1. Who we are
This website, hexasecurelabs.com, is operated by [Legal entity name, e.g. Hexa Secure Labs Private Limited], registered at [Registered office address], India ("Hexa Secure Labs", "we", "us").
For the personal data described in this policy, we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and the "controller" under the EU and UK General Data Protection Regulation where it applies.
Questions about this policy can be sent to hello@hexasecurelabs.com.
2. Information we collect
Information you give us
- Contact form: your name, work email, phone number (optional), the service you are interested in and the project details you write.
- Email and phone: anything you choose to share when you write to or call us.
Information collected automatically
- Server logs: our hosting provider records standard request data such as IP address, browser type, pages requested and the time of the request. This is used to keep the site running and secure.
- Fonts: the site loads fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address. See Google's privacy policy.
Client engagement data
When we deliver services, such as penetration testing or software development, we may access client systems and the data inside them. That access is governed by our written contract, statement of work and NDA with the client, not by this policy.
3. Cookies and tracking
This website does not set cookies and does not use analytics, advertising or tracking tools. If that changes, we will update this policy and ask for your consent where the law requires it.
4. How we use your information
- To reply to your enquiry and discuss your project.
- To prepare proposals and deliver the services you engage us for.
- To keep this website secure and prevent misuse.
- To meet our legal, tax and accounting obligations.
We do not sell your personal data. We do not send you marketing emails unless you have agreed to receive them, and you can unsubscribe at any time.
Legal basis
Under the DPDP Act, we process the data you submit on the basis of your consent, which you give when you send the form or contact us, and for legitimate uses permitted by Section 7 of the Act. For visitors covered by the GDPR, our legal bases are taking steps at your request before entering into a contract, our legitimate interest in responding to business enquiries, and compliance with legal obligations.
5. Who we share it with
We share personal data only as needed with:
- Service providers who help us run this website and our business, such as our hosting provider, email provider and contact-form processing service. They may use the data only to provide their service to us.
- Authorities when required by law, court order or a valid government request.
- A successor business if we are involved in a merger, acquisition or sale of assets, subject to this policy.
6. International transfers
Some of our service providers may store or process data outside India. Where they do, we rely on transfers permitted under the DPDP Act and, for GDPR-covered data, on appropriate safeguards such as standard contractual clauses.
7. How long we keep it
We keep enquiry data for up to 24 months after our last contact with you, unless you become a client. Client records are kept for as long as the engagement lasts and afterwards for the period required by Indian tax and company law. When data is no longer needed, we delete or anonymise it.
8. How we protect it
Security is our business, and we apply the same standards to our own systems. Measures include encrypted connections (HTTPS), access restricted to staff who need it, multi-factor authentication on business accounts and regular review of our service providers. No system is completely secure, but we will notify you and the relevant authorities of a personal data breach where the law requires it.
9. Your rights
Under the DPDP Act you have the right to:
- Get a summary of the personal data we hold about you and how we use it.
- Ask us to correct, complete, update or erase your personal data.
- Withdraw your consent at any time. This does not affect processing that already took place.
- Have your grievance addressed by us, and if you are not satisfied, complain to the Data Protection Board of India.
- Nominate another person to exercise your rights in the event of death or incapacity.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your local data protection authority.
To use any of these rights, email hello@hexasecurelabs.com. We may need to verify your identity before acting on your request.
10. Children
This website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us information, contact us and we will delete it.
11. Grievance officer
If you have a concern about how we handle your personal data, contact our Grievance Officer:
Name: [Grievance Officer name]
Email: hello@hexasecurelabs.com
Address: [Registered office address]
We aim to respond to grievances within 30 days.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with its effective date. If a change significantly affects how we use your data, we will tell you before it takes effect where we can.