Privacy Policy

This policy describes what happens to personal data when you browse pentestproviders.in (the "Site"), send us an enquiry or otherwise get in touch. The Site is run by BugFoe Private Limited, a company incorporated in India and based in Ahmedabad, Gujarat, which trades in this context as PentestProviders India ("we", "us"). We wrote it with the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 in mind. For any question about it, write to sales@bugfoe.com.

1. Our role

For personal data collected through the Site, BugFoe Private Limited acts as the Data Fiduciary under the DPDP Act. Where the EU or UK GDPR applies to you, we are the controller. The DPDP Rules were notified on 13 November 2025 and their provisions take effect in stages, with most obligations applying from 13 May 2027. We already follow the practices set out below and will keep this policy in step with the Rules as they come into force.

2. Information we hold

• What you send us: your name, work email, organisation, phone number if you share it, the services you are interested in, compliance drivers, timelines and anything you write in a form or email.
• Technical information: IP address, browser and device details, pages requested and times of access. We use these to keep the Site secure, block spam and limit abuse.
• Cookies and similar tools: explained in our Cookie Policy.

Please do not send passwords, confidential system details or other people's personal data through our forms. If scoping needs sensitive information, we will arrange a secure channel once an NDA is in place.

3. Why we use it

We tell you the purpose when we collect your data, and we use it only for that purpose or one closely connected to it.

Where we rely on consent, you can withdraw it at any time by email, and withdrawing is as easy as giving it. Withdrawal does not affect anything we did lawfully before. We will only send marketing emails if you ask for them, and each one has a simple way to stop them.

4. Advertising and Google AdSense

Blog posts on the Site may carry advertising served through Google AdSense. Adverts never appear on our service descriptions, the quote form or the contact page.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to this site and/or other sites on the Internet.
• You can opt out of personalised advertising through Google Ads Settings. Some other vendors' personalised-advertising cookies can be switched off through the aboutads.info choices page or, in Europe, Your Online Choices.
• Google explains its approach on its partner sites data page.

If you visit from the European Economic Area, the United Kingdom or Switzerland, a Google-certified consent management platform asks for your choice before any advertising or analytics cookie is set. You can revisit that choice through the "Privacy and cookie settings" link shown on pages with adverts.

5. Site analytics

When analytics is enabled we use Google Analytics 4 to see, in aggregate, which pages are read and how visitors move around the Site. Google Consent Mode is configured so that, where consent is needed, no analytics cookie is set until you agree.

6. Who we share data with

We never sell or rent personal data. It is shared only with:

• our hosting company (Hostinger) and email providers, acting as Data Processors on our behalf under contracts that oblige them to protect it;
• Google, for the analytics and advertising features described in sections 4 and 5;
• professional advisers, and government bodies or regulators where Indian or other applicable law requires disclosure.

7. Where processing happens

Our team works in India and handles your data here. Some service providers may process data in other countries, which the DPDP Act allows subject to any restrictions the Central Government notifies. If you write to us from the EU or UK, your data comes to India, and where GDPR requires it we use suitable safeguards such as standard contractual clauses.

8. How we protect it

We apply reasonable security safeguards: the whole Site runs over HTTPS, form submissions are stored with restricted access, and only people who need your details to reply can see them. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.

9. How long we keep it

We delete enquiry details two years after we last heard from you, unless an ongoing relationship gives us reason to keep them longer. Data from client engagements is kept for the period set in the contract. Security logs are retained for at least as long as Indian law requires and no longer than that purpose needs.

10. Your rights as a Data Principal

As the DPDP Act's provisions take effect, you can ask us to:

• tell you what personal data we process about you and how;
• correct, complete, update or erase it, including by withdrawing consent so processing stops;
• resolve a grievance about how we have handled your data;
• accept a nominee who can exercise your rights if you die or become unable to do so.

If you are in the EU or UK, GDPR also gives you rights of access, rectification, erasure, restriction, objection (including to direct marketing) and portability, the right to withdraw consent, and the right to complain to your local supervisory authority, such as the UK Information Commissioner's Office.

11. Grievances and complaints

To use any of these rights or raise a grievance, email sales@bugfoe.com with "Privacy Request" in the subject line. We acknowledge requests promptly and respond within 30 days, or sooner if the law sets a shorter deadline. We may need to confirm your identity first.

If our response does not resolve your grievance, you may approach the Data Protection Board of India after using our grievance process.

12. Children

The Site is meant for businesses and is not aimed at anyone under 18. We do not knowingly collect children's data; if you think a child has sent us personal data, tell us and we will delete it.

13. Updates to this policy

We may revise this policy, for example as further DPDP Rules take effect. The "Last updated" date at the top will change, and significant changes will be highlighted on this page.