1. Who we are
Data Fiduciary: SECQOR, operating the QRAD product line, Bengaluru, India. Correspondence: contact@secqor.com.
Person able to answer questions about processing (DPDP Act section 8(9); Rules, rule 9): write to dpo@secqor.com. We use the title “Data Protection Officer” for this mailbox. SECQOR has not been notified as a Significant Data Fiduciary; a statutory DPO under section 10 is therefore not required. The mailbox is still monitored as the public contact for privacy questions and rights.
Grievance Officer (section 13): grievance@secqor.com.
When you read these pages, submit the pilot form, or write to us, SECQOR decides why and how your personal data is processed and is the Data Fiduciary for that processing.
2. Itemised personal data
A. Pilot form (“Book a governance pilot” on qrad.co.in), only if you choose to submit it:
- Name — required.
- Work email — required; used as the reply address.
- Organisation — optional.
- Role — optional; sent only if you select a value. The menu starts blank.
- Message — required. Do not include credentials, board minutes, health data, or other sensitive material.
- Consent evidence we store with the submission: notice version, notice URL, the consent-request text you saw, language selected, time of consent (UTC), page URL, and that you ticked the consent box. This is so we can prove notice and consent if asked (section 6(10)).
B. Direct email to contact@, dpo@ or grievance@: whatever you choose to include. The same handling rules apply.
C. Rights, withdrawal, grievance, and language-request forms on rights.html: name (optional except where needed to identify you), email, the type of request, and the details you type. Lawful basis is our duty under the Act, not a fresh marketing consent.
D. Hosting logs. Our host (Vercel) necessarily observes IP address, user-agent, referring page and request time in order to deliver the page, keep it available, and resist abuse. We do not run Google Analytics, Meta Pixel, LinkedIn Insight, Hotjar, Clarity, or any session recording. We set no first-party tracking cookies.
We do not sell personal data. We do not profile you for advertising.
3. Specified purposes and the service enabled
For the pilot form, the specified purposes are only:
- to respond to your governance-pilot enquiry;
- to schedule a related scoping conversation;
- to keep a record of that enquiry so we can continue the conversation and show, if asked, that we handled it lawfully.
The service enabled by that processing is scoping and, if we both agree, delivering a QRAD Secure Governance Platform pilot for your organisation.
We will not add you to a marketing list, build a profile for advertising, or use the message to train a public model, unless we come back and ask for a new, separate consent.
4. Lawful basis
Pilot form: your consent under section 6. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. On our form that action is: you open this notice, tick an unticked box, and press Send. Submitting without the box ticked is rejected.
Rights, withdrawal, grievance, language requests: our obligation to honour sections 11–14 and 13 of the Act.
Hosting logs: delivering the page you asked your browser to load, and securing that delivery.
5. How to give and withdraw consent
On the home page and the rights page, a first-visit overlay summarises the visit data in section 2.D as soon as the page loads (section 5: notice before or at the time of collection). Acknowledging that overlay is not consent for the pilot form. You give consent on the pilot form at qrad.co.in/#contact. You may read the consent request there in English or any language in the Eighth Schedule to the Constitution. The full notice is here in English and Hindi; any other Eighth Schedule language can be requested on the same website, at no cost, using this form. We aim to send that copy within seven working days.
You may withdraw consent at any time, with ease comparable to giving it: use the withdrawal form at rights.html#withdraw (same website, short form, one button). You may also email dpo@secqor.com with the subject “Withdraw consent”. Withdrawal does not make past replies unlawful. After withdrawal we stop, and we instruct our processors to stop, processing for the purposes you consented to, unless another law requires us to keep a limited record (for example, that a withdrawal happened).
6. Processors and where data goes
When you press Send on the pilot or rights forms, your browser posts the fields over HTTPS to Web3Forms (api.web3forms.com), which relays them by email to SECQOR. The site itself does not keep a copy of the form body.
- Web3Forms — form relay. Status of a signed Data Processing Agreement: requested; not yet signed. Until it is signed this is a residual vendor risk we are closing. We have asked them to retain submissions no longer than 90 days, not to use them for their own training or marketing, and to notify us of a breach within 24 hours.
- Vercel — host and edge delivery of qrad.co.in (region intended: Mumbai bom1, to be verified in the Vercel project). DPA: to be executed on Vercel’s standard data-processing terms.
- SECQOR’s business-email provider — stores the enquiry or rights email. DPA / processor terms: to be confirmed against the provider contract.
Google Fonts and jsDelivr are not used. Fonts and animation libraries are served from this website.
We do not transfer personal data to a country or territory the Central Government has notified as restricted under section 16. Some processors may use infrastructure outside India. Rule 15 also lets the Central Government set extra conditions if data is made available to a foreign State; we will meet those conditions if and when they are specified.
We do not share your data with anyone for their own marketing, profiling or resale.
7. What this page loads in your browser
qrad.co.in sets no first-party tracking cookies. Pages load only from this origin (HTML, CSS, fonts, scripts, images). The only third-party network call involving your form contents is Web3Forms, and only when you press Send.
A first-visit overlay on the home and rights pages summarises visit-log collection (section 2.D). Acknowledging it stores a versioned flag in your browser’s localStorage so we do not show the overlay again until this notice’s version changes. That flag never leaves your device. You can reopen the overlay from the footer (“Collection notice”). This Privacy Notice page does not auto-open the overlay because this page is the full notice.
8. Retention
Pilot enquiries and related email: 24 months from last interaction, then deleted or irreversibly anonymised, unless a live contract or another law requires a longer hold.
Rights, withdrawal and grievance files: 3 years from closure (so we can show we honoured the request). Those files keep your email, dates and the outcome — not a copy of deleted personal data.
Web3Forms copies: we ask for deletion within 90 days; until a DPA is signed their default period applies.
Hosting logs: the host’s default security window.
Security logs of access to personal data (Rule 6): kept for at least one year.
You can ask for erasure earlier; we will do it unless a lawful exception applies. Live systems are updated first; backups (when we operate them for product data) expire on a documented cycle rather than instantly.
9. Security
We apply safeguards matching Rule 6, in proportion to this being a marketing-site mailbox rather than a live Secure Room:
- TLS in transit; form posts only to HTTPS.
- Access to the SECQOR mailbox limited to named people, with multi-factor authentication.
- No bulk export of enquiries as a matter of practice.
- A personal-data breach is handled under our incident runbook: Board intimation without delay, detailed report within 72 hours, and notice to affected people (Rule 7).
Post-quantum cryptography described on the marketing pages applies to the product we are building, not to this website’s mailbox.
10. Your rights
You may, under the Act:
- Access a summary of personal data we hold, the processing, and processors it has been shared with (section 11).
- Correct, complete or update that data (section 12).
- Erase data that is no longer needed for the specified purpose, unless the law says we must keep it (section 12).
- Withdraw consent (section 6(4)).
- Nominate someone to exercise these rights if you die or lack capacity (section 14).
- Raise a grievance (section 13).
11. How to exercise rights
Use https://qrad.co.in/rights.html — the same website as the pilot form. Or email dpo@secqor.com stating the right, the email you used with us, and enough for us to check it is you (we start with a simple confirming question, not identity documents).
We acknowledge within one business day. Access: target 7 working days. Correction, erasure, withdrawal: target 14 working days. We will not demand a new consent merely to let you exercise a right.
12. Grievance Officer
If you are unhappy with how we handled your data or a rights request, use the grievance form or write to grievance@secqor.com. We aim to respond in 30 days, and in any event within 90 days of receipt (Rule 14(3)). You must use this path before complaining to the Board (section 13(3)).
13. Consent Managers
You may give, manage, review or withdraw consent through a Consent Manager registered with the Board (section 6(7); Rule 4, in force from 13 November 2026). SECQOR is not a Consent Manager. We will honour a valid request routed through a registered Consent Manager.
14. Children
This website is for company officers evaluating a governance product. We do not knowingly process a child’s personal data. We do not track children or serve them ads. If you believe a child submitted the form, write to dpo@secqor.com and we will delete the record.
15. Complaint to the Data Protection Board of India
After you have used our grievance path, you may complain to the Data Protection Board of India, the digital office established under the Act (notified 13 November 2025; headquarters in the National Capital Region). The Board’s public complaint portal is still being stood up (Chairperson and Members were under recruitment by MeitY as of 2026).
Communication links we can give you today:
- Ministry of Electronics and Information Technology (the ministry that notifies the Board and the Rules): https://www.meity.gov.in/
- MeitY public grievance channel: complaint registration
- Appeals from Board orders go to the Appellate Tribunal (TDSAT) as a digital office: https://tdsat.gov.in/
When the Board publishes a dedicated complaint URL, we will put that URL in this section within seven days and bump the notice version. Until then, these ministry links plus our grievance form are the means we can actually give you.
16. Languages
You may read this notice in English (this page) or Hindi (privacy-hi.html). You may read the short consent request on the pilot form in any Eighth Schedule language. For a full notice in another Eighth Schedule language, use the request form — no fee, target seven working days. English is authoritative if a translation differs.
17. Changes
If our practices or the law change, we update this page and the version number. We keep prior versions internally so we know which text applied when you consented.