How we handle your information.

We do not ask you to send passwords, access tokens, identity documents, patient or financial records, complete logs or vulnerability evidence through the general contact form. If an engagement or report requires sensitive information, we will first discuss the scope and an appropriate exchange method.

If you send information about someone else, only provide what is necessary and what you are entitled to share. If you accidentally send sensitive material, contact us so we can assess appropriate restricted handling, deletion or preservation.

We use information for the purposes described below. Where EU or UK data protection law applies to our processing, the final column explains the relevant basis. Those bases are not a statement that the same legal categories apply in every jurisdiction.

Where we rely on legitimate interests, we assess the necessity and impact on your rights. You can object as explained below. Where consent is required for a particular activity, we will request it for that activity and explain how to withdraw it. Simply visiting the website is not treated as consent to unrelated processing.

An enquiry does not subscribe you to a marketing list. We will not treat it as consent to unrelated promotional messages. Any separate marketing activity must have its own appropriate information and legal basis.

You can browse the public pages without submitting an enquiry. An email address is needed if you use the form so we have a way to respond. You can instead contact us by email or use the other contact routes shown on the website.

Providing optional context can help us understand your request, but you do not need to disclose confidential system details to start a conversation. No security engagement or confidentiality agreement is created solely by sending an enquiry.

Our website and infrastructure process technical information needed to deliver pages, handle requests and protect against misuse. This can include security logs and network-error information. We do not use advertising pixels, cross-site behavioural tracking or optional visitor analytics.

The website does not set cookies for its own functions or for measurement. The only browser storage it uses is a high-score value for the optional game on our page-not-found screen, which stays in your browser and is not sent to us.

We use providers to deliver the website, process enquiries and operate communications. Relevant recipients include:

• Cloudflare, for delivery of website traffic and related operational and security information.
• Hostinger, which hosts the website and its enquiry form, and provides the email service that transmits and stores correspondence.
• WhatsApp and its service providers, when you choose to contact us through WhatsApp.
• Authorised personnel, where their involvement is necessary for the particular enquiry, security concern or business matter.
• Professional advisers, public authorities or other parties, where disclosure is necessary for a legal obligation, appropriate advice, protection of rights or handling a claim.

We limit sharing to the purpose involved. A provider may process information on our behalf or, for some activities, under its own responsibilities. We do not sell personal information.

You can ask us for relevant information about recipients involved in handling your information. We may limit a response where disclosure would expose security-sensitive information, another person's rights or information protected by law.

Our business is operated from India. Our website and its enquiry form run on a server provided by Hostinger in Jakarta, Indonesia, and website traffic passes through Cloudflare's global network, which may handle it in locations near you. Email is handled through Hostinger's email service.

Information may therefore be processed in countries other than your own. Where the law that applies to you requires particular safeguards for that processing, you can ask us about them at [email protected].

We keep personal information for the purpose for which it is needed, taking account of the following criteria:

• Enquiries and correspondence: whether the discussion remains active, the time since the last meaningful contact, follow-up requested by you and any need to retain a limited record of the enquiry.
• Engagement administration: contractual administration, applicable accounting or recordkeeping duties and the period reasonably needed to establish or defend claims. Engagement evidence has its own retention terms.
• Security reports: investigation, remediation validation, coordination, prevention of recurrence and any required legal preservation. Evidence that is unnecessary for those purposes should not be retained merely because it was supplied.
• Operational logs: troubleshooting, misuse prevention, incident investigation and any retention period required by applicable law.
• Rights and complaint records: enough information to handle the request and demonstrate its outcome, without retaining unnecessary identity evidence.

When the applicable purpose and retention requirement end, we delete the information or anonymise it appropriately. Information subject to a lawful preservation requirement is restricted to that purpose. Copies in backups are managed through the applicable backup lifecycle and are not restored into ordinary use without reapplying relevant deletion restrictions.

We apply technical and organisational measures appropriate to the information and risks involved. No website, communication channel or storage system can be guaranteed completely secure.

If a security incident affects information for which we are responsible, we assess the impact and make notifications required by applicable law or a relevant agreement. Reporting duties can have different triggers and deadlines; we do not treat a standard enquiry response time as the incident reporting period.

Email [email protected] with the subject Privacy request to ask about your information or raise a complaint. Describe the request and the information or interaction it concerns. We may need proportionate information to confirm your identity or authority; do not send an identity document unless we explain why it is necessary and how to provide it appropriately.

Depending on applicable law and the processing involved, your rights may include access, correction, deletion, restriction, portability, withdrawal of consent and objection. Some rights have conditions or exceptions. Withdrawal does not undo processing that was lawful before withdrawal. We will explain any lawful reason why a request cannot be fulfilled in full.

Your right to object: where EU or UK law applies and we rely on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing at any time where that processing occurs; information will no longer be used for that marketing purpose.

We handle requests within the period required by the law that applies. Where the EU or UK GDPR's standard access-request period applies, this is ordinarily one month, subject to lawful extensions and relevant rules about identification or clarification. Where rule 5(9) of India's 2011 SPDI Rules applies to a grievance, it requires redress within one month of receipt.

Where the UK data protection complaint requirements apply, we acknowledge a complaint within 30 days of receipt, investigate it appropriately, keep you informed and communicate the outcome without undue delay. This complaint process is separate from any deadline for a request to exercise a data protection right.

You may also complain to a competent data protection authority where the law gives you that right. For UK matters this may include the Information Commissioner's Office; in the EEA, the relevant national supervisory authority. You do not have to give up a legal complaint route by contacting us first where the law does not require it.

If your information is part of a client environment that we handle on that client's instructions, the client may be responsible for responding to your request. We will direct or assist with the request as appropriate under the applicable arrangement and law. Our own legal duties continue to apply.

This website is intended for business enquiries and is not directed at children. We do not ask children to provide information. If you believe a child has supplied personal information, contact us so we can assess appropriate action. Please do not send a child's identifying records through the public form.

External websites and communication platforms have their own practices. Following an external link or contacting us through WhatsApp may involve processing by that provider. Its notice applies to its own activities; this does not remove our responsibilities for the information we receive.

We update this notice when the relevant processing, contact details or legal requirements change. The date above identifies the published version. Where a change requires a separate notice, permission or other action, posting an updated page alone will not replace that requirement.