Privacy Policy

This website (vanshield.io) is operated by VANShield.io, an independent security consultancy based in New Delhi, India. For any privacy or data-protection request, contact privacy@vanshield.io.

This policy explains what personal data we collect from visitors to this website, why we collect it, and the rights you have over it. We apply the protections described here to all visitors, wherever you are located.

1. Scope

This policy covers personal data processed through this website. It does not cover information exchanged during a security engagement — that is governed by the separate written agreement, scope of work and confidentiality terms agreed with each client.

2. Information we collect

• Contact forms. When you use a contact form on this Site, we collect the name and work email address you provide, together with any optional detail you choose to add — the service you are interested in, your website or domain, and your message.
• Enquiries about Managed Phishing Simulation. This service tests staff awareness by sending simulated phishing emails to employee mailboxes that the organisation has authorised in writing beforehand. Its enquiry form therefore also asks roughly how many mailboxes you would want in scope, because that is what the engagement is sized and priced on. At enquiry stage this is only an approximate number — we do not ask for, and you should not send us, any employee names or email addresses through this website. Those are necessarily shared later, but only once an engagement has been agreed and signed: the client provides the authorised mailbox list under the written agreement, scope of work and confidentiality terms, and we handle it strictly on the client’s documented instructions. In data-protection terms the client remains the controller of that employee data and we act as its processor. That processing sits outside this policy, which covers this website only — see section 1. If you have used a pricing estimator on this Site, the form additionally sends the selection you made there (the number of mailboxes, whether you chose a single engagement or an annual programme, whether you included an optional add-on, and the resulting estimate), so that we can reply to the right scope.
• How form data reaches us. We use the information above only to respond to your enquiry. Submissions are delivered to us through Web3Forms.
• Analytics (only with your consent). If you accept analytics cookies, we use Google Analytics to understand aggregate, non-identifying site usage such as page views and general location. We do not use cross-site or advertising tracking. If you decline, no analytics cookies are set.
• Server logs. Like most websites, our hosting provider automatically records standard technical data (such as IP address, browser type and time of request) in server logs, used to operate and secure the site.

3. Why we process it, and our legal bases

• To respond to your enquiry — your consent, and taking steps at your request prior to any possible engagement (GDPR Art. 6(1)(a) and (b)).
• Analytics — your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time through your cookie/browser controls.
• Operating and securing the site — our legitimate interests in running a safe, functioning website (GDPR Art. 6(1)(f)).

4. Cookies

We use a minimal set of analytics cookies, and only after you select “Accept” on the cookie banner. Selecting “Decline” means no analytics cookies are set. We do not use advertising or cross-site tracking cookies. You can clear cookies at any time in your browser.

5. Sharing and service providers

We do not sell your personal data. We share it only with the service providers who help us run this site, who process it on our behalf:

• Web3Forms — delivery of contact-form submissions.
• Google Analytics (Google LLC) — website analytics, only after you consent.
• Our hosting provider — serves the website and maintains standard server logs.

6. International transfers

Our visitors and some of our service providers are located in different countries. Where personal data is transferred outside your jurisdiction, we rely on the safeguards offered by those providers (such as standard contractual clauses) to keep it protected.

7. How long we keep it

We keep contact-form submissions only as long as needed to handle your enquiry and for a reasonable period afterwards, then delete them. Analytics data is retained according to our analytics provider’s standard retention settings.

8. Your rights

Depending on where you live you have rights over your personal data. We extend the following to all visitors:

• access a copy of the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data (“right to erasure”);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, for example for analytics.

To exercise any of these, email privacy@vanshield.io. We will respond within the timeframes required by applicable law.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection authority. If you are in India, you may raise a grievance with us at privacy@vanshield.io and, if it remains unresolved, with the Data Protection Board of India.

9. Children

This website is intended for businesses and professionals and is not directed at children. We do not knowingly collect personal data from children.

10. Security

We use reasonable technical and organisational measures to protect personal data, including serving this site exclusively over HTTPS. Where something confidential needs to be exchanged during an engagement — an authorised mailbox list, credentials, or a finding not yet remediated — we do not send it as an email attachment. We operate a dedicated secure drop for that purpose: content is encrypted in your browser before it is uploaded, so the server holds no key and has zero knowledge of what is stored, and each link expires automatically and can be set to be destroyed after a single read. Clients are given the address of that service directly during an engagement; it is not published here. Assessment reports may still be delivered by email where a client asks for them on record. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this policy from time to time. The “last updated” date above always reflects the current version.

12. Contact

Questions or requests about this policy or your data: privacy@vanshield.io.