Privacy Policy

1. Regulatory Framework & Corporate Status

BHISHMASEC CYBERSECURITY SOLUTIONS (OPC) PRIVATE LIMITED ("BhishmaSec", "Company", "we", "us", or "our") is a corporate cybersecurity architecture and offensive testing practice incorporated under the Indian Companies Act, 2013. This Privacy Policy sets out the principles and legal bases under which we collect, process, manage, and safeguard Personal Data in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") of India;
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation / "GDPR") where applicable to international engagements.

2. Data Fiduciary vs. Data Processor Classification

In the execution of our corporate operations, BhishmaSec acts in dual statutory capacities:

• As a Data Fiduciary / Controller: In respect of business contact details, inquiry scoping forms, procurement correspondence, and billing records provided directly by prospective or contracted enterprise clients.
• As a Data Processor: In respect of any client application data, database records, source code, or network logs accessed strictly transiently and incidentally during the execution of contracted security architecture, DevSecOps pipelines, or offensive penetration tests.

3. Categories of Data Collected

We practice rigorous data minimization. We do not collect consumer behavioral dossiers or deploy invasive third-party ad trackers. We collect only:

• Inquiry & Scoping Records: Full name, corporate email address, employer entity name, designation, high-level technological architecture specifications, and budget ranges.
• Technical Security Telemetry: Target IP ranges, domain names, API schemas, and security vulnerability findings generated solely under contracted Statements of Work (SoWs).
• Essential Local Preferences: Consent status stored locally within browser localStorage (e.g. cookie preference tokens).
• B2B Prospect Outreach Data: As part of our legitimate business development activity, BhishmaSec sources professional contact details of senior technology and security decision-makers at recently-founded companies (name, corporate email address, job title, company domain) from B2B intelligence platforms (Apollo.io). This data is used solely for personalised security awareness outreach and is never sold or used for consumer marketing. Recipients may opt out at any time by replying to any outreach communication.
• Passive Security Research Data: BhishmaSec conducts non-invasive, publicly-available passive security scans (Certificate Transparency logs, DNS records, public HTTP headers) on prospect company domains as part of generating personalised outreach context. No systems are accessed or credentials tested. All findings are handled under strict confidentiality.
• Meeting Scheduling Data: When a prospect or client books a discovery call via our scheduling page (powered by Cal.com, Inc., USA), we collect the booker's name and business email address for the purpose of conducting the meeting and recording the interaction in our CRM (Clarify). Cal.com acts as a sub-processor for this purpose. See our Sub-Processors Registry and Cal.com Privacy Policy for details.

4. Lawful Grounds for Processing

We process personal data solely on established lawful grounds:

• Consent & Voluntary Provision: Where an authorized representative submits an inquiry form seeking scoping advisory (DPDP Act Section 6; GDPR Article 6(1)(a)).
• Contractual Performance: Processing necessary for the execution of Master Services Agreements (MSAs), Statements of Work (SoWs), and bilateral NDAs (GDPR Article 6(1)(b)).
• Legitimate Interests: B2B outreach to senior security and technology decision-makers at companies that may benefit from our services (GDPR Article 6(1)(f); DPDP Act Section 4). We conduct a legitimate interest assessment prior to any outreach campaign, and all recipients retain the right to object.
• Statutory & Legal Compliance: Compliance with mandatory tax laws, accounting standards, and statutory cybersecurity reporting obligations issued by the Indian Computer Emergency Response Team (CERT-In).

5. Technical Safeguards & Cryptographic Protocols

Pursuant to Section 8 of the DPDP Act and Article 32 of GDPR, BhishmaSec enforces institutional technical safeguards:

• In-Transit & At-Rest Encryption: All electronic communication is encrypted via TLS 1.3; all client reports and audit artifacts are encrypted using AES-256 GCM.
• Isolated Testing Enclaves: Security assessments are executed from hardened, access-restricted ephemeral VPCs with multi-factor authentication (FIDO2/WebAuthn).
• Cryptographic Data Sanitization: Upon conclusion of the contracted re-test window (30 days), all client proof-of-concept payloads and temporary test credentials are cryptographically purged (NIST SP 800-88 Rev. 1 Guidelines for Media Sanitization).

6. Rights of Data Principals & Data Subjects

Under applicable data protection legislation, you are entitled to exercise the following statutory rights:

• Right to Confirmation & Access: Request a summary of personal data being processed by the Company.
• Right to Correction & Erasure: Request the correction of misleading or outdated data, or the deletion of data no longer required for statutory or contractual purposes.
• Right of Grievance Redressal: Submit inquiries or grievances to our nominated Data Protection Officer.
• Right to Nominate: (Under DPDP Act) Nominate an individual to exercise rights in the event of death or incapacity.

7. Data Protection Officer & Grievance Redressal

In accordance with the DPDP Act 2023, inquiries or complaints regarding the processing of your personal data should be addressed to our Data Protection Officer:

Data Protection Officer: Legal & Compliance Practice
Corporate Entity: BHISHMASEC CYBERSECURITY SOLUTIONS (OPC) PRIVATE LIMITED
Email: [email protected]
Jurisdiction: Tamil Nadu, India