Privacy Policy

UnlockSec Cybersecurity Private Limited ("UnlockSec", "we", "us", or "our") operates the website unlocksec.com and delivers offensive security services. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and your rights in relation to it.

By using our website or engaging our services, you agree to the practices described in this policy. If you disagree with any part, please discontinue use of our website and contact us to discuss your engagement terms.

We use personal data for the following purposes:

• To respond to enquiries, proposals, and contact form submissions
• To deliver contracted security services and manage client relationships
• To operate and improve the Security Blueprint platform
• To process job applications and communicate with candidates
• To send service-related communications (never unsolicited marketing without consent)
• To analyse website usage and improve our content and user experience
• To comply with legal obligations and enforce our Terms of Service

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. Ever.

Under GDPR and equivalent laws, we process personal data only where we have a valid legal basis:

• Contract performance: Delivering security services to clients under a signed agreement.
• Legitimate interests: Analysing website traffic to improve our services; responding to unsolicited enquiries.
• Legal obligation: Retaining records required by tax law or applicable security regulations.
• Consent: Optional marketing newsletters (you may withdraw consent at any time).

Our website uses cookies and similar technologies. We use the following categories:

You can manage cookie preferences through your browser settings. Disabling analytics cookies will not affect your access to any part of our website.

We use carefully selected third-party services to operate our business. Each is subject to its own privacy policy and data processing agreements with us:

• Email & CRM provider: Managing contact form submissions and client communications
• Website hosting (Vercel or equivalent): Serving website content; may log IP addresses
• Analytics platform: Privacy-respecting visitor analytics; no cross-site tracking
• Payment processor: Handling subscription or invoice payments if applicable

We do not share your personal data with third parties except as necessary to deliver our services, comply with law, or with your explicit consent.

We retain personal data only as long as necessary for the stated purpose:

• Contact form enquiries: 24 months from last contact
• Client engagement records: 7 years (legal and tax requirements)
• Job application data: 12 months if unsuccessful (unless you consent to longer)
• Website analytics: 14 months rolling (anonymised thereafter)
• Security Blueprint platform data: for the duration of the subscription plus 90 days

We apply appropriate technical and organisational security measures to protect your personal data, including:

• Encryption in transit (TLS 1.2+) and at rest for all stored personal data
• Access controls limiting data access to staff with a legitimate need
• Regular internal security reviews of systems handling personal data
• Incident response procedures for notifying affected individuals within 72 hours of a breach

As a cybersecurity firm, data security is not a compliance exercise for us — it is core to our business. We hold ourselves to the same standards we apply for our clients.

If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR / UK GDPR:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data where there is no overriding legal basis for retention.
• Restriction: Ask us to restrict processing while a dispute is being resolved.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw consent: Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, contact us at privacy@unlocksec.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK).

If you are located in India, the Digital Personal Data Protection Act 2023 (DPDPA) grants you the following rights as a "Data Principal":

• Right to Access: Obtain a summary of personal data being processed and the purposes for which it is processed.
• Right to Correction: Correct inaccurate or misleading personal data; complete incomplete data.
• Right to Erasure: Erase personal data where the purpose for processing is no longer served, subject to legal retention obligations.
• Right to Grievance Redressal: Register a grievance with us and receive a timely response.
• Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

We act as a "Data Fiduciary" under DPDPA. You may exercise your rights by contacting our Grievance Officer at privacy@unlocksec.com. We will acknowledge within 48 hours and resolve within 30 days.

UnlockSec is based in India. If you contact us from the EEA, UK, or other jurisdictions with data transfer restrictions, your data may be transferred to and processed in India. We ensure such transfers are governed by appropriate safeguards, including standard contractual clauses where required.

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a prominent notice on our website and, where we hold your email address, by sending a notification. The "Last updated" date at the top of this page always reflects the current version.

Continued use of our website following a change notification constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or complaints, please contact:

We aim to respond to all privacy enquiries within 5 business days.