1. Who we are (Data Fiduciary)
Secqor Technologies Pvt. Ltd. is a company in Bengaluru, Karnataka, India. For the Digital Personal Data Protection Act, 2023 Secqor is the only Data Fiduciary for personal data collected on secqor.com and on the QRAD product site qrad.co.in. QRAD is a Secqor product, not a separate company and not a separate Data Fiduciary.
QRAD publishes a product-specific notice at qrad.co.in/privacy so visitors of that site can read what that page collects. That notice does not split accountability. Every request about QRAD — pilots, early access, consent, withdrawal, access, correction, erasure, nomination, or grievance — is received and decided by Secqor at the Secqor addresses on this page and at secqor.com/your-rights. You may use a form on qrad.co.in; it is delivered to Secqor mailboxes (contact@, dpo@, grievance@secqor.com). There is no QRAD-only inbox that bypasses Secqor.
Registered office: Bengaluru, Karnataka, India. CIN and street address will be published in this section when allotted.
General contact: contact@secqor.com.
Person able to answer questions about processing (section 8(9); Rule 9): dpo@secqor.com. We use the title “Data Protection Officer” for this mailbox. Secqor has not been notified as a Significant Data Fiduciary; a statutory DPO under section 10 is not required.
Grievance Officer (section 13): grievance@secqor.com.
2. Personal data we collect on this website
We collect only the categories below. If a field is not listed, this website is not collecting it.
- Correspondence you send us — email address, any name or company you include, and the message, when you write to contact@, dpo@ or grievance@secqor.com about Secqor or about QRAD.
- QRAD product requests — name, work email, organisation, role, message and consent evidence from the QRAD pilot or rights forms. Those posts are relayed to Secqor. Secqor decides why and how that data is processed.
- Rights-request email — the same, when you use the links on /your-rights.
- Basic technical logs — our host (Vercel) records IP address, user-agent and request time to keep the site available and to prevent abuse.
- No cookies. No analytics. No advertising trackers. We do not set tracking cookies, load Google Analytics, Meta Pixel, LinkedIn Insight, Hotjar or session replay. Google Fonts and jsDelivr are not used. Fonts and scripts are first-party. The only browser storage is a versioned local flag that remembers whether you acknowledged the first-visit collection overlay. That flag never leaves your device.
3. Processing register (what, why, basis, how long)
| Data | Purpose / service enabled | Lawful basis | Retention |
|---|---|---|---|
| Enquiry email | Reply to your enquiry | s.6 consent (writing to us) | Up to 24 months after last exchange |
| Early-access / QRAD pilot request | Evaluate you for Secqor or QRAD; scope a governance pilot | s.6 consent (via Secqor) | Until launch or 24 months, whichever is earlier |
| DPO / grievance / rights email | Honour a right or grievance | s.7(a) / statutory duty — not marketing consent | 3 years from closure (stub after erasure) |
| Technical logs | Availability, security, abuse prevention | s.7(i) specified security purpose | Host default, up to 90 days where we control it |
The service enabled by an enquiry is a reply from Secqor — and, if we both agree, a conversation about Secqor or the QRAD product. We will not add you to a marketing list, build an advertising profile, or use your message to train a public model unless we ask for a new, separate consent.
4. Lawful basis
Writing to us: consent under section 6. The clear affirmative action is composing and sending the email after this notice is available on the same website.
Visit-log overlay: a first visit to the homepage or Your Rights shows a collection overlay that summarises visit-log processing (IP, user-agent, referrer, time). Acknowledging it (“I understand”) is not consent to send a message or a QRAD request. This full Privacy Notice page does not auto-open that overlay; use Collection notice in the footer to reopen it.
Rights and grievances: our duty under sections 11–14 and 13. We will not demand a new marketing consent to honour a right.
Hosting logs: delivering the page you asked the browser to load, and securing that delivery.
5. How to give and withdraw consent
You give consent by writing to contact@secqor.com from secqor.com/#contact, or by submitting the QRAD pilot form (which is delivered to the same Secqor mailbox). You may read this notice in English or Hindi; any other Eighth Schedule language can be requested on /your-rights at no cost (target seven working days).
You may withdraw consent at any time, with ease comparable to giving it: open /your-rights#withdraw and send the pre-filled email (one click). Or write to dpo@secqor.com with the subject “Withdraw consent”. Withdrawal does not make past replies unlawful. After withdrawal we stop processing for the purposes you consented to, unless another law requires a limited record.
6. Recipients, vendors, cross-border (section 16)
We do not sell personal data. We share it only with:
- Vercel — hosts secqor.com. DPA: to be executed on Vercel’s standard terms. Region intended: India where available.
- Email provider — stores mail you send us. Processor terms: to be confirmed against the provider contract.
- Source control & deployment — stores this website’s source, not visitor mailboxes.
We store personal data in India by default. Where a vendor operates elsewhere, we transfer only to countries not restricted by the Central Government under section 16, under contractual terms that impose DPDP-equivalent protection.
7. What this page loads in your browser
secqor.com sets no first-party tracking cookies. Pages load only from this origin (HTML, CSS, fonts, scripts, images). Google Consent Mode v2 is set to denied by default for analytics and advertising storage; we do not load those tags. LinkedIn is a link you choose to follow, not a pixel. On a first visit to the homepage or Your Rights, a collection overlay summarises the visit log; this Privacy Notice page does not auto-open it.
8. Retention
Enquiries: 24 months from last interaction, then deleted or irreversibly anonymised, unless a live contract or another Indian law requires a longer hold. Rights and grievance files: 3 years from closure (email, dates, outcome — not a copy of deleted data). Security logs of access to personal data (Rule 6): at least one year. You can ask for erasure earlier.
9. Security (section 8(5), Rule 6)
HTTPS with HSTS, CSP, and related headers; isolated build pipeline; secrets out of source; least privilege for the small team; no personal data in application logs. Mailbox access is limited to named people with multi-factor authentication. A personal-data breach is handled under our incident runbook: Board intimation without delay, detailed report within 72 hours, and notice to affected people (Rule 7).
Post-quantum cryptography described on the marketing pages applies to the product we are building, not to this website’s mailbox.
10. Your rights
- Access — a summary of what we hold, the processing, and processors (section 11).
- Correction & completion — correct, complete or update (section 12(1)).
- Erasure — when the purpose is served or you withdraw consent (section 12(3)).
- Withdraw consent — as easy as it was to give (section 6(4)).
- Grievance — section 13; details in section 12 of this notice.
- Nomination — someone to exercise rights on your death or incapacity (section 14).
11. How to exercise rights
Use https://secqor.com/your-rights — the same website as the contact mailto. Each right is a pre-filled email; that is comparable to how consent is given (also email). Or write to dpo@secqor.com with the words “DPDP request” in the subject. We verify identity by return-reply to the address on file. Acknowledge within one business day. Access: 7 working days. Correction, erasure, withdrawal: 14 working days. Statutory outer limit: 90 days.
12. Grievance Officer
Grievance Officer, Secqor Technologies Pvt. Ltd., Bengaluru, Karnataka, India. Email: grievance@secqor.com. Initial response within 30 days; final resolution within 90 days (Rule 14(3)). You must use this path before complaining to the Board (section 13(3)).
13. Consent Managers
You may give, manage, review or withdraw consent through a Consent Manager registered with the Board (section 6(7); Rule 4, in force from 13 November 2026). Secqor is not a Consent Manager. We will honour a valid request routed through one.
14. Children (under 18) — section 9
This website is for company officers evaluating a governance product. We do not knowingly process a child’s personal data. We do not track children or serve them ads. If you believe a child wrote to us, email dpo@secqor.com and we will erase the record.
15. Complaint to the Data Protection Board of India
After our grievance path, you may complain to the Data Protection Board of India (digital office notified 13 November 2025; headquarters in the National Capital Region). A dedicated Board portal was not resolving at the date of this notice. Links we can actually give you:
- MeitY: https://www.meity.gov.in/
- CPGRAMS: https://pgportal.gov.in/
- MeitY complaint registration: complaint registration
- Appeals: TDSAT https://tdsat.gov.in/
When the Board publishes a dedicated complaint URL, we will put it here within seven days and bump the notice version.
16. Languages
English (this page) and Hindi (/privacy-hi). Short consent copy on the homepage is in English; a full notice in any other Eighth Schedule language can be requested at /your-rights#language — no fee, target seven working days. English is authoritative if a translation differs.
17. Changes
We post changes here, increment the version, and update the date. Material changes: we notify you if we have your address. Older versions are kept for audit.
Version history: v1.0 — 31 August 2026 — modal notice on the SPA. v2.1 — 1 September 2026 — standalone pages. v2.2 — 1 September 2026 — Secqor is the sole Data Fiduciary for QRAD; all QRAD requests go through Secqor. First-visit collection overlay (s.5 visit log) added on the homepage and Your Rights; Privacy Notice pages do not auto-open it.