FUTRSEC Privacy Policy

Under Rule 3 of India’s Digital Personal Data Protection Act 2023, this plain-language summary explains how FUTRSEC handles your personal information in concise, jargon-free terms before the complete legal provisions below.

1. Data Fiduciary Identity & Scope

FUTRSEC is developed and operated by BCBUZZ Technologies Private Limited, an incorporated company registered under the laws of India, in technical collaboration with Cybervault Innovations Pte Ltd, Singapore (collectively referred to as "FUTRSEC", "we", "us", or "our").

We act as a Data Fiduciary under Section 2(i) of the Digital Personal Data Protection (DPDP) Act 2023. This Privacy Policy applies to all users ("Data Principals") accessing our mobile application (Google Play: com.futrsec.app) and web portal (https://futrsec.in).

2. Personal Data We Collect & Access

We collect and process personal data strictly necessary to deliver cybersecurity learning modules, interactive CTF lab environments, automated skill assessments, and recruitment placement matching:

Device Permissions Disclosed:

• Storage / Media Access (Optional): Required solely when you choose to upload a resume file (PDF), submit practical lab reports, or upload a profile picture. We do not scan or access your device's external storage without explicit user-initiated selection.
• Network / Internet: Required to communicate with our secure backend API, stream cybersecurity learning content, and interact with lab virtual machines.
• Notifications (Optional): Required to send real-time alerts for live webinars, assessment deadlines, and job application status updates (can be disabled anytime in device settings).

3. Purposes & Legal Basis of Processing

We process personal data based on your freely given, specific, informed, and unambiguous consent under Section 6 of the DPDP Act 2023, for the following purposes:

• Providing interactive cybersecurity training, virtual lab sandboxes, and AI tutor assistance.
• Evaluating technical skills and generating verifiable benchmark scores and certificates.
• Connecting certified candidates with prospective employers and Training & Placement Officers (TPO) only upon explicit affirmative opt-in.
• Maintaining audit logs and cryptographic records of consent per statutory regulations.
• Protecting the security and integrity of our platform against malicious attacks or cheating.

4. Third-Party Data Processors & Sharing

We do not sell, rent, or trade your personal data to third parties for advertising or unauthorized commercial purposes. Data is shared exclusively with verified Data Processors under strict confidentiality and security agreements:

• Cloud & Database Infrastructure: Microsoft Azure & AWS (enterprise cloud hosting with end-to-end encryption in transit and at rest).
• Payment Gateway: Razorpay (PCI-DSS Level 1 compliant gateway for processing subscription payments; FUTRSEC does not store raw credit card numbers or banking PINs).
• Communication Channels: Transactional SMS, Email, and WhatsApp OTP verification providers (Twilio, Gupshup, Nodemailer).
• Hiring Partners / Recruiters: Candidate profiles and talent scores are shared with registered corporate recruiters strictly upon explicit student application or affirmative consent.

5. Data Retention & Account Deletion (Google Play Compliance)

We retain personal data only as long as necessary to fulfill the educational and certification purposes for which it was collected, or as required by applicable laws.

6. Statutory Rights under DPDP Act 2023

As a Data Principal under India's Digital Personal Data Protection Act 2023, you have the following enforceable rights:

• Right to Access (§11): Request a summary of personal data processed and processing activities.
• Right to Correction & Erasure (§12): Request rectification of inaccurate data and deletion of data upon withdrawal of consent.
• Right to Grievance Redressal (§13): Right to have privacy complaints acknowledged within 48 hours and resolved within 30 days (statutory maximum of 90 days under DPDP Act §13). Unresolved grievances may be escalated to the Data Protection Board of India (DPBI) via its designated digital portal (DPDPA Rules 3(b) & 19).
• Right to Nominate (§14): Nominate an individual to exercise data rights in the event of death or incapacity. Nominations may be submitted directly to our Data Protection Officer at dpo@futrsec.in or through the Privacy Portal at /privacy.

6b. Right to Nominate Procedure (DPDP Act §14)

Under Section 14 of the Digital Personal Data Protection Act 2023, you have the right to nominate an individual to exercise your data principal rights in the event of death or permanent incapacity.

Actionable Submission Channel: To register a nominee, submit an email to our Data Protection Officer at dpo@futrsec.in or initiate via the Privacy Portal at /privacy with the following details:

• Data Principal Registered Account Email
• Nominee's Full Legal Name & Relationship
• Nominee's Contact Email Address and Phone Number
• Government-issued ID Proof or Verification Document

7. Security & Safeguards

We employ enterprise-grade technical and organizational safeguards aligned with OWASP ASVS standards:

• Transport Layer Security (TLS 1.3 / HTTPS) with HTTP Strict Transport Security (HSTS) enforced.
• AES-256 encryption for sensitive database fields and HMAC-signed storage tokens.
• Role-Based Access Control (RBAC) and immutable cryptographic audit logging.
• Strict Content Security Policy (CSP), anti-clickjacking protection, and automated rate-limiting.