Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data HanulX Private Limited ("HanulSec", "we", "us") collects through hanulsec.com, why we collect it, and the choices you have. HanulSec is a brand of HanulX Private Limited, a company registered in India. We process personal data in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and, where it applies to you, the EU General Data Protection Regulation ("GDPR").

1. What we collect

• Quote requests. When you use the "Request a quote" form we collect your name, work email, company, phone number (optional), the services you are interested in, details about your environment and compliance needs, and anything you write in the message box.
• Emails you send us. If you write to hello@, ir@ or security@hanulsec.com we receive your email address, the content of your message and any attachments.
• Technical data. Our hosting provider records standard server logs, such as your IP address, browser type, the page requested and the time of the request. These logs are used for security and to keep the site running.

We do not use advertising cookies, analytics trackers or social media pixels. We do not knowingly collect sensitive personal data through this website, and we ask that you do not send passwords, credentials or regulated data through the quote form.

2. Why we use it

• To reply to your quote request, scope the work and prepare a proposal.
• To respond to security incidents and vulnerability reports you send us.
• To protect the website and our systems from abuse, fraud and attack.
• To meet our legal, tax and regulatory obligations.

We process your data on the basis of the consent you give when you submit the form or email us, and for the legitimate uses permitted by Section 7 of the DPDP Act (such as complying with law and responding to emergencies). Where the GDPR applies, our legal bases are consent, steps taken at your request before entering into a contract, our legitimate interests in securing our services, and legal obligations.

3. Who we share it with

We do not sell or rent personal data. We share it only with:

• Service providers that run our infrastructure, such as our web hosting and business email provider (Hostinger), under contracts that require them to protect it.
• Google Fonts, which delivers the typefaces on this site and therefore receives your IP address when the page loads.
• Authorities, including CERT-In, where Indian law requires us to report or disclose information.
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.

Some providers may store data outside India. When that happens we rely on transfers permitted under the DPDP Act and, for GDPR data, on appropriate safeguards such as standard contractual clauses.

4. How long we keep it

• Quote requests and related emails: up to 24 months after our last contact, unless they turn into an engagement.
• Client engagement records: for the length of the contract and up to 8 years afterwards, as required for accounting and tax records under Indian law.
• Server and security logs: up to 180 days, in line with CERT-In directions.

5. How we protect it

The site is served only over HTTPS with strict security headers. Access to inboxes and client records is limited to the people who need it and protected with strong authentication. Client engagement data is handled under a mutual NDA and the security terms of each contract. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

6. Your rights

You can ask us to:

• Tell you what personal data we hold about you and how we use it.
• Correct, complete or update your data.
• Erase your data when it is no longer needed for the purpose it was collected for.
• Withdraw your consent at any time. This does not affect what we did before you withdrew it.
• Nominate another person to exercise your rights if you die or become incapacitated.

To use any of these rights, email hello@hanulsec.com. We will reply within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EU or UK, you may also complain to your local data protection authority.

7. Children

This website is meant for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, contact us and we will delete it.

8. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. Significant changes will be highlighted on this page.