Privacy Notice

getBuckler Solutions Private Limited ("getBuckler Solutions", "we", "us") is a cybersecurity and compliance consultancy incorporated in India as a private limited company (CIN U74904PN2025PTC238133), with its registered office at SR No - 176, Suyog Space, Wakad, Pune, Maharashtra 411057, India. We are the controller (under the GDPR and UK GDPR) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for the personal data described in this notice.

Contact for all privacy matters: connect@getbuckler.com, or by post to the address above marked "Privacy".

We have not appointed a Data Protection Officer. Questions that would go to a DPO can be sent to the contact above.

• Enquiry and lead forms (contact, assessment booking, partner and landing-page forms): your name, work email, phone or WhatsApp number, company, role, country, the service you are interested in, your message and — if you choose to submit them — the answers and result of a self-assessment on this site.
• Correspondence: emails, calls and meeting notes when you contact us or we reply.
• Analytics data, only if you accept analytics cookies: pages viewed, referring site, approximate location (derived from a truncated IP address), device and browser type, and a pseudonymous analytics identifier.
• Technical data processed by our hosting provider to deliver the site securely: IP address, browser user-agent, requested URL and timestamps in server logs.

We may also receive business contact details (name, job title, company, work email or phone) from public professional sources, business-contact data providers, event organisers or partners who refer you to us. When we do, we tell you at our first contact and at the latest within one month.

We do not intend to collect special-category or sensitive personal data through this site. Please do not include it in form messages.

Where we rely on legitimate interests, we have balanced them against your rights; you can ask us for details. Under the DPDP Act we process your data on the basis of your consent, given when you submit a form, or for the legitimate uses the Act permits (such as where you have voluntarily provided the data for a specified purpose).

Giving us your details is voluntary and not a statutory or contractual requirement, but we cannot respond to an enquiry without contact details. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Self-assessment results are calculated in your browser for your information only.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

Service providers process data only on our instructions and under written contracts that require confidentiality and security.

We are based in India and use service providers in other countries, so your data may be processed outside the country where you are. India and the United States are not covered by an EU or UK adequacy decision.

For transfers of personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss amendments, where relevant), or on the recipient's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can request a copy of the relevant safeguards by emailing us.

Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies.

We may keep data longer where needed to comply with law or to establish, exercise or defend legal claims, and only for that purpose.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access restricted to staff who need it, multi-factor authentication on business systems, security headers on this site, and contractual security obligations on our service providers.

Depending on where you live, you have some or all of these rights:

• EU, UK and Switzerland: to access your data; to rectify it; to erase it; to restrict or object to its processing (including an absolute right to object to direct marketing); to data portability; and to withdraw consent at any time without affecting processing already carried out.
• India (DPDP Act, 2023): to obtain a summary of your data and processing; to correct, complete, update or erase it; to grievance redressal; to nominate another person to exercise your rights in the event of death or incapacity; and to withdraw consent as easily as you gave it.
• California and other US states with privacy laws: to know and access the personal information we hold; to delete or correct it; to opt out of sale, sharing or targeted advertising (we do none of these); to limit use of sensitive personal information (we collect none); and not to be discriminated against for exercising your rights.

How to exercise them:

• Email connect@getbuckler.com with the subject line "Privacy request", saying which right you want to exercise. You can also write to our postal address.
• We will verify your identity by confirming details you have given us — usually by replying from the email address we hold. We ask only for what we need to verify you and use it only for that.
• You may use an authorised agent. We will ask for signed permission from you and may still verify your identity directly.
• We respond within one month (EU/UK — extendable by two further months for complex requests, in which case we will tell you why), within 45 days (US states — extendable once by 45 days), and within the period set by the DPDP Rules for Indian requests. Requests are free unless manifestly unfounded or excessive.
• If we decline a request, we will explain why. US residents may appeal a decision by replying to it with the subject "Appeal"; we will answer within the period your state law requires.

You have the right to complain to a data protection authority — in the EU, the authority in your country of residence or work; in the UK, the Information Commissioner's Office (ico.org.uk); in India, the Data Protection Board of India, after first using our grievance process below. We would appreciate the chance to resolve your concern first.

Grievances about how we handle your personal data can be raised with our grievance officer at connect@getbuckler.com (subject "Grievance"). We will acknowledge your grievance promptly and resolve it within 90 days.

The table below lists the categories of personal information we collect, the sources, why we collect it and how long we keep it. We do not sell or share personal information, we do not collect sensitive personal information, and we do not knowingly collect information from anyone under 16.

We disclose these categories to the service providers listed under "Who we share it with", for the business purposes stated.

This site uses one strictly necessary item of browser storage and, only with your consent, Google Analytics cookies. See our Cookie Policy at getbuckler.com/cookie-policy for details and to change your choice.

This site is intended for business users. We do not knowingly collect personal data from children (under 18 in India, under 16 elsewhere). If you believe a child has provided us data, contact us and we will delete it.

We will update this notice when our practices or the law change. We will change the version number and date at the top, and for material changes we will give a prominent notice on this site.

• Version 1.0 — 29 September 2026: first published version.