Privacy Policy

1. Who We Are

This Privacy Policy applies to Bharat Security ("BharatSec", "we", "us", "our"), a cybersecurity services company based at NH114A, Ranchi, Jharkhand, India. We operate the website at bharatsec.com and subdomains including academy.bharatsec.com.

For questions about this policy, contact us at support@bharatsec.com.

2. Information We Collect

We collect information in the following ways depending on how you interact with us:

2.1 Free Security Scanner (/scan)

When you use our free website security scanner, we collect: your name, business email address, phone number, company name, job role, and the website URL you submit for scanning. We also record your IP address for rate-limiting and abuse prevention. We require a business email address — free email providers (Gmail, Yahoo, etc.) are not accepted.

2.2 Contact Form

When you submit our contact form, we collect your name, email address, company name, phone number, and message content. This is processed by Web3Forms on our behalf.

2.3 Free Cyber Awareness Initiative Form

When you request a free awareness session for your institution, we collect the point-of-contact's name, designation, email, phone, institution name, and address. This is used solely to schedule and deliver the session.

2.4 Quote Requests

When you submit a pentest quote request from our results page, we collect your email address, intended scope, budget range, timeline, and any additional notes.

2.5 Automatically Collected Data

We use Google Analytics (GA4) to understand how visitors use our site. This collects anonymised data about page views, session duration, and general location (country/region level). We do not use advertising cookies.

3. How We Use Your Information

• Security scanner: to run the scan, deliver the report to your email, store results in our database, and follow up with you about our security services where you have consented.
• Contact and quote forms: to respond to your enquiry and provide the services you've requested.
• Initiative requests: to schedule and deliver the free cybersecurity awareness session at your institution.
• Internal records: to maintain a record of our engagements and service delivery.
• Security and fraud prevention: IP addresses are used to enforce rate limits and detect abuse.
• Analytics: to understand site performance and improve the user experience.

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

4. Our Legal Basis

Under India's Digital Personal Data Protection Act 2023 (DPDPA) and applicable privacy principles:

• Consent: When you submit the security scanner form, you explicitly consent to us processing your data to deliver the scan report and follow up about our services. You may withdraw this consent at any time by contacting us.
• Legitimate interests: We process IP addresses for security, rate-limiting, and abuse prevention — this is a legitimate operational necessity.
• Contract performance: When you engage our services, we process your data as necessary to fulfil that contract.

5. Data Processors & Third Parties

We use the following third-party services to operate our website. Each acts as a data processor under our instructions:

All third-party processors are bound by their own privacy policies and, where applicable, data processing agreements. Data stored on US-based services is transferred under applicable cross-border data transfer mechanisms.

6. Data Retention

• Scanner leads and results: retained for 12 months, after which they are deleted.
• One-time scan tokens: automatically expire and are unusable after 10 minutes.
• PDF scan reports: stored in Vercel Blob for 12 months.
• Contact form submissions: retained for 6 months.
• Initiative requests: retained for the duration of the engagement plus 3 months.

To request deletion of your data before these periods expire, contact us at support@bharatsec.com.

7. Your Rights

Under the DPDPA 2023 and applicable privacy law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Withdraw consent (for scanner data processed on the basis of your consent)
• Lodge a complaint with the relevant data protection authority

To exercise any of these rights, email support@bharatsec.com. We will respond within 30 days.

8. Security

We take data security seriously — it is, after all, our business. We use the following measures to protect your data:

• All data is transmitted over HTTPS
• Scan tokens are single-use with a 10-minute expiry
• IP-based rate limiting on all form submissions
• Input sanitisation and parameterised database queries to prevent injection attacks
• Access to our database and storage systems is restricted to authorised personnel only

No system is completely impenetrable. If you believe there has been a security incident involving your data, contact us immediately at support@bharatsec.com.

9. Cookies & Analytics

We use Google Analytics (GA4), which places cookies in your browser to collect anonymised usage data. We do not use advertising cookies or tracking pixels for retargeting purposes. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

10. Contact & Updates

If you have questions about this policy, contact us at:

Bharat Security (BharatSec)
NH114A, Ranchi, Jharkhand, India
support@bharatsec.com
+91 790-386-7080

We may update this policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.