Privacy policy
How SafCY collects, uses and protects your personal data, in line with the Digital Personal Data Protection Act, 2023.
This privacy policy explains how SafCY collects, uses, shares and protects your personal data when you use safcy.com (the “website”) or contact us. It is written to meet the notice requirements of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), and our obligations under the Information Technology Act, 2000 and the rules made under it.
We have tried to write it plainly. If anything is unclear, contact our Grievance Officer (see section 12).
1. Who we are
The website is operated by SAFCY TECHNOLOGIES PRIVATE LIMITED, a company incorporated in India (CIN U62011TS2026PTC214796), with its registered office at 3rd Floor, KNR Square, Opp. The Platina, Gachibowli, Hyderabad, Telangana - 500032 (“SafCY”, “we”, “us”, “our”).
For the personal data described in this policy, SafCY is the Data Fiduciary under the DPDP Act: we decide why and how your personal data is processed.
2. Scope
This policy covers personal data we collect:
- when you browse the website; and
- when you send us an enquiry through the contact form, by email or by phone.
Client engagement data is not covered. When we deliver a security service (for example a penetration test, a forensic investigation or a compliance audit), we may handle personal data that belongs to our client. In that work we act on the client’s instructions as a Data Processor, under a written contract that governs how that data is handled. Questions about that data should go to the client organisation first.
3. Personal data we collect
We collect only what we need for the purposes below. We do not collect financial information, government identifiers (such as Aadhaar or PAN), biometric data or precise location through this website.
| What we collect | When | Why we use it | Basis |
|---|---|---|---|
| Name, work email address, and optionally company name and phone number | You submit the contact form, email us or call us | To reply to your enquiry and discuss the service you asked about | Your consent (DPDP Act, s. 6) |
| The service you are interested in and your message | You submit the contact form | To understand your enquiry and send it to the right specialist | Your consent (DPDP Act, s. 6) |
| Confirmation that you ticked the consent box (a message is only saved if you did), with the date and time of your message | You submit the contact form | To show that we had your consent | Legitimate use: meeting our legal obligations (DPDP Act, s. 7) |
| Technical data: IP address, browser type, device type, pages requested, date and time | Every visit, automatically, in our web server logs | To run the website securely, detect and prevent attacks and abuse, and fix faults | Legitimate use: meeting legal obligations, including the CERT-In Directions of 28 April 2022 (DPDP Act, s. 7) |
4. How we use your personal data
We use your personal data only for the purposes listed in section 3. In particular:
- Enquiry data is used only to contact you about your enquiry. We do not add you to a mailing list or send you newsletters or marketing unless you separately and explicitly ask us to.
- We do not sell, rent or trade your personal data.
- We do not use your personal data for targeted advertising, profiling or automated decision-making that affects you.
- If we ever want to use your personal data for a new purpose, we will tell you first and, where the law requires, ask for your consent again.
5. Cookies and similar technologies
The website uses one strictly necessary cookie, named session. It holds a random security token that protects the contact form against cross-site request forgery, and it expires when you close your browser.
The cookie is marked HttpOnly and SameSite=Lax (and Secure over HTTPS). The website cannot work securely without it, so it is set without asking you first. You can block or delete cookies in your browser settings, but the contact form will not work if you do.
We do not use analytics, advertising or social-media tracking cookies.
Content delivered by third parties
To display the website, your browser loads some files directly from third-party servers. When it does, those providers receive your IP address and basic browser information, as with any web request:
- Google Fonts (Google LLC), for typefaces — see Google’s privacy policy.
Where we show a map on the contact page, it is embedded from Google Maps, and Google’s privacy policy applies to your use of it.
Share links on blog posts (LinkedIn, X) are plain links. No data is sent to those platforms unless you click a link.
6. Who we share personal data with
We share personal data only when necessary, and only with:
- Service providers (Data Processors) who work for us under contract, such as website hosting, cloud infrastructure and email providers. They may use the data only to provide their service to us, and must protect it with reasonable security safeguards (DPDP Act, s. 8).
- Government and law-enforcement authorities, courts and regulators (including CERT-In and the Data Protection Board of India), when the law requires it or a valid legal order directs it.
- Professional advisers such as lawyers and auditors, under a duty of confidentiality, when we need their advice.
- A successor organisation, if SafCY is involved in a merger, acquisition, amalgamation or sale of assets. The successor must continue to protect your personal data in line with this policy.
If you ask, we will give you the identities of the Data Fiduciaries and Data Processors we have shared your personal data with, and a description of what we shared (see section 10).
7. Where your data is stored and transfers outside India
Our website and its data are hosted by trusted cloud service providers, which may store data in India or in other countries.
Some of our service providers, and the third-party content providers in section 5, may process data on servers outside India. Section 16 of the DPDP Act allows this, except to countries the Central Government has restricted by notification. We do not transfer personal data to any such restricted country, and we require providers to protect transferred data to the standard this policy describes.
8. How long we keep personal data
We keep personal data only for as long as we need it for the purpose we collected it for, or as long as the law requires. Then we delete it securely (DPDP Act, s. 8(7)).
| Data | How long we keep it |
|---|---|
| Contact-form enquiries and related correspondence | [24 months] from our last communication with you. If the enquiry leads to an engagement, the retention terms of the engagement contract apply instead. |
| Consent records | As long as we hold the related enquiry, plus any period the law requires. |
| Web server and security logs | At least one year, as the DPDP Rules require for traffic data and logs, and at least 180 days in India under the CERT-In Directions. Then deleted. |
The session cookie |
Until you close your browser. |
If you withdraw your consent, we will stop processing and delete the personal data concerned within a reasonable time. The only exception is data the law requires us to keep.
9. How we protect personal data
As a cybersecurity firm, we apply the reasonable security safeguards required by section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules. These include:
- encryption of data in transit using HTTPS (TLS);
- role-based access, so only authorised staff can see enquiries;
- protection against cross-site request forgery and brute-force attacks;
- strict security headers on every page;
- logging and monitoring of access to detect unauthorised use;
- regular backups; and
- confidentiality obligations for staff and contracts with service providers.
No method of transmission or storage is completely secure, but we continually review and improve these safeguards.
Personal data breaches
If a breach affects your personal data, we will:
- inform you without delay, as required by section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, explaining what happened, its likely impact, what we are doing about it and the steps you can take to protect yourself;
- notify the Data Protection Board of India within the required timelines; and
- report cyber incidents to CERT-In within six hours, where its Directions require it.
10. Your rights
Under the DPDP Act you have the following rights.
- Right to information (s. 11): a summary of the personal data we process about you and how we process it, and the identities of everyone we have shared it with.
- Right to correction, completion, updating and erasure (s. 12): ask us to fix inaccurate or incomplete data, update it, or delete data we no longer need. We will act on it unless the law requires us to keep the data.
- Right to withdraw consent (s. 6(4)): withdraw your consent at any time, as easily as you gave it, by emailing us. Withdrawal does not affect processing that happened before it. After withdrawal we will stop processing and delete the data concerned, and we may no longer be able to respond to your enquiry.
- Right to grievance redressal (s. 13): complain to our Grievance Officer about how we handle your personal data.
- Right to nominate (s. 14): nominate another person to exercise your rights if you die or become incapable.
How to exercise your rights: email srinivas@safcy.com with the subject line “Data request” and tell us which right you want to exercise. We may ask you to verify your identity before we act, so we never disclose or change data at the request of the wrong person. We do not charge for requests.
How quickly we respond: we will acknowledge your request within 7 days and resolve it within 30 days. That is well within the maximum of 90 days the DPDP Rules allow. If we need longer, we will tell you why.
Complaints to the Data Protection Board: if you are not satisfied with our response, you may complain to the Data Protection Board of India. Under section 13(3) of the DPDP Act, you must first use our grievance process.
11. Links to other websites
The website links to other websites, such as social-media profiles and references in blog posts. We are not responsible for how those websites handle personal data, so please read their privacy policies.
12. Contact us and Grievance Officer
For any question, request or complaint about this policy or your personal data, contact our Grievance Officer:
- Name: Srinivas K
- Designation: Grievance Officer, SAFCY TECHNOLOGIES PRIVATE LIMITED
- Email: srinivas@safcy.com
- Address: 3rd Floor, KNR Square, Opp. The Platina, Gachibowli, Hyderabad, Telangana - 500032
- Hours: Monday–Friday, 9:00–18:00 IST
13. Language
This policy is published in English. Under section 5(3) of the DPDP Act, you may ask for it in any language listed in the Eighth Schedule to the Constitution of India by emailing the Grievance Officer.
14. Changes to this policy
We may update this policy when our practices or the law change. We will post the new version on this page. If a change materially affects how we use personal data we already hold, we will tell you before it takes effect and, where the law requires, ask for your consent again.