Privacy Policy

1. Who We Are & the Scope of This Policy

CyberSRC® Labs Pvt. Ltd. is a cybersecurity product company based in India. We build and operate digital-risk, threat-intelligence, attack-surface, OT-security and software-supply-chain products, including SRC-AttackGuard™, SRC-TI®, SRC-OTShieldX™, SRC-iSBOM™, SRC-AssetIntelligence™, SRC-PhaaS™ and SRC-VMS.

For the personal data described in this policy, CyberSRC Labs is the Data Fiduciary — the entity that decides why and how your personal data is processed.

This policy covers personal data we handle when you:

• Visit or interact with cybersrclabs.com;
• Request a demo, contact us, or ask about our products and services — directly or through one of our partners;
• Subscribe to updates, or register for an event or webinar;
• Deal with us as a customer, reseller, distributor, partner, supplier or prospective employee.

It does not cover the personal data we process on behalf of our customers when we operate our products for them — for that, see Section 12.

2. Key Terms

We use these terms as defined in the DPDP Act:

• Personal data — any data about an individual who can be identified from it.
• Processing — any operation on personal data, such as collecting, storing, using, sharing or erasing it.
• Data Principal — the individual the personal data is about (that’s you).
• Data Fiduciary — the organisation that decides the purpose and means of processing (that’s us, for this policy).
• Data Processor — a party that processes personal data on behalf of a Data Fiduciary.

3. The Personal Data We Collect

a. Data you give us

When	What we collect
Demo requests & enquiries (“book a demo” / “contact us”)	Name, business email, phone number, company, job title, country/region, and the details in your message.
Newsletter / updates	Name and email address.
Events & webinars	Name, email, organisation, and registration details.
Customer, reseller & partner dealings	Business contact details of the people we work with, and records of our correspondence.
Support requests	Contact details and the information you share to resolve your query.
Careers	The information in your application and CV, and anything you share during recruitment.

b. Data we collect automatically

When you use our website, we collect technical information such as your IP address, device and browser type, pages viewed, referring links, and the date and time of your visit. We collect this through cookies and similar technologies — see Section 5.

c. Data from other sources

We may receive business contact details from lawful sources such as professional networking platforms, business-data providers, event organisers, and our authorised resellers, distributors and referral partners — for example when a partner passes on your interest in one of our products, or introduces you to us.

Providing personal data is voluntary. However, if you do not give us the information we need to answer your enquiry or deliver a service, we may be unable to help. We do not intentionally collect special or sensitive categories of data through our website — please do not send us such information in your enquiries unless it is necessary.

4. Why We Use Your Personal Data & Our Lawful Basis

Because our products are B2B, most of what we handle is business-contact information that you or your organisation provide voluntarily for a specific purpose. Under the DPDP Act, we process personal data either for a legitimate use permitted by the Act or with your consent.

Purpose	Basis
Respond to your enquiries and demo requests	Your voluntary request / legitimate use
Route your enquiry to the right CyberSRC team or to an authorised reseller / distributor in your region	Your voluntary request / legitimate use
Provide, administer and support our products and services	Contract / legitimate use
Manage our reseller, distributor and partner relationships	Contract / legitimate use
Send you product updates, offers and marketing	Consent (withdrawable any time)
Operate, secure and improve our website	Legitimate use
Protect against fraud, misuse and security threats	Legitimate use / legal obligation
Meet legal, regulatory and tax obligations	Legal obligation
Consider you for employment	Your application / consent

Where we rely on consent, we ask for it clearly and you can withdraw it at any time — withdrawing is as easy as giving it (see Section 10). Every marketing email also carries an unsubscribe link. Withdrawing consent does not affect processing already carried out. We take reasonable steps to keep the personal data we use accurate and up to date.

5. Cookies & Similar Technologies

Our website uses cookies and similar technologies to make the site work, remember your preferences, understand how the site is used, and — where you allow it — to personalise content. You can accept or decline non-essential cookies through our cookie banner, and you can change your choice at any time. Essential cookies are needed for the site to function and cannot be switched off.

6. How We Share Personal Data

We share personal data only where needed, and only with:

• Authorised resellers, distributors and channel partners — where a partner introduced you, or where a partner in your region will handle your enquiry, demo or purchase. These partners handle your data under their own privacy terms and are responsible for their own use of it.
• Service providers (Data Processors) who work for us under contract — for example website hosting, analytics, email delivery and customer-relationship (CRM) tools. They may process your data only on our instructions and must protect it.
• Group companies, such as CyberSRC® Consultancy Pvt. Ltd., where relevant to serving you, under appropriate safeguards.
• Authorities and advisers, where we are required to disclose data by law, court order or regulation, or to establish, exercise or defend legal claims.
• A successor entity, if our business or assets are reorganised, merged or acquired — subject to this policy.

We do not sell your personal data, and we do not share it for others’ independent marketing.

7. Transfers Outside India

We are based in India and generally process personal data here. Some of our service providers or partners may process data outside India. Where that happens, we do so in line with the DPDP Act — we do not transfer personal data to any country or territory that the Government of India has restricted, and we keep appropriate safeguards in place. Certain categories of data will be kept in India where the law requires it.

8. How Long We Keep Your Personal Data

We keep personal data only for as long as we need it for the purpose we collected it, or for as long as the law requires — after which we erase it or anonymise it. As a guide:

Data	Typical Retention
Enquiry & demo-request data	Up to 24 months after our last contact, unless a relationship continues
Marketing subscriber data	Until you unsubscribe or withdraw consent
Customer, reseller & contract records	For the relationship, then as required by law (e.g. tax, accounting)
Recruitment data (unsuccessful)	Up to 12 months, unless you ask us to keep it on file
Website logs & analytics	Short retention, then aggregated or deleted

9. How We Protect Your Personal Data

As a cybersecurity company, security is central to what we do. We use reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration and loss — including access controls, encryption in transit, logging and monitoring, backups, staff confidentiality obligations, contractual security terms with our processors, and an information security programme aligned to recognised standards. No system can be completely secure, but we work continuously to protect your data and to keep our safeguards up to date.

10. Your Rights as a Data Principal

Under the DPDP Act you have the right to:

• Access — ask for a summary of the personal data we hold about you and how we process it.
• Correction & updating — ask us to correct, complete or update inaccurate or incomplete data.
• Erasure — ask us to erase your personal data where it is no longer needed for the purpose it was collected, unless we must keep it by law.
• Withdraw consent — withdraw any consent you gave us, at any time, as easily as you gave it. If you withdraw consent, we and the processors acting for us will stop the related processing, unless we are required to continue by law.
• Grievance redressal — raise a concern about how we handle your data and receive a response.
• Nominate — nominate another individual to exercise these rights on your behalf if you die or become incapacitated.

To exercise any of these rights, contact our Grievance Officer (Section 15). We may need to verify your identity before we act. We will acknowledge and respond to your request within 7 days and in any case within the period required by law.

You may also give or withdraw consent through a Consent Manager registered with the Data Protection Board of India, once such services are available. You have a duty under the DPDP Act to provide accurate information and not to raise false or frivolous requests.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. We would appreciate the chance to resolve your concern first.

11. Children’s Data

Our website and products are meant for businesses and are not directed at children. We do not knowingly collect the personal data of anyone under 18 through this website. Where we do need to process a child’s personal data, we will obtain verifiable consent from a parent or lawful guardian, and we will not carry out tracking, behavioural monitoring, or targeted advertising directed at children, or any processing likely to harm a child’s well-being. If you believe a child has given us personal data, please contact us and we will delete it.

12. Our Products & Threat Intelligence (Our Role as a Data Processor)

When we operate our products for a customer — for example SRC-AttackGuard™, SRC-TI®, SRC-OTShieldX™, SRC-iSBOM™, SRC-AssetIntelligence™, SRC-PhaaS™ or SRC-VMS — that customer decides why and how the data is processed. The customer is the Data Fiduciary and CyberSRC Labs acts as a Data Processor, processing personal data only on the customer’s documented instructions.

Depending on the product, this can involve processing:

• Information gathered from public sources and the surface, deep and dark web — such as exposed credentials, leaked data and brand-impersonation signals (SRC-AttackGuard™, SRC-TI®);
• Asset, account and asset-owner details discovered during external and internal asset inventory and vulnerability management (SRC-AssetIntelligence™, SRC-VMS, SRC-OTShieldX™);
• Contributor or maintainer details that may appear within software components and dependencies (SRC-iSBOM™); and
• The customer’s employee details and their responses to simulated phishing and awareness campaigns (SRC-PhaaS™).

Some of this data may contain personal data of the customer’s staff or of third parties. It is processed for the customer’s security and risk-management purposes, under the customer’s agreement and applicable law, and is not governed by this website policy.

If your personal data appears in a customer’s environment and you wish to exercise your rights, please contact that organisation (the Data Fiduciary); we will support them in responding to you.

Where you purchase our products through an authorised reseller or distributor, your commercial relationship is with that partner, and the roles and responsibilities for any personal data are set out in the applicable agreements.

13. Personal Data Breaches

If a personal data breach occurs, we will act promptly to contain and assess it and, in line with the DPDP Act and the DPDP Rules, 2025, we will notify the Data Protection Board of India without delay and affected Data Principals as required (generally within 72 hours), with the information the law prescribes — including what happened, the likely consequences, the measures we are taking, and steps you can take to protect yourself.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or the law. We will post the updated version here and change the “last updated” date above. Where changes are significant, or where the law requires fresh consent, we will take reasonable steps to bring them to your attention. This policy is governed by the laws of India.

15. How to Contact Us

For any question about this policy, or to exercise your rights, please contact our Grievance Officer: