Privacy Policy
Last updated: 6 September 2026
Who we are
Advik Cyber Shield LLP, a limited liability partnership registered in India and operating under the brand Offload Security ("Offload", "we", "us"), operates offloadsecurity.com (the "Website") and the Offload Platform. For any privacy question, request or complaint, contact our Grievance Officer at privacy@offloadsecurity.com.
This policy covers the Website, our free tools and our marketing communications. For the Offload Platform itself, see What the platform processes.
What we collect on this website
We collect as little as the Website needs to work and to answer you:
- Email you send us. Demo, pilot, partnership and security enquiries are by email (contact@, security@, legal@ and privacy@offloadsecurity.com). We keep your name, work email and the content of the message so we can reply and follow up.
- Demo bookings. The contact page embeds a Calendly scheduling widget. If you book a slot, Calendly collects your name, email and chosen time and passes them to us; the widget loads Calendly's script and may set Calendly's own cookies as soon as the page opens, under Calendly's privacy notice.
- Newsletter sign-ups. The email address you enter on the blog, used only to send you the content you asked for. Unsubscribe at any time by replying to any newsletter or emailing privacy@offloadsecurity.com.
- DPDP Readiness Checker report requests. Described in the next section.
- Hosting logs. The Website is served by GitHub Pages. GitHub may log visitor IP addresses for security and legal-compliance purposes under GitHub's privacy statement. We do not receive or analyse these logs.
We do not run third-party analytics, advertising pixels or tracking cookies on the Website. The only third-party code the Website loads is the Calendly widget on the contact page, described above. The Website stores two things in your browser's local storage: your light/dark theme preference, and — only if you request a DPDP Checker report — a copy of that request (your email, company and result summary) so a failed submission is not lost. That copy stays on your device until you clear the site's data in your browser; we cannot read or delete it remotely. Your control-by-control checker answers are held in memory only, never stored and never sent. We do not sell personal data, and we do not share it with anyone for their own marketing.
Free DPDP Readiness Checker
Our free DPDP Readiness Checker scores your answers entirely in your browser — your control-by-control questionnaire answers are not transmitted to us. If you choose to unlock the detailed report, we collect the work email and company name you enter, together with a summary of your result: your readiness score and band, your Significant Data Fiduciary likelihood, the obligation areas where gaps were found, and your organisation profile (such as sector and data-volume tier). We use this to send you the report and to follow up about your DPDP readiness (our legitimate interest / your request).
We only send marketing communications (DPDP updates and product content) if you expressly opt in using the optional checkbox — unlocking the report by itself does not subscribe you. You can withdraw consent, request a copy, or ask us to delete this data at any time by contacting privacy@offloadsecurity.com.
Checker report requests and newsletter sign-ups are delivered to us through Formspree (Formspree, Inc., United States), which acts as a processor on our behalf under its privacy policy and terms of service and stores submissions in the United States. We retain these leads for 24 months from your last interaction with us, or until you ask us to delete them, whichever is earlier.
Who we share data with
We use a small number of service providers, each bound by contractual data-protection terms and used only to operate the services above:
- Formspree, Inc. (United States) — DPDP Checker report requests and newsletter sign-ups.
- Calendly, LLC (United States) — demo scheduling on the contact page.
- GitHub, Inc. (United States) — Website hosting.
- Google LLC (Google Workspace) — our business email, where your enquiries, bookings and form submissions are received.
We may also disclose personal data where the law requires it, to protect our rights or safety, or as part of a merger, acquisition or asset transfer (in which case this policy continues to apply).
International transfers
Offload is based in India. The providers above process data in the United States and, for Google Workspace email, in the regions Google operates. Transfers from India are made in accordance with the Digital Personal Data Protection Act, 2023 and its rules. Where the EU/UK GDPR applies to you, transfers rely on the provider's Standard Contractual Clauses or an applicable adequacy decision.
Legal bases
Where the EU/UK GDPR applies, we rely on:
- Steps at your request / legitimate interest — replying to enquiries, sending a report you requested, and following up on it.
- Consent — newsletter and marketing emails. Withdraw at any time by replying to any email or by emailing us.
- Legal obligation — record-keeping and responding to lawful requests.
Under India's DPDP Act, 2023 we process personal data for the specified purposes above with your consent or, for enquiries and requested reports, on the basis of your voluntary provision of that data for the purpose you asked us to fulfil.
How long we keep data
- Enquiry emails — 24 months after our last exchange, unless a business relationship follows (then under the customer agreement).
- Newsletter subscriptions — until you unsubscribe; we then keep only your address on a do-not-email list.
- DPDP Checker leads and demo bookings — 24 months from your last interaction, or on request.
- Hosting logs and Calendly data — held by GitHub and Calendly under their own retention, not by us.
We delete or anonymise data when the purpose is complete and no legal obligation requires us to keep it.
Your rights and grievance redressal
Whether under the DPDP Act, 2023 (as a Data Principal) or the GDPR (as a data subject), you can ask us to:
- tell you what personal data we hold about you and provide a copy;
- correct, complete or update it;
- erase it, where we have no overriding obligation to keep it;
- withdraw consent, where consent is the basis;
- nominate another person to exercise these rights on your behalf (DPDP Act);
- object to or restrict processing, and receive a portable copy (GDPR).
Send requests to our Grievance Officer at privacy@offloadsecurity.com. We acknowledge every request and aim to resolve it within 30 days, and in any case within the period prescribed under the DPDP Rules. If you are not satisfied, you may complain to the Data Protection Board of India or, where the GDPR applies, to your local supervisory authority.
Security
We protect the data above with access limited to the people who need it, encryption in transit, and the same practices we hold our customers to. How we secure the Offload Platform itself — including on-premises deployment where nothing leaves your network — is described in the Trust Center. To report a security issue, see our responsible disclosure policy.
Children
The Website and our services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.
What the platform processes
The Offload Platform processes customer-provided security data (findings, configurations, code excerpts) as a processor on the customer's behalf, governed by the customer agreement and data-processing agreement — not by this website policy. See the Trust Center for the data-handling architecture.
Changes to this policy
We will post any changes here and update the date at the top. Material changes to how we use data you have already given us will be notified by email where we have your address.
Contact
Grievance Officer, Advik Cyber Shield LLP (Offload Security) — privacy@offloadsecurity.com