Privacy Policy

Version 1.0  ·  Effective date: 20 July 2026  ·  Last updated: October 2026

1. Who We Are

Indic Shield Technologies is a sole proprietorship owned and operated by Dibyam Prabhat, providing cybersecurity audit and managed security services to businesses across India.

Data Fiduciary (Controller): Dibyam Prabhat, proprietor of Indic Shield Technologies
Registered office: Innov8, Prestige Tech Platina, 11th Floor, 32/2, 34/1, Kadabisanahalli, Bengaluru, Karnataka, India – 560087
GSTIN: 29BIMPP5462N1ZB  |  Udyam: UDYAM-KR-03-0699368

Grievance Officer / Data Protection Contact:
Dibyam Prabhat  |  dibyam@indicshield.ai  |  +91 78297 64838

2. What Data We Collect

We collect only the data necessary to provide our services and operate this website. This includes:

Information you provide directly

• Name — when you fill out a contact or enquiry form
• Email address — for correspondence and, if opted in, newsletters
• Phone number — if provided in a contact form or enquiry
• Company name and role — if provided in a business enquiry
• Message content — the text of your enquiry or communication

Information collected automatically

• IP address — logged by our hosting provider's server infrastructure
• Browser type and version — collected in server logs
• Pages visited and time spent — basic website analytics
• Referring URL — how you arrived at our website

Cookies and local storage

We use essential cookies and local/session storage for website functionality (for example, remembering your light/dark theme preference). See our Cookie Policy for full details.

3. How We Collect It

• Contact forms on this website
• Email correspondence you initiate with us
• Phone calls you make to us
• WhatsApp messages sent to our business number
• Automatic server logs generated when you visit this website
• Cookies and session storage in your browser

We do not purchase data, scrape social media, or obtain your data from data brokers.

4. Why We Process It (Purposes)

• Respond to enquiries: To reply to questions you send us via any channel
• Provide services: To deliver cybersecurity and compliance services you engage us for
• Newsletter communications: To send security advisories, compliance updates and insights — only if you have opted in
• Website improvement: To understand how our website is used and improve it
• Legal obligations: To comply with applicable Indian laws including CERT-In Directions (2022), which require us to retain server logs for 180 days
• Security: To detect, investigate and prevent fraud, abuse or security incidents

5. Legal Basis for Processing

Our processing of personal data is based on the following:

• Consent: For newsletter subscriptions and non-essential cookies, we process data only with your explicit consent, which you can withdraw at any time
• Legitimate interest: For responding to business enquiries and improving our website
• Legal obligation: For server log retention under CERT-In Directions, 2022 (180-day mandatory retention)
• Contract performance: For delivering services under an engagement agreement

The applicable statutory framework includes: IT Act 2000, IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Digital Personal Data Protection Act, 2023 (DPDP Act) with Rules, 2025. Full DPDP Rules 2025 compliance is targeted by 13 May 2027.

6. Data Sharing

We do not sell, rent or trade your personal data.

We share data only in the following limited circumstances:

• Email platform: We use a third-party email service to send newsletters. Subscribers' email addresses are shared with this platform solely for delivery purposes
• Hosting provider: Our website host processes server logs (including IP addresses) as part of infrastructure operation. They act as a data processor under contractual obligations
• Professional advisers: Our CA and legal advisers may access relevant data under professional confidentiality obligations and NDAs
• Law enforcement: We will disclose data when required to do so by a court order, government direction, or applicable law — including reporting obligations under CERT-In Directions, 2022

7. International Transfers

Our primary data storage is within India. Where data is processed by third-party service providers (such as email platforms or hosting infrastructure) that operate outside India, we ensure adequate safeguards are in place, consistent with the requirements of the DPDP Act 2023 and applicable RBI/MeitY guidelines.

We will update this section as the Data Protection Board of India notifies rules on cross-border data transfers under the DPDP Act.

8. Retention Periods

• Contact enquiry data: Retained for 3 years from the date of last contact, or longer if required for an active engagement or legal obligation
• Newsletter subscriber data: Retained until you unsubscribe; deleted within 30 days of unsubscription
• Server logs (IP addresses, access logs): 180 days, as mandated by CERT-In Directions, 2022
• Session/theme preference (local storage): Cleared when you clear browser data; not transmitted to our servers
• Engagement-related data: Retained for 7 years for legal and professional record-keeping purposes (standard Indian business practice)

9. Your Rights Under the DPDP Act 2023

As a data principal under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right of access: Request a summary of what personal data we hold about you and how it is being processed
• Right to correction: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data, subject to our legal retention obligations
• Right to grievance redressal: Lodge a complaint with our Grievance Officer (details in Section 13) and, if unresolved, with the Data Protection Board of India
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity
• Right to withdraw consent: Withdraw consent for any processing that is based solely on consent, without affecting the lawfulness of prior processing

To exercise any of these rights, write to dibyam@indicshield.ai. We will respond within 30 days.

10. Cookies

We use a minimal set of cookies and session storage. For full details of what we use, why, and how to control it, please read our Cookie Policy.

11. Children

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. If you believe we may have collected such data, please contact us at hello@indicshield.ai.

Under the DPDP Act 2023, processing of data of children requires verifiable parental consent. We do not process children's data.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. For material changes, we will notify affected individuals by email (where we hold your address) at least 14 days before the change takes effect. The updated policy will always be available at this URL with a revised effective date.

13. Grievance Redressal

If you have a complaint or concern about how we handle your personal data, please contact our Grievance Officer:

Dibyam Prabhat
Proprietor, Indic Shield Technologies
dibyam@indicshield.ai
+91 78297 64838

We will acknowledge your grievance within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted and operational under the DPDP Act 2023.

14. Contact Us

For any questions about this policy or our data practices:

Email: hello@indicshield.ai
Phone: +91 78297 64838
WhatsApp: wa.me/917829764838
Address: Innov8, Prestige Tech Platina, 11th Floor, 32/2, 34/1, Kadabisanahalli, Bengaluru, Karnataka, India – 560087