Privacy Policy

01 / Who We Are

Imperial CyberX is a trade name used by Sheikh Junayed Ahmed for an individually owned remote digital and cybersecurity services business operating from Electronic City Phase 1, Bengaluru, Karnataka, India. In this Policy, “Imperial CyberX”, “we”, “us” and “our” refer to the business operated by the proprietor.

This Privacy Policy explains how information may be handled when you visit the website, make an enquiry, request a service, or communicate with us. It should be read alongside the Terms & Conditions and any separate agreement that applies to a specific service engagement.

02 / Information That May Be Processed

The information involved depends on how you interact with the website and our services. It may include:

• Information you submit: your name, contact details, organisation, enquiry contents, project requirements, and information you choose to send through an available contact or service-request channel.
• Technical and security records: depending on the hosting, delivery and security configuration, routine logs may include IP address, requested URL, date and time, browser or device information, referral information, error events and security-related events.
• Project information: information reasonably required to scope or deliver a service under a separate proposal, statement of work, or client agreement.
• Business records: relevant communications, quotations, invoices, transaction records or records that must be maintained under applicable law.

Please do not send passwords, private keys, authentication codes, payment-card details, sensitive personal information, or confidential system data through a public enquiry channel. Where such information is genuinely needed for a contracted service, an appropriate secure method and agreed scope should be established first.

03 / Why Information May Be Used

Information may be used, to the extent relevant and permitted by law, to respond to enquiries, prepare proposals, communicate about a project, provide requested services, maintain and protect the website, investigate technical or security incidents, prevent misuse, maintain business records, resolve disputes and comply with legal obligations.

We aim to collect and use only information that is reasonably relevant to the purpose for which it is requested. We do not describe information as mandatory where it is optional; where information is necessary to respond to a request or perform an agreed service, the consequences of not providing it will be explained where appropriate.

04 / Legal Framework

Information handling is subject to the laws and rules applicable to the relevant activity. These may include the Information Technology Act, 2000 and applicable rules, and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent the relevant provisions are in force and apply.

The DPDP Act and Rules provide for phased commencement. This Policy does not represent that every provision is already operative as of its update date. We will review this Policy and the related practices as the applicable legal requirements take effect.

Security and privacy risk-management practices may be informed by NIST privacy or cybersecurity guidance. NIST frameworks are voluntary guidance; this statement does not claim NIST certification, independent audit, or formal conformance.

Reference material: Information Technology Act, 2000; Digital Personal Data Protection Act, 2023; DPDP Rules, 2025; NIST Privacy Framework; and NIST Cybersecurity Framework.

05 / Sharing and Service Providers

Information may be made available to service providers when reasonably necessary to host, deliver, secure or maintain the website or to support a service you have requested. It may also be disclosed where required by law, in response to a lawful request, to protect rights or safety, or as part of handling a dispute.

Where a particular client engagement involves third-party platforms, cloud services, code repositories, communication tools or other providers, the relevant scope and provider arrangements should be assessed for that engagement. Third-party services have their own terms and privacy practices.

We do not promise that every service provider or processing location is identical for every project. Where a project requires specific data-handling, confidentiality, location or security requirements, those requirements should be recorded in the applicable written agreement.

06 / Cookies, Analytics and External Links

Cookies, local storage and similar technologies may be used where they are part of the website's actual configuration—for example, to support essential functionality, preferences or security. The technologies present may change as the website changes. This Policy should be updated if non-essential analytics, advertising, embedded content or other tracking technologies are introduced.

Your browser may provide controls for limiting cookies or stored data. Blocking certain technologies can affect website functionality. External websites linked from Imperial CyberX are not controlled by this Policy; review the relevant third party's privacy information before using them.

07 / Retention

Information should be retained only for as long as reasonably necessary for the purpose for which it was collected, for legitimate security and operational needs, for an active service engagement or dispute, or to meet an applicable legal recordkeeping requirement. Retention periods may therefore differ by record type and context.

When information is no longer required, it will be deleted, anonymised or otherwise handled in a manner considered appropriate and lawful, subject to technical constraints and any applicable preservation obligation.

08 / Security

Reasonable technical and organisational measures appropriate to the nature of the information and the service are intended to protect information against unauthorised access, alteration, loss or disclosure. No website, communication channel or electronic storage method can be guaranteed to be completely secure.

For a specific engagement, security controls, incident reporting, data handling, access rights and responsibilities should be defined in the written scope or agreement. Do not treat general statements on this website as a substitute for a project-specific security plan.

09 / Your Requests and Choices

You may contact us to ask about information you have submitted, request correction of inaccurate details, withdraw consent where processing is based on consent, or raise a privacy concern. Responses and available rights depend on the applicable law, the nature of the request, any provisions currently in force, and lawful record-retention requirements.

Requests should identify the relevant communication or engagement sufficiently for us to locate it. We may need to verify identity before acting on a request. We will not ask you to send a password or authentication secret to verify your identity.

For privacy requests or complaints, contact the proprietor through the Contact section of the official website. Any statutory grievance or response arrangements required for the applicable activity will be handled as required by law.

10 / Children’s Information

The website and services are not intended to invite children to disclose personal information unnecessarily. Where information relating to a child is involved in a service or enquiry, applicable legal requirements and appropriate safeguards must be considered before processing. Do not submit a child’s personal information through a public channel unless it is necessary and there is a lawful basis to do so.

11 / Changes to This Policy

This Policy may be updated when the website, services, data practices or applicable legal requirements change. The “Last updated” date at the top indicates the date of the latest published revision. Material changes should be reflected in the published text; where required, notice or consent will be handled in accordance with applicable law.

This page is a general disclosure of intended information-handling practices. It is not legal advice and does not replace review of the actual website configuration, service-provider terms or client-specific data-processing arrangements.