BizLiveGo Privacy by Design & Default Policy

Regulatory Alignment & Design Mandate

At BizLiveGo, privacy is not treated as an afterthought or a compliance checkbox. It is an engineering baseline integrated into code repositories, database schemas, and dynamic QR resolvers.

This framework satisfies Section 8 of India's Digital Personal Data Protection (DPDP) Act, Article 25 of the GDPR (Data protection by design and by default), and the international ISO/IEC 27701 standard.

The Two Operational Pillars

Our platform development is governed by dual engineering doctrines:

• Privacy by Design: Privacy risks are anticipated, engineered out, and mitigated during the conceptual phase of every feature.
• Privacy by Default: The strictest privacy settings apply automatically without requiring technical intervention by the user.

1. Proactive, Not Reactive

Our architecture anticipates systemic privacy risks and data leakage before incidents occur. We do not wait for privacy infractions to develop remediation measures.

Automated static code audits flag unencrypted inputs prior to deployment.

2. Privacy as the Default Setting

If an individual does nothing, their privacy remains completely intact. Non-essential tracking scripts, advertising pixels, and open search crawling are off by default.

No manual hardening required by non-technical publishers.

3. Privacy Embedded into Design

Privacy is an essential core component of our dynamic profile engine, responsive scaling layout, and SQL database schema, not an add-on bolted on later.

Engineered directly into template inputs, QR resolvers, and media storage.

4. Full Functionality: Positive-Sum

We reject zero-sum tradeoffs (privacy vs. functionality). Publishers enjoy beautiful, mobile-optimized live profile links with complete privacy controls intact.

High performance, real-time sync, and rigorous privacy operate in unison.

5. End-to-End Security

Data protection extends across the entire lifecycle: from input capture and encrypted transit (TLS 1.3) to encrypted resting storage (AES-256) and cryptographic destruction.

Continuous security safeguards protect records from cradle to grave.

6. Visibility and Transparency

System operations and data flows remain open and verifiable to users, business clients, and regulatory authorities. Clear, unbundled notices govern every field.

Plain language summaries without deceptive dark patterns or hidden clauses.

1. Default Opt-Out

Marketing & analytics:

• Meta Pixels disabled by default
• No commercial cross-tracking
• Zero dark-pattern pre-ticks
• Explicit opt-in required

2. Search Indexing

Crawler boundaries:

• Resumes default to unindexed
• No public meta tags on private CVs
• Robots.txt protections
• Publishers must enable SEO

3. Pseudonymization

Telemetry sanitization:

• Anonymized IP addresses
• Randomized session tokens
• Decoupled analytic events
• No cross-device fingerprinting

4. Data Minimization

Collection discipline:

• Only operational fields saved
• Optional fields purely elective
• Automated draft purge cycles
• No auxiliary scraping

1. Mandatory DPIA Protocols

Before rolling out any new profile template, location mapping API, dynamic QR routing update, or third-party integration, our Data Protection Officer conducts a formal Data Protection Impact Assessment (DPIA).

Assesses necessity, proportionality, user risk, and technical safeguards.

2. Privacy in Secure SDLC

Privacy requirements are mapped into user stories and technical sprints. Peer reviews, static analysis security testing (SAST), and automated unit tests verify that data isolation boundaries are never breached.

Zero production deployment without DPO compliance sign-off.

3. Privacy Threat Modeling

We systematically map data flows to identify points of exposure using threat modeling frameworks (such as LINDDUN: Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance).

Directly targets privacy harms rather than purely traditional security flaws.

End-to-End Data Lifecycle Management

Privacy by Design dictates that data must not outlive its legitimate purpose:

• Immediate Link Deactivation: Canceled or deleted profiles cease to resolve within hours (HTTP 404/Gone).
• Hard Purge SLA: Production database records and object storage media are wiped within 7 to 15 working days.
• Cryptographic Shredding: Encryption keys tied to user storage shards are destroyed, rendering backup fragments unrecoverable.

Frictionless Rights Execution

User interfaces are designed to eliminate administrative roadblocks:

• Self-Service Controls: Edit public information, toggle discovery flags, or export data directly from user settings.
• Unified DSR Intake: Submit Access, Rectification, Portability, and Erasure requests via our Privacy Request Center.
• Equal Ease of Withdrawal: Revoking consent requires no more effort than granting it.