Privacy Policy

1. Company Identity & Data Fiduciary

Under the Digital Personal Data Protection Act, 2023, the Data Fiduciary responsible for determining the purpose and means of processing your personal data is:

2. Personal Information We Collect

We only collect personal information that is directly necessary to process your inquiries and evaluate applications. Depending on how you interact with us, we collect:

• Contact & General Inquiries: Full Name, Contact Number (Phone/WhatsApp), Email Address, Inquiry Category (e.g., Course Admission, Corporate Training), and the specific inquiry message or questions you submit.
• Internship Applications: Full Name, Contact Number, Email Address, College / University Name, Academic Standing / Degree Status (e.g., 3rd Year, Final Year, Graduate), Preferred Internship Track (e.g., SOC Analyst, Offensive Security, DFIR, GRC, Cloud Security), Resume/Curriculum Vitae details (if submitted), and mentorship evaluation feedback.
• Technical & Session Telemetry: Essential server connection data including IP address (used solely for rate-limiting, firewall threat detection, and defense against brute force attacks), timestamp, and browser user agent.

3. Purpose of Collection & How Data Is Used

Your personal data is collected and processed exclusively for specified, lawful, and legitimate purposes for which you provide explicit consent:

• To respond directly to your course inquiries, provide syllabus information, and schedule admissions counseling.
• To evaluate your technical readiness for cybersecurity internship tracks, schedule screening tests or interviews, and communicate admissions decisions.
• To provide ISO 27001-standard accredited certificates and Letters of Recommendation (LOR) upon program completion.
• To maintain an auditable consent record verifying compliance with the Digital Personal Data Protection Act, 2023.
• To safeguard our website and network systems against denial-of-service, automated scraping, and unauthorized malicious intrusions.

We do not engage in automated profiling or behavioral cross-site advertising, and we will never use your contact details for unrelated third-party marketing.

4. Data Storage, Retention & Deletion

We practice strict data minimization. Your personal data is kept only for as long as necessary to fulfill the purpose for which it was gathered:

• General Inquiries: Retained for [RETENTION PERIOD - e.g., 12 months] following inquiry resolution, after which records are permanently deleted or irreversibly anonymized.
• Internship Applications: Retained for the active duration of the evaluation and training cycle ([RETENTION PERIOD - e.g., 24 months] for academic record verification) or until the applicant requests deletion.
• Consent Audit Records: Stored separately from personal lead data, retaining only reference identifiers, timestamps, and policy versions to establish lawful processing compliance.

5. Security Safeguards

As a cybersecurity institute holding ISO 27001 credentials, we maintain rigorous technical and organizational measures to safeguard your personal data:

• Encryption in Transit: 100% of website communication and form submissions are transmitted over secure TLS 1.3 / HTTPS channels.
• Access Control: Access to inquiry data is restricted strictly to designated admissions coordinators on a need-to-know basis with multi-factor authentication.
• Server Hardening: Routine system audits, firewall rate-limiting, and sanitized input validation to prevent SQL injection, cross-site scripting (XSS), and data leakage.

6. Third-Party Service Providers (Data Processors)

We do not sell, rent, or trade your personal data. To deliver reliable digital services, we engage vetted service providers who act as Data Processors bound by contractual confidentiality:

• Email Delivery Services: Transactional email gateways ([THIRD-PARTY PROVIDERS - e.g., Google Workspace / SMTP Server]) for routing inquiries to our admissions desk.
• Hosting Infrastructure: Dedicated secure web infrastructure located in compliant facilities ([THIRD-PARTY PROVIDERS - e.g., Cloud Hosting Provider]).

7. Your Rights under the DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you enjoy statutory rights regarding your personal data:

8. How to Withdraw Your Consent

Consent given for the collection and processing of your personal data may be withdrawn at any time through a straightforward, cost-free procedure:

Send an email to Info@h2infosec.com or [PRIVACY CONTACT EMAIL] with the subject line "Withdrawal of Consent - DPDP", quoting your unique Submission Reference ID (provided upon form completion).

Upon receipt of your verified request, we will stop processing your personal data within the statutory timeframe, unless retention is mandated by law. Note that withdrawal does not affect the legality of any processing carried out prior to withdrawal.

9. Cookies & Website Analytics

Our website uses minimal, strictly essential technical cookies necessary for session security and form submission verification. We do not deploy third-party advertising cookies, cross-device trackers, or invasive data brokers.

10. Privacy & Grievance Officer Contact

For privacy-related inquiries, exercise of data rights, or complaints under the Digital Personal Data Protection Act, please contact our designated Grievance Officer: