B-52 Privacy Policy

This Privacy Policy explains what personal data Security Brigade InfoSec Private Limited ("Security Brigade", "we", "us" or "our") collects through b52security.com and when you buy B-52 from us, why we collect it, who we share it with, where we keep it, and the rights you have over it.

B-52 is a product of Security Brigade InfoSec Private Limited. It is not a separate legal entity.

1. Who we are

Security Brigade InfoSec Private Limited is a company incorporated in India (CIN U74999MH2011PTC217821), with its registered office at A 2604, Lodha Adrina, Lodha Park, Opp. Hard Rock Cafe, Pandurang Budhkar Marg, Worli, Mumbai 400013, Maharashtra, India.

For the personal data described in this policy, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"): we decide why and how it is processed. Where the EU or UK General Data Protection Regulation ("GDPR") applies, we are the controller.

To ask about this policy, to exercise your rights or to raise a grievance, write to our Grievance Officer at privacy@securitybrigade.com or call +91-022-41642220 (section 10).

2. What this policy covers

This policy covers personal data we collect:

• when you visit b52security.com;
• when you send an enquiry or ask for a walkthrough;
• when you use the pricing wizard, save a quote or ask for a quotation;
• when you place an order, pay for it and are invoiced; and
• when you write to us about any of these.

It does not cover personal data we process for a customer while delivering B-52: the authorised scope, the information the targets disclose, the evidence for each finding, credentials issued for testing, and the accounts of the customer's people on the B-52 platform. For that data the customer is the Data Fiduciary and we are its Data Processor, and the B-52 Data Processing Agreement ("DPA") governs it. The one exception is our use of anonymised engagement material to improve the platform: we decide that purpose (DPA sections 2.2 and 3.10(d)), and the customer can exclude its material from that use at any time (DPA section 3.11). Billing and order details we keep as the seller, for invoicing and our accounts, are covered by this policy.

3. What we collect and why

3.1 Enquiries and walkthrough requests

What we collect. Your name, work email address and company; your job title and phone number, if you give them; what you want tested, the delivery model and timing you choose, and your message. With it we record the page that sent you to the form, the first page of your visit, the site that referred you and any campaign tags in the link you followed. Our server adds your browser's user agent, and the notice our sales team receives also shows your IP address.

Why. To reply to your enquiry, scope the work and price it; to see which of our pages and campaigns bring enquiries; and to help our sales team spot automated submissions.

3.2 The pricing wizard, quotes and quotations

What we collect. The assessment you configure and the price the wizard shows. To save a quote or ask for one, the contact details you enter: your name, work email address, organisation, phone number and billing country. Details about your organisation (its size, headquarters country, industry or regulator, the regions it operates in and your timing), if you give them. If you are billed in India, your GSTIN, if you give it. For a formal quotation, or a quote you download or have emailed, your purchase order number and billing address, if you give them. Any brief you write for a red-team or other bespoke request. With it we record the page and campaign that brought you, the country your request came from (as Cloudflare reports it), and your Google Analytics identifiers, if your browser holds them.

Why. To show the price in the right currency; to prepare and send the quote or quotation you ask for, with your GSTIN on it where you give one; to follow up your request; and to keep a record of what we quoted.

3.3 Orders and payments

What we collect. Your work email address, organisation, billing country and phone number, and your GSTIN if you are billed in India and give it; the order, its amount, and how and when it was paid. Your card or UPI details are entered in Razorpay's checkout and never reach our servers (section 7).

Why. To take payment, confirm your order and email you an order confirmation; to raise your tax invoice; to deliver the service; to handle cancellations, refunds and payment disputes; and to meet our tax and accounting obligations.

3.4 Emails with us

What we collect. Your emails to us, our replies and what they contain.

Why. To answer you, and to keep a record of what we agreed.

3.5 Search on this site

What we collect. What you type into the search box, and the result you open, if any. Your browser keeps a random identifier for search, which we store only in a coded form that changes every day. We do not store your IP address with a search.

Why. To return results, to improve them, and to find what people look for on this site and cannot find.

3.6 Every visit

What we collect. Cloudflare handles your IP address and the requests your browser makes in order to deliver and protect this site (section 5). Our server records page-speed measurements with the page address, your device and connection type and the country your visit came from, without your IP address and without a cookie. If an error occurs in your browser, the error, the page address, your browser's user agent and a short record of what happened on the page just before it are sent to an error-tracking system we host ourselves. Analytics are covered in section 6.

Why. To deliver this site, to keep it fast and working, and to protect it from attack.

You do not have to give us any of this. Without your contact details, though, we cannot reply to you, send you a quote or take an order. We do not sell personal data.

4. Our basis for using it

Under the DPDP Act we use personal data on one of two grounds:

• Your consent (Section 6). The enquiry and walkthrough forms ask for it, and the cookie banner asks for it before analytics cookies are set. You can withdraw consent at any time (section 10), and withdrawing does not affect what we did before.
• The purpose you gave it to us for (Section 7(a)). For example, we use the details you enter to get a quote to prepare and send that quote.

Where the GDPR applies, we rely on performing a contract with you or taking the steps you ask for before one (quotes, orders and delivery); on our legitimate interests in answering enquiries, understanding which pages and campaigns work, and keeping this site secure; on your consent, for analytics cookies; and on our legal obligations, for tax and accounting records.

5. Who we share it with

We share personal data only as this section describes.

Service providers. These providers handle personal data to provide their services to us:

• Cloudflare, Inc. delivers this website and protects it and our API (DNS, content delivery and firewall), and counts page views without cookies. It handles your IP address and the requests your browser makes to this site and to our API, including what you send in a form.
• Google LLC provides Google Analytics, our website analytics (section 6). It handles the pages you view and what you do on them, your device and browser, the site that referred you, and the enquiry and payment events our server sends.
• SendGrid (Twilio Inc.) sends the emails this website triggers: notices to our sales team, and your saved quotes, quotations, bank transfer and wire instructions, instalment links and order confirmations. It handles the contents of those emails.
• Microsoft Corporation provides Microsoft 365: our email, and the Microsoft Teams channel where our sales team is told about enquiries, quotes and orders. It handles those details and our emails with you.
• Razorpay Software Private Limited handles payments: card and UPI checkout, bank transfer to an account number created for your order, payment links for instalments, and refunds. It handles your name, email address and phone number, your organisation, billing country, GSTIN and order reference, and the payment details you enter in its checkout.

Others. We also share personal data with:

• banks, when you pay by bank transfer or international wire, or when we refund you;
• Razorpay or your bank in a payment dispute, as our Cancellation and Refund Policy describes;
• our auditors and professional advisers, where their work needs it; and
• government, regulatory or law-enforcement authorities, where the law requires us to.

Our database, our error tracking and our backups run on systems that Security Brigade administers itself.

6. Cookies, analytics and browser storage

This website asks for your choice before it sets any analytics cookie. The banner offers "Reject non-essential" and "Accept all".

Before you choose, and if you reject. This site sets no cookies, apart from the security cookie Cloudflare may set, described below. Google Analytics runs in Google's consent mode with storage denied, so Google receives page views and events without a cookie. Cloudflare Web Analytics counts page views without cookies, whatever you choose.

If you choose "Accept all". Google Analytics sets two cookies, _ga and _ga_NFSPH0Y9P7, which tell visitors and visits apart and last up to two years. Your choice also signals to Google your consent to advertising storage, to the use of this data for advertising, and to ad personalisation.

Your choice is kept in your browser's local storage. To change it at any time, use Cookie settings in the footer of any page, and the banner asks again.

Events from our server. When you submit a form, our server also records the enquiry in Google Analytics, so that we can count enquiries. The event carries the form, the first page of your visit (with any campaign tags in its address), the page that sent you to the form (or, if none is recorded, the service you chose), this site's name and, if an AI assistant referred you, which one. When an order is paid, our server also records the payment in Google Analytics: the order reference, the amount before tax, the tax and the currency, the payment reference, what was bought (the type of target, the term and the delivery model) and this site's name. Both happen whether or not you accepted analytics cookies. Each event is linked to your Google Analytics identifier, if your browser held one when you sent the form, asked for the quote or placed the order, and otherwise to a pseudonymous identifier derived from your email address. None of the analytics events this site sends carries the contact details you type into a form.

Browser storage that is not a cookie. For the length of your visit, your browser's session storage keeps the first page of your visit, the site that referred you and any campaign tags, which reach us only if you submit a form. It also keeps the pricing wizard's progress: your answers, your step and your quote or order reference, never your contact details. If you use search, your browser's local storage keeps a random search identifier and your recent searches on this site.

Cloudflare may set a cookie of its own if it has to check that a visitor is not automated. That cookie is used only for security.

7. Payments

Card and UPI payments are made in Razorpay's checkout. You enter your card or UPI details there, not on our website, and they never reach our servers. A bank transfer in India goes either to an account number Razorpay creates for your order or, if you pay against a quotation, to our bank account shown on it. An international wire goes to our bank. For each order we keep its payment reference (for a bank transfer or wire, the bank's own reference), amount, method and status, and the tax invoice we raise. For a transfer to an account Razorpay created, we also keep the name and bank branch code (IFSC) of the account that paid, as Razorpay reports them.

8. Where your data is kept and how we protect it

What you send us through this website is stored in a database on a server in India that Security Brigade administers. The database cannot be reached from the internet, and the server receives web traffic through Cloudflare. The database is backed up every night, and each backup is encrypted before it leaves the server and is kept on a separate storage server in India, also administered by Security Brigade.

Your browser connects to this site and to our API over HTTPS, so what you send is encrypted on the way.

Cloudflare delivers this site from its global network, and Google, Twilio and Microsoft are based outside India, so information they handle for us can be processed outside India. We use them as the DPDP Act permits, and we do not transfer personal data to any country the Government of India restricts under Section 16 of the Act.

9. How long we keep it

We keep personal data for as long as we need it to provide the service, and to meet our legal, tax and accounting obligations. Search records are deleted from our database after 180 days.

When you ask us to erase your data, we erase what the law does not oblige us to keep. Tax invoices and accounting records are kept for as long as Indian law requires them (Section 8(7) of the DPDP Act).

10. Your rights

We give you the rights the DPDP Act provides:

• to access: a summary of the personal data we hold about you, what we do with it, and who we have shared it with (Section 11);
• to correction and erasure: to have your personal data corrected, completed or updated, and to have it erased once we no longer need it, unless the law obliges us to keep it (Section 12);
• to withdraw consent at any time (Section 6);
• to grievance redressal: to have a complaint about how we handle your personal data dealt with by us (Section 13); and
• to nominate someone to exercise these rights if you die or cannot exercise them yourself (Section 14).

Where the GDPR applies to you, you also have the rights it gives you, including to restrict or object to processing and to data portability.

To exercise a right or raise a grievance, write to our Grievance Officer at privacy@securitybrigade.com. We may ask you to confirm your identity first. We acknowledge a grievance within 48 hours and resolve it within one month of receiving it. We deal with a request to exercise any other right within the period the law prescribes.

If you are not satisfied with our response, you can complain to the Data Protection Board of India once the Act's complaint provisions are in force. If you are in the European Union or the United Kingdom, you can also complain to your data-protection authority.

11. Children

B-52 is sold to organisations, and this website is not meant for children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@securitybrigade.com and we will delete it.

12. Changes to this policy

We may update this policy. We post the revised policy on this page with a new "Last updated" date.

13. Contact

Security Brigade InfoSec Private Limited

• Registered and operating office: A 2604, Lodha Adrina, Lodha Park, Opp. Hard Rock Cafe, Pandurang Budhkar Marg, Worli, Mumbai 400013, Maharashtra, India
• Phone: +91-022-41642220
• Grievance Officer (privacy requests and grievances): privacy@securitybrigade.com
• B-52 orders and refunds: sales@securitybrigade.com

---

End of B-52 Privacy Policy v1.0 · Effective 2026-11-01 · Last updated 2026-11-01