personal data based on one or more of the following legal grounds:
We use the personal data we collect for the following specified purposes:
We also use non-personal data and aggregate information, such as that collected automatically, to customize our marketing efforts or to customize the use of the Site for an aggregate group of customers.
Vultr does not sell, share or rent your personal data to third parties.
For processing activities based on your consent, we may process your personal data for the purposes for which we have obtained your consent and for any other reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you, explain the legal basis which allows us to do so and obtain fresh consent for that specific purpose.
We may disclose personal data about Site visitors, users of our Services, or our suppliers or customers if, in our sole discretion, we believe that it is reasonable to do so, including:
We provide our customers the ability to select the location for storage of their content based on their own requirements. For storing your content, our servers in India are located in Bangalore, Delhi, and Mumbai. We may provide additional or fewer locations in India for storing your content. For a complete listing of all data centers and locations please visit https://www.vultr.com/features/datacenter-regions/. We undertake all reasonable measures to ensure the security of the personal information shared by you.
Your personal data may be transferred to, processed in, and stored at, destinations outside India, including the United States and other countries where our servers or service providers are located, or where our employees or contractors are located, such as for the purpose of providing support services to you. Such transfers are made only for the purposes described in this Notice and in accordance with applicable laws. When we transfer your personal data outside India, we take appropriate safeguards to ensure that your data remains protected.
The Site and our Services are not intended for use by children under the age of 18 years and Vultr does not knowingly collect, store, share, process, or use the personal data of children under 18 years. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete such information. Verifiable parental consent includes verifying their identity and age through appropriate measures in accordance with applicable law. If you are under the age of 18 years, please do not provide any personal data, even if prompted by the Site to do so. If you are under the age of 18 years and you have provided personal data, please ask your parent(s) or guardian(s) to notify Vultr and Vultr will delete all such personal data. We do not knowingly undertake tracking or behavioral monitoring of children.
Where lawful to do so, and subject to your consent where required, we may communicate with you by e-mail to tell you about our Services. If you wish to stop receiving marketing communications, please use the ‘unsubscribe’ link provided in our emails.
If you are a subscriber to our Services, we may send you periodic announcements including the details of our existing and new programs. If you wish to stop receiving these announcements, please fill out the form at https://www.vultr.com/unsubscribe/ or by clicking the opt-out link at the bottom of these emails.
If you opt out of marketing emails, you may still receive system notices and other information that is specifically related to your subscription or account.
We take measures, including data encryption, to protect the transmission of all sensitive end-user information. We make reasonable efforts to ensure the integrity and security of our network and systems. Nevertheless, we cannot guarantee that our security measures will prevent third-parties from illegally obtaining this information. We take all reasonable measures to prevent such breaches of security, but given the resourcefulness of cyber-criminals we are unable to guarantee that our security is 100% breach-proof. You assume the risk of such breaches to the extent that they occur despite our reasonable security measures.
Security Breach Notification: In the event of a personal data breach that affects you, we will notify you without delay and in any event within 72 hours of becoming aware of such breach, to the best of our knowledge. The notice will include: (a) a description of the nature of the personal data breach; (b) the name and contact details of our point of contact; and (c) a description of the likely consequences of the personal data breach and a description of the measures taken or proposed to be taken by us to address the personal data breach, including, where appropriate, the measures taken to mitigate any possible adverse effects.
Vultr maintains personal data only for as long as required to fulfill the purposes for which it was collected, except Vultr may retain personal information as described below:
8.1. Minimum Retention Requirement: Vultr will retain your personal data, associated traffic data and processing logs for a minimum period of one year from the date of such processing, for purposes including security, compliance with legal obligations and investigation.
8.2. Legitimate Use: Personal information necessary for our legitimate uses, such as record keeping, resolution of disputes, enforcement of our agreements, protection of our rights, prevention and detection of fraud, or misuse of our Services, may be retained as long as necessary to fulfill such legitimate uses.
8.3. Legal Obligations: Personal information necessary to fulfill our legal obligations, such as taxation obligations, data retention obligations, reporting obligations, and other obligations under applicable law, court order, or law enforcement request, may be retained as long as required to comply with such legal obligations.
8.4. Marketing Emails: With respect to marketing, we retain your personal data for 18 months after your last request for service or other contact you initiate.
After the retention period, we will securely delete or anonymize your personal data, unless further retention is required by law. Prior to deleting your account or the data stored by you in your account, we will send a notice of at least 48 hours to the email address specified in your account.
The Site may contain links to third-party sites. Since Vultr does not control nor is responsible for the privacy practices of those Sites, we encourage you to review the privacy policies of these third-party sites. This Notice applies solely to personal data collected by our Sites or during our business activities.
Please contact us as indicated in Clause 12 (Grievance Redressal and Contact information) if you wish to exercise any of your rights, or if you have any inquiries or complaints regarding the processing of your personal data. Under the DPDPA, you have the following rights regarding your personal data:
We reserve the right to revise, amend, or modify this Notice and our other policies and agreements at any time and in any manner. You should periodically check for any modifications to this Notice by re-visiting this web page and using the ‘refresh’ button on your browser.
You should note the date of the last revision to this Notice, which appears at the top of this Notice. A changed ‘last modified’ date indicates that this Notice has been updated or edited, and the updated or edited version supersedes any prior versions immediately upon posting.
Should you have any inquiries regarding this notice, or should you require translation of this notice into your regional language, or if you wish to assert any of your rights, or you have any other grievance or concern related to this privacy notice, please contact:
Name: Praveen Patel
Email: india-grievance@vultr.com
You may contact the Data Protection Board of India if your grievance is not resolved by Vultr. As of the date of publication of this privacy notice, the contact details of the Data Protection Board of India are not yet available as the DPDP Act implementation is still in progress. We will update this section with the Data Protection Board of India’s contact information after the full details are available.
Data Protection Board of India contact information: [to be updated]