1. Introduction

BOOTSTRAP PARADOX (OPC) PRIVATE LIMITED, operating under the brand name BPDoxS (“BPDoxS”, “we”, “our”, or “us”), respects your privacy and is committed to protecting personal information and confidential data entrusted to us.

This Privacy Policy explains how BPDoxS collects, uses, processes, stores, shares, and protects information obtained through:

• Our website: bpdoxs.com
• Business communications
• Cybersecurity consulting engagements
• Client projects
• Partnership discussions
• Vendor relationships
• Recruitment processes
• Conferences, meetings, and offline interactions
• Any other business interaction with BPDoxS

This Privacy Policy is designed to support compliance with the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) as the primary privacy framework applicable to our India operations, and with the European Union General Data Protection Regulation (GDPR) and UK GDPR where applicable to our EU/UK clients and individuals.

BPDoxS applies privacy principles designed to support transparency, accountability, confidentiality, responsible information management, and appropriate protection of personal information.

This Privacy Policy is intended to provide transparency regarding our data practices while allowing us to deliver cybersecurity, infrastructure, cloud, application security, consulting, and related professional services worldwide.

2. Company Information

Legal Entity Name:
BOOTSTRAP PARADOX (OPC) PRIVATE LIMITED

Brand Name:
BPDoxS

Registered Office Address:
#4, Friends Colony,
Patiala, Punjab 147001
India

Country of Incorporation:
India

Website:
bpdoxs.com

Contact Email:
info@bpdoxs.com

Privacy Requests Email:
info@bpdoxs.com

Accountable Executive:
Mohan Preet Singh Virk, Founder
mohan.virk@bpdoxs.com

Phone:
+91 7717571863

3. Scope of This Privacy Policy

This Privacy Policy applies to all personal information processed by BPDoxS, including information collected from:

Website Visitors

Information provided through:

• Contact forms
• Partnership forms
• Service enquiry forms
• Communication requests
• Newsletter or promotional communication, where applicable
• Website interactions

Clients and Prospective Clients

Information collected during:

• Sales discussions
• Business meetings
• Security assessments
• Contract negotiations
• Statements of Work
• Service delivery
• Technical consultations
• Project execution

Cybersecurity Engagements

During cybersecurity engagements, BPDoxS may process information provided by clients, including:

• Infrastructure information
• Security configurations
• System details
• Application information
• Logs and security events
• Technical documentation
• Business risk information
• Confidential operational information

The type and extent of information accessed depends on:

• Contractual agreements
• Defined project scope
• Client authorization
• Service requirements
• Security objectives

BPDoxS does not access client environments unless such access is authorized and required for the delivery of contracted services.

Partners and Vendors

Information collected during:

• Partnership applications
• Vendor onboarding
• Collaboration discussions
• Service delivery coordination
• Commercial agreements

Recruitment Applicants

Information collected during recruitment may include:

• Resume/CV information
• Professional background
• Employment history
• Skills and qualifications
• Interview information
• Background verification information

Employees and Contractors

BPDoxS may collect employee and contractor information necessary for employment and business operations, including:

• Full name
• Contact information
• Government identification documents
• Aadhaar and PAN details where legally required
• Bank account information
• Address information
• Emergency contact details
• Employment records
• Salary and compensation information
• Tax-related information
• Performance-related information

4. Our Role in Data Processing

Depending on the nature of interaction, BPDoxS may act as:

Data Controller / Fiduciary

Where BPDoxS determines:

• Why personal information is collected
• How information is used
• Business purposes for processing

Examples include:

• Website enquiries
• Recruitment
• Employee administration
• Partner communications
• Marketing activities

Data Processor / Service Provider

Where BPDoxS processes information on behalf of a client according to their instructions.

Examples include:

• Security monitoring
• Vulnerability assessments
• Incident response
• Cloud security services
• Infrastructure security projects

In such cases, the client remains responsible for determining the purpose and lawful basis of processing, while BPDoxS processes information according to contractual requirements and the applicable Client Data Processing Schedule.

Independent Service Provider

For certain advisory and consulting engagements, BPDoxS may independently process professional information necessary to provide expert recommendations, maintain business records, and fulfil contractual obligations.

5. Information We Collect

BPDoxS may collect the following categories of information:

5.1 Personal Identification Information

Including:

• Name
• Job title
• Organization name
• Professional role
• Contact details
• Business address
• Government identification information where required

5.2 Communication Information

Including:

• Email communications
• Phone conversations
• Meeting records
• Business correspondence
• Project discussions

5.3 Technical Information

Depending on services provided, this may include:

• IP addresses
• Browser information
• Device information
• Security logs
• System information
• Network information
• Cloud environment details

Technical information collected during client engagements is processed only according to agreed service requirements.

5.4 Business Information

Including:

• Company details
• Business requirements
• Security objectives
• Project documentation
• Contracts
• Purchase orders
• Billing information
• Service requirements

5.5 Financial Information

BPDoxS may process:

• Billing information
• Payment records
• Transaction details
• Invoice-related information

BPDoxS currently accepts payments through bank transfer.

5.6 Recruitment Information

Including:

• CV/resume details
• Education information
• Employment history
• Interview responses
• Verification information

6. Services and Data Processing Context

BPDoxS provides cybersecurity and technology services across the following areas:

Threat Detection & SOC

Including:

• SOC-as-a-Service
• Incident Response
• Vulnerability Assessment
• SOAR
• Managed EDR/XDR
• Threat Intelligence and Hunting

Infrastructure & Platform Security

Including:

• Infrastructure Hardening
• Secure Architecture
• IT Infrastructure Management
• Secure Network Infrastructure
• Linux Infrastructure Engineering
• Identity Access Management
• System Security Auditing
• Secure Infrastructure Migration

Cloud Infrastructure & Security

Including:

• Cloud Security
• Cloud Migration and Hardening
• Cloud Security Posture Management
• Secure Cloud Architecture
• Cloud Security Assessments
• Cloud Cost Optimization
• Cloud Readiness Evaluation

DevSecOps & Application Security

Including:

• Secure CI/CD Pipelines
• SAST
• Dependency Security Scanning
• Secure Code Review
• Secure Deployment Practices
• Supply Chain Security
• Build Pipeline Integrity

Cyber Resilience & Continuity

Including:

• Disaster Recovery
• Incident Response
• Data Loss Prevention
• Backup Architecture
• Business Continuity Planning
• High Availability Architecture
• Cyber Insurance Readiness

Cybersecurity Consulting & Advisory

Including:

• Cybersecurity Consultancy
• Security Awareness Training
• Compliance Readiness
• Risk Assessment
• Third-Party Risk Management
• Cybersecurity Maturity Assessment
• M&A Cybersecurity Due Diligence

7. How We Use Your Information

BPDoxS processes personal information only for legitimate business purposes, applicable contractual requirements, legal obligations, and to provide effective services.

The purposes for which we may use information include:

7.1 Providing Cybersecurity and Technology Services

We use information necessary to:

• Deliver cybersecurity services
• Perform security assessments
• Provide consulting and advisory services
• Monitor and analyse security environments where authorized
• Support incident response activities
• Improve infrastructure and application security
• Develop security recommendations
• Prepare technical reports and documentation

Where client environments or confidential information are accessed, processing is performed only within the agreed scope of services and contractual obligations.

7.2 Business Communication and Enquiries

We may use contact information to:

• Respond to enquiries
• Schedule meetings
• Provide requested information
• Discuss potential projects
• Coordinate business activities
• Maintain communication records

7.3 Contractual and Commercial Activities

Information may be processed for:

• Preparing proposals
• Negotiating agreements
• Managing contracts
• Processing purchase orders
• Providing invoices
• Maintaining service records
• Managing client relationships

7.4 Security and Risk Management

We may process information to:

• Protect our systems and services
• Detect fraudulent or unauthorized activity
• Maintain operational security
• Investigate security incidents
• Maintain business continuity
• Protect confidential information

7.5 Recruitment and Workforce Management

Employee and applicant information may be used for:

• Evaluating candidates
• Conducting interviews
• Performing background verification
• Managing employment relationships
• Payroll administration
• Compliance obligations
• Workforce planning

7.6 Marketing and Business Development

Where permitted by applicable laws, BPDoxS may use business contact information for:

• Sending service updates
• Sharing cybersecurity insights
• Providing relevant business communications
• Inviting users to events, webinars, or discussions

You may request removal from promotional communications at any time.

7.7 Improving Our Website and Services

We may analyse website usage information to:

• Understand visitor behaviour
• Improve website performance
• Improve user experience
• Measure marketing effectiveness
• Improve our services

8. Legal Basis for Processing Information

BPDoxS processes personal information on grounds that differ depending on whether Indian or EU/UK privacy law applies to you.

8.1 Consent

Where required, BPDoxS obtains your clear, affirmative consent before processing personal information.

Examples include:

• Marketing communications
• Optional website cookies
• Certain optional website interactions

You may withdraw consent at any time, as easily as you gave it, where applicable.

8.2 Legitimate Uses Under the DPDP Act — India

For individuals located in India, BPDoxS processes personal information under the specific legitimate uses recognized by Section 7 of the DPDP Act where applicable.

This may include information voluntarily provided to us for a specified purpose, such as when you submit a contact form or provide information for a particular business request.

Processing may also occur where specifically permitted under the DPDP Act, including processing necessary for our own employment purposes as an employer.

These legitimate uses are limited to the circumstances recognized by applicable law and do not constitute a general open-ended business-interest ground.

8.3 Legitimate Interests — EU/UK Only

For individuals in the European Union or United Kingdom, BPDoxS may rely on legitimate interests under Article 6(1)(f) of the GDPR or corresponding UK GDPR provisions for limited purposes, such as basic service improvement, fraud prevention, and maintaining secure business operations.

Where legitimate interests are relied upon, BPDoxS considers the impact of the processing on individual rights and maintains appropriate internal assessments where required.

This legal basis is not relied upon as a legal basis for processing personal data of Indian data subjects under the DPDP Act.

8.4 Contractual Necessity — EU/UK Only

For individuals in the EU/UK, BPDoxS may process personal information where necessary to perform a contract with you or to take steps at your request before entering into a contract, where permitted by applicable law.

For Indian data subjects, BPDoxS does not rely on a separate “contractual necessity” ground under the DPDP Act. Where applicable, processing necessary to deliver a requested service may instead be based on information voluntarily provided for a specified purpose under Section 7 of the DPDP Act or on consent.

8.5 Legal Obligations

BPDoxS may process information where processing is required by applicable:

• Tax laws
• Corporate laws
• Employment laws
• Regulatory requirements
• Court orders
• Government requirements
• Other applicable legal obligations

9. Cookies and Tracking Technologies

BPDoxS uses cookies and similar technologies to improve website functionality, analyse usage, and understand visitor interaction.

Cookies may include:

Essential Cookies

Required for:

• Website functionality
• Security features
• Basic operations

These cookies cannot generally be disabled where they are necessary for the website to function.

Analytics Cookies

BPDoxS may use:

• Google Analytics
• Google Tag Manager

These technologies may help us understand website usage and improve website performance.

Marketing Cookies

BPDoxS may use technologies such as:

• Meta Pixel
• Google Ads

These technologies may be used to measure marketing performance and understand campaign effectiveness.

9.1 Cookie Consent

BPDoxS uses a cookie consent banner that blocks non-essential cookies, including analytics and marketing cookies, until you actively accept them.

This consent mechanism applies to visitors regardless of location.

You may also manage cookies through:

• Browser settings
• Device preferences
• Cookie controls provided on our website

Disabling cookies may affect certain website functionality.

10. Third-Party Services and Data Sharing

BPDoxS does not sell personal information.

We may share information only where necessary for legitimate business purposes, service delivery, contractual requirements, or legal obligations.

10.1 Service Providers

We may engage trusted third-party providers for:

• Website hosting
• Analytics
• Communication systems
• Business operations
• Infrastructure services
• Customer relationship management
• Website form processing

Current service providers may include:

• Hostinger — website hosting
• Google services — analytics and business tools
• HubSpot — customer relationship management, where applicable
• Forminator — website form processing

Third-party providers are expected to process information according to applicable agreements and privacy requirements.

Where applicable, BPDoxS’s relationship with HubSpot is governed by HubSpot’s Data Processing Agreement, including applicable Standard Contractual Clauses for international transfers.

10.2 Client-Authorized Third Parties

During cybersecurity engagements, information may be shared with:

• Client-approved vendors
• Cloud providers
• Security technology providers
• Relevant stakeholders

only where required for service delivery and authorized under contractual arrangements.

10.3 Legal Requirements

BPDoxS may disclose information where required:

• By law
• By government authorities
• Through legal processes
• To protect rights, safety, or property

11. Client Confidential Information

BPDoxS understands that cybersecurity engagements may involve highly sensitive business and technical information.

Client information may include:

• Infrastructure details
• Security configurations
• Vulnerability information
• Network information
• Application details
• Internal documentation
• Business processes

BPDoxS handles such information according to:

• Contractual agreements
• Non-disclosure agreements (NDAs)
• Service agreements
• Applicable legal obligations

Access to client information is limited according to engagement requirements.

The specific handling procedures, technical controls, and operational practices used to protect client information may vary based on:

• Project scope
• Client requirements
• Risk assessment
• Contractual obligations

12. Access to Client Environments

As part of cybersecurity service delivery, BPDoxS may require authorized access to client environments.

Such access may include:

• Cloud platforms
• Applications
• Infrastructure systems
• Security tools
• Monitoring platforms

Access is provided only:

• With client authorization
• For defined business purposes
• During agreed engagement periods
• According to contractual terms

Clients remain responsible for granting appropriate permissions and defining access boundaries.

BPDoxS does not intentionally access client environments beyond the authorized scope.

13. International Operations and Data Transfers

BPDoxS is incorporated in India and provides services globally.

Personal information may be processed in India or other locations depending on:

• Service requirements
• Client agreements
• Third-party service providers
• Technical infrastructure

Where information is transferred internationally, BPDoxS seeks to ensure appropriate safeguards consistent with applicable privacy requirements.

For international clients, BPDoxS aims to support privacy principles and requirements applicable under:

• General Data Protection Regulation (GDPR)
• UK GDPR
• India Digital Personal Data Protection Act, 2023 (DPDP Act)
• Digital Personal Data Protection Rules, 2025
• Other applicable privacy regulations

14. Data Security and Protection

BPDoxS recognizes that protecting personal information and confidential business data is essential to maintaining trust with clients, partners, employees, and users.

We maintain appropriate technical and organizational measures designed to protect information against:

• Unauthorized access
• Accidental disclosure
• Misuse
• Loss
• Alteration
• Destruction
• Unauthorized processing

The specific security measures implemented by BPDoxS may vary depending on:

• The nature of information processed
• Business requirements
• Client contractual obligations
• Risk considerations
• Applicable legal requirements

Because cybersecurity practices must be adapted according to operational requirements and risk environments, BPDoxS does not publicly disclose internal security controls, architectures, or operational procedures that could compromise security.

15. Confidentiality Obligations

BPDoxS understands that clients and partners may provide confidential information during business engagements.

Confidential information may include:

• Business strategies
• Technical documentation
• Security assessments
• Infrastructure information
• Source code
• Application details
• Customer information
• Internal processes
• Commercial information

BPDoxS handles confidential information according to applicable agreements, including:

• Non-Disclosure Agreements (NDAs)
• Master Service Agreements (MSAs)
• Statements of Work (SOWs)
• Other contractual arrangements

Confidential information is used only for authorized business purposes and is not disclosed except where:

• Required to deliver contracted services
• Authorized by the information owner
• Required by applicable law

16. Data Breach Management

BPDoxS maintains a documented process intended to identify, assess, manage, contain, and respond to potential security incidents affecting information under our responsibility.

In the event of a suspected data breach, BPDoxS may:

• Investigate the nature and scope of the incident
• Take steps to contain and mitigate impact
• Assess affected information
• Implement corrective actions
• Notify affected parties where required by applicable laws or contractual obligations

Where applicable, BPDoxS will also comply with relevant incident reporting requirements, including applicable CERT-In reporting requirements, DPDP Board notification requirements, and, where applicable, the GDPR 72-hour supervisory authority notification requirement.

Where BPDoxS processes information on behalf of a client, notification and response activities will be handled according to:

• Client agreements
• Applicable data protection requirements
• Defined incident management procedures

17. Data Retention

BPDoxS retains information only for as long as necessary for legitimate business purposes, contractual obligations, legal requirements, dispute resolution, security purposes, and maintaining accurate business records.

Retention periods vary depending on the type of information.

17.1 Website and Business Enquiry Information

Website and business enquiry information, including lead information collected through contact forms and business enquiries, is generally retained for 24 months of inactivity, after which it is deleted, subject to applicable legal or contractual requirements.

17.2 Recruitment Information

Recruitment and candidate information is generally retained for 6 months from the hiring decision where the candidate is unsuccessful, after which it is deleted, subject to applicable legal requirements.

If a candidate is hired, relevant information becomes part of the employee record and is retained according to the employee and contractor retention period described below.

17.3 Employee and Contractor Records

Employee and contractor records are generally retained for the duration of employment or engagement and for 7 years after departure, after which they are securely deleted, subject to applicable legal, tax, regulatory, contractual, or dispute-related requirements.

17.4 Client Engagement Records

Client engagement records, including:

• Contracts
• Statements of Work
• Project documentation
• Technical records
• Billing information
• Engagement history

are retained for the duration of the business relationship and for a period afterward as required for legal, audit, business-continuity, contractual, and legitimate business purposes, as agreed in the relevant client contract.

18. Employee and Contractor Privacy

BPDoxS collects and processes employee and contractor information necessary for workforce management and business operations.

This may include:

• Identity information
• Contact details
• Government identification documents
• Aadhaar information where legally required
• PAN details
• Bank account information
• Address information
• Emergency contact details
• Employment agreements
• Compensation information
• Performance records
• Professional information

Such information is used for:

• Employment administration
• Payroll processing
• Legal compliance
• Workforce management
• Business operations
• Security and access management

Employee and contractor information is handled with appropriate confidentiality.

BPDoxS may provide employees and contractors with additional privacy information through a separate Employee Data Notice.

19. Recruitment Privacy

During recruitment, BPDoxS may collect information from candidates, including:

• Resume/CV
• Education details
• Work experience
• Technical skills
• Interview responses
• Professional references
• Background verification information

Recruitment information is used for:

• Candidate evaluation
• Hiring decisions
• Communication regarding opportunities
• Verification processes

Candidates may request information regarding their personal data or request deletion, subject to applicable legal requirements.

20. Privacy Rights and Choices

Your privacy rights depend on the privacy law applicable to you.

20.1 Rights Available to Everyone

Depending on applicable law, you may have the following rights:

Right to Access

You may request information regarding:

• Whether BPDoxS processes your personal information
• Categories of information processed
• Purposes of processing
• Relevant details about processing activities

Right to Correction

You may request correction of inaccurate or incomplete personal information.

Right to Deletion

You may request deletion of personal information where applicable, subject to legal, contractual, security, and other lawful retention requirements.

Right to Withdraw Consent

Where processing relies on consent, you may withdraw consent at any time.

Withdrawal does not affect processing already completed lawfully before withdrawal.

Right to Raise a Grievance

You may raise a complaint or grievance regarding how BPDoxS handles your personal information.

See Section 21 for information about submitting a request or complaint.

20.2 Additional Rights for Individuals in India

Where the DPDP Act applies, you may additionally have:

Right to Nomination

You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, subject to applicable legal requirements and procedures.

Right to Complain to the Data Protection Board of India

If you are not satisfied with BPDoxS’s response to your privacy request or grievance, you may have the right to complain to the Data Protection Board of India through the applicable designated process.

20.3 Additional Rights for Individuals in the EU/UK

Where the GDPR or UK GDPR applies, you may have additional rights, including:

• Restriction of processing in specified circumstances
• Objection to processing in specified circumstances
• Data portability
• The right to lodge a complaint with your local data protection supervisory authority

These rights are subject to applicable legal conditions and exemptions.

20.4 Marketing Preferences

You may opt out of promotional communications at any time by:

• Following unsubscribe instructions
• Contacting us directly

21. Exercising Your Privacy Rights

To submit a privacy request or complaint, you may use our Privacy Requests form:

bpdoxs.com/privacy-requests/

You may also contact:

Privacy Contact:
Mohan Preet Singh Virk, Founder
mohan.virk@bpdoxs.com

Please include:

• Your name
• Contact details
• Nature of request
• Relevant information needed to identify or verify your request

BPDoxS may verify your identity before processing requests to protect personal information from unauthorized access.

We aim to respond to valid privacy requests and complaints within 15 days, subject to applicable law and the nature and complexity of the request.

Complaints in India

If you are located in India and are not satisfied with our response, you may have the right to complain to the Data Protection Board of India through its designated complaint mechanism.

Information regarding the Board’s public complaint process will be provided or updated when the applicable mechanism becomes operational.

Complaints in the EU/UK

If the GDPR or UK GDPR applies to you, you may also lodge a complaint with the data protection supervisory authority in your country or jurisdiction.

22. Children’s Privacy

BPDoxS services are designed for businesses, organizations, and professional users.

We do not intentionally collect personal information from individuals under the age of 18.

If we become aware that information from a child has been collected unintentionally, we will take reasonable steps to review and address the situation.

23. Artificial Intelligence Usage

At the time of publication of this Privacy Policy, BPDoxS does not use artificial intelligence systems to process customer personal information or confidential client data.

If BPDoxS introduces AI-based technologies in the future, this Privacy Policy will be updated to explain:

• Purpose of use
• Type of information processed
• Applicable safeguards
• User rights where relevant

24. Compliance With Applicable Privacy Laws

BPDoxS operates from India and serves clients globally.

Our privacy practices are designed to comply with:

• India Digital Personal Data Protection Act, 2023 (DPDP Act)
• Digital Personal Data Protection Rules, 2025
• Information Technology Act, 2000
• European Union General Data Protection Regulation (GDPR)
• UK GDPR
• Other applicable privacy requirements based on the location of the individual concerned and the nature of the engagement

The rights and legal bases available to individuals may differ depending on which privacy regime applies, as described in Sections 8 and 20 of this Privacy Policy.

BPDoxS does not claim regulatory certification unless explicitly obtained and verified.

25. Third-Party Websites and External Links

The BPDoxS website may contain links to third-party websites, platforms, or resources.

These external websites may have their own:

• Privacy policies
• Cookie practices
• Data collection methods
• Terms of use

BPDoxS does not control and is not responsible for the privacy practices, security measures, or content of third-party websites.

We encourage users to review the privacy policies of any external websites before providing personal information.

26. Third-Party Platforms and Service Providers

BPDoxS may use third-party platforms and service providers to support business operations, including:

• Website hosting
• Analytics
• Customer relationship management
• Communication platforms
• Form processing
• Business administration tools

These providers may process limited information required to provide their services.

BPDoxS expects such providers to maintain appropriate privacy and security practices; however, each third-party provider remains responsible for its own processing activities under its applicable terms and policies.

27. Business Meetings and Offline Data Collection

BPDoxS may collect personal information through offline business activities, including:

• Industry conferences
• Networking events
• Business meetings
• Client discussions
• Partnership meetings
• Vendor interactions
• Business cards exchanged during professional interactions

Information collected through these activities may include:

• Name
• Organization
• Job title
• Email address
• Phone number
• Business requirements
• Professional interests

This information may be used for:

• Business communication
• Partnership discussions
• Service opportunities
• Maintaining professional relationships

Where required, individuals may request access, correction, or deletion of their information.

28. Client Engagement Privacy Terms

Cybersecurity services often require access to sensitive business environments and technical information.

The privacy obligations applicable to a specific client engagement may additionally be governed by:

• Master Service Agreements (MSA)
• Statements of Work (SOW)
• Non-Disclosure Agreements (NDA)
• Data Processing Agreements (DPA)
• Security requirements agreed with the client

Where these agreements provide additional privacy requirements, those contractual obligations will apply alongside this Privacy Policy.

29. Client Responsibilities

Clients engaging BPDoxS are responsible for ensuring that:

• They have appropriate authorization to provide information to BPDoxS
• They have lawful rights to share information required for service delivery
• Access provided to BPDoxS is properly authorized
• Sensitive information shared during engagements is necessary for the defined scope

Clients should avoid sharing unnecessary personal information unless required for the agreed services.

30. Security Testing and Assessment Information

During security assessments, penetration testing, vulnerability assessments, or related cybersecurity activities, BPDoxS may process information such as:

• Security findings
• Vulnerability details
• System configurations
• Application information
• Network information
• Technical evidence

Such information is considered confidential and is handled according to:

• Engagement agreements
• Client authorization
• Applicable security requirements

Security assessment information is not publicly disclosed without explicit authorization from the client unless legally required.

31. Intellectual Property and Confidential Materials

Information, documentation, methodologies, frameworks, reports, and materials created or provided by BPDoxS may contain proprietary information.

Unless otherwise agreed:

• Client confidential information remains the property of the client
• BPDoxS retains ownership of its proprietary methodologies, tools, frameworks, and internal processes

Any transfer of ownership or usage rights will be governed by contractual agreements.

32. Data Localization and Storage

BPDoxS primarily manages business information from India.

Information may be stored or processed through:

• Internal business systems
• Authorized service providers
• Client-approved platforms

The location of stored information may vary depending on:

• Service requirements
• Client agreements
• Technology providers used during engagements

Where applicable, BPDoxS considers regional privacy requirements relating to data storage and international transfers.

33. Changes to This Privacy Policy

BPDoxS may update this Privacy Policy periodically to reflect:

• Changes in business operations
• New services
• Legal requirements
• Regulatory developments
• Improvements in privacy practices

When significant changes are made, BPDoxS may update:

• The “Last Updated” date
• Website notifications where appropriate
• Relevant communication channels

Users are encouraged to review this Privacy Policy periodically.

34. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India.

Any disputes relating to this Privacy Policy or the processing of information by BPDoxS shall be subject to the jurisdiction of courts located in Punjab, India.

For international users and clients, mandatory privacy rights under applicable local laws continue to apply where relevant.

35. No Security Guarantee Disclaimer

While BPDoxS takes reasonable measures to protect information, no method of electronic storage, transmission, or processing can be guaranteed to be completely secure.

BPDoxS continuously evaluates and improves its privacy and security practices based on:

• Business requirements
• Risk considerations
• Industry practices
• Applicable obligations

36. Contact Us

If you have questions, concerns, requests, or complaints regarding this Privacy Policy or the handling of personal information, you may contact:

BOOTSTRAP PARADOX (OPC) PRIVATE LIMITED

Brand:
BPDoxS

Registered Address:
#4, Friends Colony,
Patiala, Punjab 147001
India

Privacy Contact:
Mohan Preet Singh Virk, Founder
mohan.virk@bpdoxs.com

General Support Email:
info@bpdoxs.com

Phone:
+91 7717571863

Website:
bpdoxs.com

Privacy Requests:
bpdoxs.com/privacy-requests/

37. Commitment Statement

At BPDoxS, trust is the foundation of every relationship.

As a cybersecurity organization, we understand that responsible handling of information is not only a legal requirement but a professional responsibility.

We are committed to maintaining transparency, respecting privacy rights, protecting confidential information, and handling data responsibly across every interaction with our clients, partners, employees, and stakeholders.