GDPR & DPDP Act 2023 Notice

1. Data Fiduciary and controller

The Data Fiduciary (DPDP Act, 2023) and controller (GDPR / UK GDPR) for personal data processed through SecureBreez is Helioster System, a proprietorship of Aman Awasthi, with GSTIN 23BUAPA6584L2ZK and Shops & Establishment Reg. No. INDO260807SE001326.

• Address: 129, Hira Bagh Colony, A.B. Road, Behind Kia Showroom, Opposite Scheme No. 78 (near Jayshri Kitchen), Indore, Madhya Pradesh 452010, India
• Email: Info@securebreez.com · Phone: +91 70671 55525
• Grievance Officer: Aman Awasthi, Grievance Officer & Proprietor (details)

This notice supplements our Privacy Policy, which describes in detail the data we collect, why, and how long we keep it.

2. What we process and why

We process account data (email, optional name, hashed password, plan and expiry), billing records and invoices, device/session counts, support tickets and short-lived connection metadata (session start and server). We operate a strict no-activity-logs policy: we do not log browsing history, traffic content, DNS queries or the websites and apps you use.

Under the GDPR our legal bases are performance of a contract, compliance with legal obligations (such as tax records), legitimate interests (network health, fraud prevention, device-limit enforcement) and consent (optional cookies and marketing). Under the DPDP Act we process data on the basis of your consent or for legitimate uses permitted by the Act, such as the service you voluntarily asked us to provide and compliance with law.

3. Processors

We use the following categories of processors (Data Processors under the DPDP Act):

We require contractual data-protection commitments from each processor, including confidentiality, security safeguards, processing only on our instructions, breach notification, and deletion or return of data at the end of the service.

4. Your rights

DPDP Act, 2023 (India)

• Access a summary of your personal data and the processing carried out;
• Correction, completion, updating and erasure of your personal data;
• Withdraw consent at any time, as easily as you gave it;
• Grievance redressal by us, then a complaint to the Data Protection Board of India;
• Nominate another individual to exercise your rights on your death or incapacity.

GDPR / UK GDPR

• Access, rectification, erasure, restriction, data portability;
• Object to processing based on legitimate interests and to direct marketing;
• Withdraw consent where processing is based on consent;
• Complain to a supervisory authority in your country of residence, work or the place of an alleged infringement.

5. How to exercise your rights

1. Email Info@securebreez.com from the address on your account, stating the right you wish to exercise.
2. We may ask you to verify your identity before acting on the request.
3. We aim to respond within 30 days. Some data, such as invoices, must be kept to meet legal obligations; we will tell you if so.
4. Under the DPDP Act you must first raise a grievance with our Grievance Officer. If you are not satisfied with the outcome, you may then complain to the Data Protection Board of India.

6. Consent managers

The DPDP Act allows you to give, manage and withdraw consent through a Consent Manager registered with the Data Protection Board of India. We do not currently integrate with a registered Consent Manager; you can manage your consent directly with us by email, in your account, or through “Cookie settings” in the website footer. We will update this notice if that changes.

7. Cross-border transfers

Some processors, including our infrastructure partner, process data outside India. We transfer personal data abroad in line with the DPDP Act and any country restrictions notified by the Government of India. For EU, EEA and UK personal data sent to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) or another lawful mechanism.

8. Data Processing Agreement for business customers

Where a business customer uses SecureBreez for its staff, we act as its processor for seat and admin data. A Data Processing Agreement (DPA) covering GDPR and DPDP Act requirements is available on request: email Info@securebreez.com.