Privacy Policy

CyberKartel
Effective date: 14 July 2026
Last updated: 14 July 2026
Contact: [email protected]

This Privacy Policy explains how CyberKartel ("we", "us", "our") collects, uses, stores, and protects personal information when you use our website, contact forms, newsletter, or engage our cybersecurity services. We process personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act), and good industry practice.

1. Who we are

CyberKartel is a practitioner-led cybersecurity firm offering services such as firmware analysis, hardware penetration testing, IoT security audits, infrastructure and network security, red team assessments, web security testing, secure code review, product security, forensics, and security consulting. Our public contact address for privacy matters is [email protected].

2. Scope

This policy applies to:

Visitors to our website
Users who submit the contact / enquiry form
Users who subscribe to our research newsletter
Prospective and current clients who communicate with us by email or during a free 30-minute discovery call

It does not replace a separate Master Services Agreement, NDA, or Statement of Work for paid engagements, which may contain additional confidentiality terms.

3. Information we collect

3.1 Information you provide

Contact / enquiry form: first name, last name, company or organisation, work email, phone (optional), service interest, and message content
Newsletter: email address only
Email / calls: information you choose to share when you write to us or speak with us

3.2 Information collected automatically

Basic technical data such as IP address, browser type, and request metadata (for example when you submit a form)
Security and abuse-prevention signals (rate limits, honeypot fields, CSRF tokens) used to protect our forms
If we use Cloudflare or similar CDN/WAF services, those providers may process connection data under their own policies to protect the site

We do not intentionally collect sensitive personal data (for example financial account numbers, government IDs, or health data) through the public website forms. Please do not submit secrets, passwords, or confidential technical details in the public form until an NDA is in place.

4. How we use your information

We use personal information to:

Respond to enquiries and schedule free 30-minute discovery calls
Prepare proposals, Statements of Work, and commercial follow-up
Send newsletter updates about research and blog content if you subscribed
Operate, secure, and improve our website and forms (including spam and abuse prevention)
Meet legal, regulatory, or contractual obligations where applicable

We do not sell your personal information. We do not use your contact details for unrelated third-party marketing lists.

5. Legal basis / purpose limitation

We process personal data for specified purposes: responding to your requests, providing services you ask for, legitimate security of our systems, and compliance with law. Where consent is required (for example optional newsletter subscription), you may withdraw it by contacting us.

6. How we share information

We may share personal information only with:

Email / hosting providers needed to deliver form notifications (for example SMTP mail services used for [email protected] / [email protected])
Infrastructure providers (hosting, DNS, CDN such as Cloudflare) that process data to run and protect the website
Professional advisers or authorities if required by law

Service providers are expected to process data only for the purpose of supporting our operations and to apply reasonable security measures.

7. Storage, retention, and security

Contact enquiries: transmitted by email to our team. We do not permanently store full form submissions in a public website database by design.
Newsletter: email addresses are stored in a protected server-side file used only for subscription management. Errors related to form processing may be logged (with limited technical detail) to help us fix failures.
Retention: we keep personal data only as long as needed for the purposes above, or as required by law or legitimate business records (for example correspondence about an engagement).
Security: we use measures appropriate to our environment, including HTTPS (when configured on the server), access controls on configuration directories, CSRF protection, rate limiting, and honeypot anti-bot fields. No method of transmission or storage is 100% secure; we work to reduce risk.

8. Cookies and similar technologies

Our public site primarily uses functional session mechanisms required for form security (for example CSRF session tokens). We do not run third-party advertising cookies as part of the core site design. If analytics or additional cookies are introduced later, we will update this policy and, where required, seek appropriate consent.

9. Your rights

Subject to applicable law (including the DPDP Act), you may request to:

Access the personal data we hold about you
Correct inaccurate data
Withdraw consent for newsletter emails
Request erasure or restriction where legally available

To exercise these rights, email [email protected] with the subject line "Privacy Request". We may need to verify your identity before acting on a request.

10. Children

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will take appropriate steps.

11. International transfers

We work with clients globally. Depending on hosting and email infrastructure, data may be processed on servers outside your country. Where we transfer personal data, we take reasonable steps consistent with applicable law and the need to provide the service you requested.

12. Third-party links

Our site may link to third-party sites (for example LinkedIn or X). Those sites have their own privacy policies. We are not responsible for their practices.

13. Blog and research content

Technical blog posts are provided for research and learning. They do not collect additional personal data beyond normal website use. Blog content is not a substitute for authorised security testing of your own systems.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Continued use of the website after updates constitutes notice of the revised policy, except where consent is required by law.

15. Contact us

For privacy questions or requests:
Email: [email protected]
Website: CyberKartel (cyberkartel.com)