Version 2026-10-07 · Applies to https://www.dravincon.com
1. Who we are
Dravincon, a unit of Dravin Empire Pvt Ltd ("we", "us"), is the Data Fiduciary for personal data collected through this website. Address: Dravin Empire Pvt Ltd, Jubilee Clio, Office Space 07, 2nd Floor, Industrial Area, Sector 75, Mohali, Punjab 140308.
For personal data we handle while delivering services to our clients (for example during a penetration test), the client's contract with us governs, and we usually act as a Data Processor on the client's instructions.
2. What we collect, why, and for how long
We only collect what you choose to give us through a form, for the specific purpose shown next to that form. Every form shows a short notice and asks for your consent with an unticked box before anything is sent.
| Where | Personal data | Purpose | Basis | Kept for |
|---|---|---|---|---|
| Enquiry / contact form | Name, work email, company, phone (optional), service of interest, message | Reply to your enquiry; prepare a proposal if you ask | Consent | Up to 12 months |
| DPDP readiness check | Nothing — answers stay in your browser. If you request the report: name, email, company, phone (optional) and your quiz answers | Prepare and discuss your gap report | Consent | Up to 12 months |
| Website assessment tool | The domain you scan (not stored). If you request a quote: name, email, company, phone (optional), domain and grade | Prepare a VAPT quote | Consent | Up to 12 months |
| Whitepaper download | Name, email, company | Give you the document; follow up if you asked | Consent | Up to 12 months |
| E-waste pickup | Name, email, company, phone (optional), message | Schedule and coordinate collection | Consent | Up to 12 months |
| Data-rights request | Name, email, request type and details | Act on your request and show we did | Legal obligation | Up to 12 months, or longer only if required by law |
| Security advisories (optional) | Email address | Send occasional security emails | Separate, optional consent | Until you unsubscribe |
| Security & server logs | IP address, browser type, pages requested, time | Keep the site secure, detect abuse, investigate incidents | Legitimate use / legal obligation | At least 1 year, as required by the DPDP Rules, 2025 and CERT-In directions, then deleted |
For each consent we keep a record of what you agreed to, the notice version and the time — this is how we prove consent, as the law requires. To prevent abuse we store a one-way hashed form of your IP address with that record and for rate limiting; we never store your raw IP address with your form data.
3. What we don't do
- No advertising, tracking or social-media pixels.
- No third-party fonts, scripts or CDNs — your browser only talks to our server.
- No selling or renting of personal data, ever.
- No profiling or automated decisions about you.
- No analytics unless you opt in through "Privacy choices" — and currently we run none.
4. Cookies and browser storage
Visitors get no cookies. We store your privacy choice in your browser's local storage, and two short-lived flags (whether you have seen the intro animation and closed the alerts bar) in session storage. Details: Cookies & storage.
5. Who we share it with
Only with service providers that help us run this website and email, acting as our Data Processors under contract (our web-hosting and email providers), and with authorities when the law requires it (for example CERT-In or a court). We require processors to protect personal data with safeguards equivalent to ours and to delete it when no longer needed.
If personal data is processed outside India by a provider, we do so only as permitted under Section 16 of the DPDP Act.
6. How we protect it
HTTPS on every page; form data encrypted at rest with AES-256-GCM; access restricted to authorised staff with strong authentication; logging and monitoring; strict security headers including a Content-Security-Policy; and automatic deletion when the retention period ends. We test our own website the way we test our clients'.
7. Your rights
Under the DPDP Act, 2023 you can:
- Withdraw consent at any time — as easily as you gave it. This doesn't affect processing done before withdrawal.
- Access a summary of your personal data we process and who we've shared it with.
- Correct, complete, update or erase your personal data.
- Raise a grievance with us, and if not satisfied, complain to the Data Protection Board of India.
- Nominate someone to exercise your rights if you die or become incapacitated.
Use the Your Data Rights form or email privacy@dravincon.com. We'll verify your identity, respond as quickly as we can, and resolve grievances within the period set by the DPDP Rules (no more than 90 days).
8. If something goes wrong
If a personal data breach affects you, we will inform you and the Data Protection Board without delay, explaining what happened, the likely impact and what we're doing about it, as the DPDP Rules require.
9. Children
This website is meant for businesses and is not directed at anyone under 18. We don't knowingly collect children's personal data; if you believe we have, contact us and we'll delete it.
10. Contact & Grievance Officer
Grievance Officer
Dravin Empire Pvt Ltd, Jubilee Clio, Office Space 07, 2nd Floor, Industrial Area, Sector 75, Mohali, Punjab 140308
Email: privacy@dravincon.com
This notice is available in English and Hindi below. If you need it in another language listed in the Eighth Schedule to the Constitution, ask us.
We'll update this notice when our practices change and change the version number above. Material changes affecting consent will be brought to your attention.
गोपनीयता सूचना — हिंदी सारांश
हम कौन हैं: ड्राविनकॉन (Dravin Empire Pvt Ltd की इकाई) इस वेबसाइट पर एकत्र किए गए व्यक्तिगत डेटा के लिए डेटा फ़िड्यूशियरी है।
हम क्या एकत्र करते हैं: केवल वही जानकारी जो आप किसी फ़ॉर्म में स्वयं देते हैं — जैसे नाम, ईमेल, कंपनी, फ़ोन (वैकल्पिक) और संदेश — और केवल उसी उद्देश्य के लिए जो फ़ॉर्म के पास लिखा है, जैसे आपकी पूछताछ का उत्तर देना।
सहमति: हर फ़ॉर्म पर बिना टिक किया हुआ सहमति बॉक्स है। मार्केटिंग ईमेल के लिए अलग, वैकल्पिक सहमति है। आप किसी भी समय उतनी ही आसानी से सहमति वापस ले सकते हैं।
अवधि: फ़ॉर्म का डेटा अधिकतम 12 महीने तक एन्क्रिप्टेड रूप में रखा जाता है, फिर अपने-आप हटा दिया जाता है। सुरक्षा लॉग कानून के अनुसार कम से कम एक वर्ष तक रखे जाते हैं।
हम क्या नहीं करते: कोई विज्ञापन या ट्रैकिंग कुकी नहीं, कोई तृतीय-पक्ष स्क्रिप्ट नहीं, और आपका डेटा कभी बेचा नहीं जाता।
आपके अधिकार: अपने डेटा का सारांश प्राप्त करना, सुधार, अद्यतन या मिटाना, सहमति वापस लेना, शिकायत दर्ज करना और नामांकन करना। संतुष्ट न होने पर आप भारत के डेटा संरक्षण बोर्ड से शिकायत कर सकते हैं।
संपर्क (शिकायत अधिकारी): privacy@dravincon.com · डेटा अधिकार फ़ॉर्म