Privacy Policy

Spy Eye Intelligence Network LLP (SPIN) is a cyber-intelligence and forensic-services platform that connects individuals and organisations seeking cyber-investigation or forensic assistance with suitable independent cyber investigators and forensic specialists.

SPIN also provides an organisational framework around engagements, including case onboarding, expertise-based allocation, case monitoring, coordination, quality assurance and escalation.

Because of the nature of cyber-investigation and digital-forensic services, information handled by SPIN may sometimes be highly confidential, case-sensitive or evidentiary in nature.

This Privacy Policy applies to personal data processed by SPIN in connection with its website and services.

It may apply to information relating to:

• Website visitors.
• Persons submitting enquiries.
• Prospective customers.
• Customers.
• Persons affected by or involved in an investigation.
• Representatives of organisations.
• Advocates and other professional representatives.
• Legal heirs, executors, administrators or authorised representatives.
• Persons whose information forms part of digital evidence.
• Independent investigators and forensic specialists.
• Professional contacts.
• Other persons whose personal data is legitimately processed in connection with SPIN's activities.

Engagement-specific privacy, confidentiality or evidence-handling requirements may apply in addition to this Policy.

The information collected will depend on how you interact with SPIN and the nature of the matter.

A. Identity and Contact Information

This may include:

• Name.
• Email address.
• Mobile number.
• City, State and Country.
• Organisation name.
• Professional or organisational role.
• Relationship to the affected person.
• Other contact information.

B. Information Provided When Requesting Assistance

When you contact SPIN about a cyber, forensic or digital matter, we may collect information such as:

• The nature of your concern.
• Your description of what happened.
• When the incident occurred or was discovered.
• Whether the matter is ongoing.
• Accounts, devices or platforms involved.
• Whether financial loss is involved.
• Whether identity theft or impersonation is suspected.
• Whether threats, harassment or other harmful activity is involved.
• Whether cryptocurrency or other digital assets are involved.
• Whether the matter relates to a business or organisation.
• Whether digital evidence may be required for legal proceedings.
• Whether the matter relates to a deceased person's digital estate.
• Information concerning what assistance you are seeking.

C. Digital Evidence and Case Information

Where relevant to an accepted matter, SPIN or an assigned specialist may receive or examine digital information such as:

• Emails.
• Messages and chats.
• Screenshots.
• Social-media profiles and URLs.
• Files and documents.
• Photographs.
• Video or audio material.
• Device information.
• System or application records.
• Account records.
• Authentication or login information.
• Transaction records.
• Payment identifiers.
• Wallet addresses.
• Blockchain transaction information.
• Metadata.
• Logs.
• Digital timelines.
• Technical identifiers.
• Forensic images or extracted data.
• Other electronic material relevant to the engagement.

The categories actually processed will depend upon the agreed scope of the service.

Some SPIN engagements may involve information of a particularly private or sensitive nature, for example:

• Intimate or sexual content.
• Sextortion-related material.
• Cyber-grooming matters.
• Threats or harassment.
• Identity documents.
• Financial records.
• Confidential business information.
• Legally privileged or litigation-sensitive information.
• Information relating to children.
• Digital estate or succession information.
• Evidence relating to an alleged offence.

Where appropriate, SPIN may apply additional controls such as:

• Restricted investigator access.
• Need-to-know access.
• Minimum-necessary disclosure.
• Minimal duplication.
• Controlled transfer.
• Secure evidence-handling procedures.
• Additional confidentiality or safeguarding measures.

A cyber investigation or forensic engagement may necessarily involve information relating to persons other than the customer.

For example, case information may contain:

• Communications with another person.
• Information relating to suspected fraudsters or attackers.
• Employee information.
• Customer or supplier information.
• Family-member information.
• Beneficiary or heir information.
• Public social-media information.
• Account information.
• Witness information.
• Information appearing within digital evidence.

Where you provide personal data relating to another person, you should have an appropriate lawful basis, authority or legitimate reason for providing that information to SPIN.

SPIN may request evidence of authority where appropriate.

SPIN may obtain personal data:

• Directly from you.
• From your authorised representative.
• From an organisation engaging SPIN.
• Through our website or contact forms.
• Through communications with SPIN.
• From devices, files or records lawfully provided for examination.
• Through an assigned independent investigator or forensic specialist.
• From publicly accessible sources.
• Through lawful open-source intelligence activities.
• From authorised intelligence or monitoring sources.
• From platforms, institutions or service providers where lawfully available.
• From legal representatives.
• From competent authorities where appropriate.
• From other lawful sources relevant to the engagement.

SPIN does not obtain personal data through unauthorised access to accounts, devices or systems.

SPIN may process personal data for purposes including:

• Responding to Enquiries: To receive, assess and respond to requests for assistance or general enquiries.
• Understanding a Case: To understand what may have happened, what information or evidence exists and what type of assistance may be appropriate.
• Establishing Authority: To verify identity, ownership, representation or lawful authority where required.
• Case Allocation: To identify and allocate an investigator or forensic specialist with appropriate expertise.
• Delivering Services: To perform or facilitate assessments, investigations, recovery assistance, forensic examinations, monitoring and other agreed services.
• Digital Evidence Handling: To identify, preserve, examine, document and report relevant digital evidence.
• Case Management: To coordinate, monitor and administer engagements.
• Quality Assurance: To review relevant investigation or forensic outputs for quality and service- assurance purposes.
• Communication: To communicate with customers, representatives, investigators and other persons involved in an engagement.
• Reporting and Escalation: To assist, where applicable, with appropriate reporting to platforms, banks, legal representatives, law-enforcement agencies or other competent institutions.
• Security and Fraud Prevention: To protect SPIN, its customers, specialists, systems and services against misuse, fraud, abuse or security threats.
• Legal and Regulatory Requirements: To comply with applicable laws, lawful orders and regulatory or statutory obligations.
• Grievance Redressal: To receive, investigate and respond to complaints or grievances.

SPIN processes personal data only where there is an appropriate basis for doing so under applicable law.

Depending on the circumstances, processing may occur:

• With the individual's consent.
• Where processing is necessary in connection with a service requested by the individual.
• Where the individual voluntarily provides information for a specified purpose.
• Where processing is necessary for a lawful purpose connected with an investigation or forensic engagement.
• Where SPIN is required or authorised to process information under applicable law.
• Where information is lawfully made available or accessible for the relevant purpose.
• On another basis permitted under applicable data-protection law.

Where consent is specifically required, SPIN will seek consent in an appropriate manner.

SPIN seeks to process personal data that is reasonably necessary for the relevant purpose.

Because investigations can contain large amounts of digital information, SPIN will, where reasonably practicable:

• Define the scope of information required.
• Limit access to relevant case information.
• Avoid unnecessary duplication of sensitive material.
• Restrict examination to information relevant to the agreed purpose.
• Avoid collecting information that is clearly unnecessary for the engagement.

Customers are also requested not to submit passwords, OTPs, private keys, seed phrases or unnecessary sensitive evidence through general website forms.

Where particular evidence is required, SPIN may identify an appropriate method of providing it.

SPIN operates through a network of independent cyber investigators and forensic specialists.

Where a specialist is assigned to a matter, SPIN may provide that specialist with personal data and case information reasonably necessary to perform the agreed work.

Access is intended to be based upon:

• The specialist's assignment to the matter.
• The agreed scope.
• Professional need.
• Confidentiality requirements.
• Applicable data-protection and evidence-handling expectations.

Assigned specialists are expected to comply with applicable confidentiality, professional, evidence- handling and data-protection requirements.

SPIN does not make all customer or case information available to its entire investigator network.

Depending on the circumstances, personal data may be disclosed to:

• An assigned cyber investigator or forensic specialist.
• Persons within SPIN who require access for case management, quality assurance or administration.
• Authorised technical or service providers processing personal data on behalf of SPIN in support of its operations or service delivery.
• Advocates or other professional advisers; where required for a lawful purpose relating to legal or professional advice, representation or support, and where such disclosure is authorised, contractually agreed or otherwise permitted by applicable law.
• Banks or payment providers; where required for reporting, investigation, containment or recovery in relation to your matter, including where such assistance has been requested or authorised by you.
• Online platforms or service providers; where reporting, account recovery, takedown or other authorised assistance is requested.
• Law-enforcement agencies or competent authorities; where requested, authorised, legally required or otherwise lawfully appropriate.
• Courts, tribunals or other legal bodies; where legally required.
• Auditors, insurers or professional advisers; where reasonably necessary for a lawful purpose relating to audit, insurance, risk management or professional advisory services, and where such disclosure is authorised, contractually agreed or otherwise permitted by applicable law.
• Another person where you have authorised the disclosure.

SPIN seeks to limit disclosure to information reasonably necessary for the relevant purpose.

Information may be disclosed where SPIN is required to do so under:

• Applicable law.
• A court order.
• A lawful request from a competent authority.
• A statutory reporting requirement.
• Another legally binding process.

Where legally permissible and appropriate, SPIN may also support a customer's authorised engagement with law-enforcement agencies, courts, tribunals, platforms or other institutions by providing relevant technical information or evidence.

SPIN services are not intended to enable children to independently commission investigative or forensic engagements where parental, guardian or other lawful authority is required.

Where a matter involves a child, SPIN may process information concerning the child where necessary and lawfully appropriate.

Such matters may be subject to additional:

• Safeguarding requirements.
• Access restrictions.
• Parental or guardian authority requirements.
• Evidence-handling controls.
• Statutory reporting requirements.

Where applicable safeguarding or statutory reporting obligations arise, those requirements may take precedence over ordinary investigation procedures.

Where a customer uses an ongoing monitoring service, SPIN may process agreed identifiers such as:

• Email addresses.
• Usernames.
• Phone numbers.
• Selected identity references.
• Professional or brand references.
• Credential-exposure indicators.
• Other digital identifiers specifically agreed within the monitoring scope.

Such identifiers may be compared against or monitored across lawfully accessible sources relevant to the service.

Monitoring will be limited by the agreed scope, available sources and lawful technical capabilities.

SPIN does not require customers to provide active account passwords merely for ordinary monitoring purposes.

Certain SPIN services involve reviewing publicly available information, open-source intelligence, breach-intelligence sources or appropriately accessible deep-web or dark-web intelligence sources.

SPIN intends to use only lawful access methods and appropriately authorised or accessible sources.

Monitoring or investigation of such information does not mean that SPIN participates in unlawful forums, transactions or unauthorised access.

Where information forms part of digital evidence, ordinary deletion or modification practices may not always be appropriate during an active investigation.

Evidence may need to be preserved:

• In its original form.
• Through forensic imaging or extraction.
• With relevant metadata.
• With integrity verification.
• With chain-of-custody records.
• Together with associated documentation.

The handling of evidentiary material may therefore differ from ordinary business records.

Detailed requirements shall be addressed through other relevant policies of SPIN.

SPIN intends to retain personal data only for as long as reasonably necessary for the purpose for which it was processed, subject to applicable legal, evidentiary, contractual and operational requirements.

Different retention periods may apply to:

• General enquiries.
• Unsuccessful or unaccepted service requests.
• Customer records.
• Engagement records.
• Digital evidence.
• Forensic images.
• Investigation files.
• Reports and deliverables.
• Financial and accounting records.
• Monitoring records.
• Grievance records.
• Information required to establish or defend legal claims.

Information constituting evidence or forming part of a legal, regulatory or investigative matter may need to be retained for a longer period.

Detailed requirements governing the retention, review, deletion and secure disposal of personal data and case information are set out in relevant policies of SPIN on data retention and secure disposal.

When information is no longer required and there is no lawful, contractual, evidentiary or operational reason to retain it, SPIN may delete, destroy, anonymise or otherwise securely dispose of the information, as appropriate.

Methods of disposal may vary depending on:

• The nature of the information.
• The storage medium.
• Whether forensic integrity must be maintained.
• Legal requirements.
• Technical feasibility.

SPIN seeks to implement reasonable technical and organisational measures appropriate to the nature of the information being processed.

Depending on the circumstances, these may include:

• Access controls.
• Restricted case access.
• Authentication controls.
• Controlled evidence transfer.
• Secure storage arrangements.
• Confidentiality requirements.
• Logging or traceability controls.
• Need-to-know access.
• Backup and recovery controls.
• Integrity-verification measures.
• Appropriate organisational procedures.

SPIN will seek to implement reasonable security safeguards and appropriate technical and organisational measures in accordance with applicable data-protection requirements, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as and when the relevant provisions become legally applicable.

However, transmission, storage and processing of data through electronic networks and systems inherently involve security risks. No technical or organisational security measure can provide absolute protection against every possible security incident.

Accordingly, even where SPIN has implemented applicable reasonable security safeguards, SPIN cannot guarantee absolute immunity from events including zero-day vulnerabilities or exploits, advanced persistent threats (APTs), state-sponsored or highly sophisticated cyber intrusions, distributed denial-of-service (DDoS) attacks, malicious software outbreaks, hardware or infrastructure failures, or other adversarial attacks capable of circumventing or defeating reasonable security safeguards.

The existence of such inherent technical risks does not reduce SPIN's obligation to implement security safeguards required under applicable law.

Where SPIN becomes aware of a personal-data breach affecting information under its control, it will take appropriate measures in accordance with applicable law, which may include assessing the breach, undertaking containment and forensic or technical investigation, mitigating potential harm, preserving relevant information or logs, undertaking appropriate remedial measures and taking reasonable steps intended to prevent recurrence.

Where applicable law requires notification, SPIN will notify affected Data Principals, the Data Protection Board of India or another competent authority in the form, manner and timeframe prescribed under the applicable legal requirements.

Such notifications may include information regarding the nature and extent of the breach, its possible consequences, measures taken or proposed in response to the breach, recommendations or protective measures for affected Data Principals and applicable contact information, to the extent required by law.

SPIN's obligations in relation to a personal-data breach will be determined by the applicable provisions of the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 and any other applicable law, rule, direction or legally binding requirement.

Compliance by SPIN with applicable breach-containment, mitigation, remediation and notification obligations does not limit any statutory right or remedy that cannot lawfully be excluded or restricted.

To the extent permitted by applicable law, SPIN, its Designated Partners, employees and empanelled investigators or forensic specialists will not be liable for unauthorised access, alteration, loss, unavailability or compromise of information to the extent directly caused by events beyond their reasonable operational control and notwithstanding the implementation of applicable reasonable security safeguards.

Such events may include regional or widespread telecommunications or internet disruptions, failures of critical third-party infrastructure, cyber warfare, state-sponsored sabotage or intrusion, unusually severe or widespread malware outbreaks, natural disasters, acts of God, or other comparable events that could not reasonably have been prevented or mitigated through the security safeguards required under applicable law.

Nothing in this section excludes or limits any responsibility or liability that cannot lawfully be excluded or limited.

By transmitting files, digital evidence, personal data or other information to SPIN, or by commissioning or using SPIN's services, you acknowledge that electronic transmission, storage and processing involve inherent technical and cybersecurity risks that cannot be completely eliminated.

Where SPIN has implemented the reasonable security safeguards required under applicable law, then, to the extent permitted by applicable law, SPIN will not be liable for indirect, incidental, consequential, special or punitive loss or damage arising solely from a third-party cyberattack or other external malicious act that circumvents such safeguards and is beyond SPIN's reasonable operational control.

This acknowledgement of inherent risk does not waive, restrict or exclude any statutory right, obligation or liability that cannot lawfully be waived, restricted or excluded.

SPIN may serve customers or work with specialists, service providers or institutions located in different jurisdictions.

Accordingly, personal data may, where necessary and legally permitted, be accessed or processed outside the location in which it was originally collected.

Where cross-border processing occurs, SPIN will seek to comply with applicable requirements governing such transfers or access.

Where applicable law restricts the transfer of particular personal data to specified jurisdictions, SPIN will apply those restrictions.

Depending upon applicable law and the circumstances, you may have rights relating to your personal data.

These may include rights to:

• Obtain information concerning the processing of your personal data.
• Seek access to or a summary of relevant personal data.
• Request correction, completion or updating of inaccurate or incomplete personal data.
• Request erasure where legally applicable.
• Withdraw consent where processing is based on consent, subject to applicable consequences.
• Nominate another individual to exercise applicable rights in specified circumstances.
• Raise a grievance regarding the processing of your personal data.

These rights may be subject to lawful limitations.

For example, SPIN may not be able to delete information immediately where retention is necessary for:

• An ongoing investigation.
• Preservation of digital evidence.
• Legal proceedings.
• Establishment or defence of legal claims.
• Compliance with statutory obligations.
• Another lawful purpose.

Where personal data is processed on the basis of consent, you may request withdrawal of that consent in accordance with applicable law.

Withdrawal will not ordinarily affect processing already lawfully undertaken before the withdrawal.

Depending on the service, withdrawal may also mean that SPIN cannot continue providing some or all of the requested assistance.

Where information must continue to be retained or processed for another lawful reason, withdrawal of consent will not require SPIN to act contrary to that lawful requirement.

You should provide information that is accurate and complete to the best of your knowledge.

Where information materially changes during an engagement, you should inform SPIN where the change is relevant to the service.

SPIN may request clarification or additional documentation where reasonably necessary to verify information or authority.

When you use the SPIN website, certain technical information may be processed automatically, such as:

• IP address.
• Browser or device information.
• Date and time of access.
• Pages visited.
• Security logs.
• Basic usage information.
• Cookie or similar technology information, where applicable.

Such information may be used for:

• Website functionality.
• Cybersecurity.
• Fraud and abuse prevention.
• Performance monitoring.
• Troubleshooting.
• Improving the website.

Use of cookies and similar technologies, where applicable, will be addressed separately through relevant policies of SPIN.

SPIN does not sell personal data as a business activity.

Personal data may be shared only where reasonably necessary for SPIN's services, operations, legal obligations or other purposes described in this Privacy Policy.

SPIN's website or services may contain links to or involve interaction with third-party websites, platforms, banks, exchanges or other service providers.

Their privacy practices are governed by their own policies.

SPIN is not responsible for the privacy practices of independent third-party platforms merely because a link, reporting process or recovery procedure involves those platforms.

Privacy and confidentiality are related but distinct.

This Privacy Policy primarily explains how SPIN processes personal data.

Additional obligations regarding:

• Customer confidentiality.
• Privileged or confidential case information.
• Sensitive evidence.
• Investigator confidentiality.
• Disclosure controls.

may be addressed through Terms of Service of SPIN and engagement-specific documentation.

If you have a concern about how SPIN has processed your personal data, you may raise it with SPIN through its designated grievance mechanism.

Grievance Officer: Mr. Gaurav Banerjee

Grievance Officer Designation: Director – Operations and Compliance

Grievance Officer Email: contact@spyeye.org

Please provide sufficient information to enable SPIN to understand and appropriately examine the grievance.

SPIN's broader complaint-handling process will be described in its Grievance Redressal Mechanism.

Where applicable law provides a further statutory remedy or right to approach the Data Protection Board of India or another competent authority, those rights remain unaffected.

Requests relating to access, correction, updating, erasure, withdrawal of consent or other applicable privacy rights may be submitted to:

Data Protection Officer: Mr. Gaurav Banerjee

Data Protection Officer Designation: Director – Operations and Compliance

Data Protection Officer Email: contact@spyeye.org

SPIN may need to verify your identity before acting on a request.

Where the request concerns information relating to another person, SPIN may also require proof of authority.

SPIN may update this Privacy Policy from time to time to reflect:

• Changes in law or regulation.
• Changes in SPIN's services.
• New technologies or processing activities.
• Changes in operational practices.
• Improvements to privacy and security controls.

The updated Privacy Policy will be published on the SPIN website together with the revised Last Updated date.

Where required by applicable law, additional notice or consent may be sought for material changes.

SPIN intends to process personal data in accordance with applicable data-protection and privacy requirements.

This includes, where and to the extent applicable, requirements under the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable laws, rules, directions and legal obligations.

Where provisions of applicable data-protection law come into force on different dates, SPIN will apply the requirements relevant to the processing activity from the date on which they become legally applicable.

For questions about this Privacy Policy or SPIN's handling of personal data:

Spy Eye Intelligence Network LLP (SPIN)

Registered Office: Rajahmundry, Andhra Pradesh, India.

Email: contact@spyeye.org

Phone: +91 877 762 8651

Privacy Contact:

Data Protection Officer: Mr. Gaurav Banerjee

Data Protection Officer Designation: Director – Operations and Compliance

Data Protection Officer Email: contact@spyeye.org

Grievance Contact:

Grievance Officer: Mr. Gaurav Banerjee

Grievance Officer Designation: Director – Operations and Compliance

Grievance Officer Email: contact@spyeye.org