Privacy Policy
Effective date: 23 October 2026 · Last updated: 23 October 2026
The short version: we collect only what we need to run our business and deliver our products, we never sell personal data, and data inside the systems we run for you belongs to you. You can ask us to access, correct or erase your personal data at any time by writing to contact@welmansec.online.
1. Who we are
Welmansec (“Welmansec”, “we”, “us”) is a product company. We provide security monitoring, service desk, secure VPN appliance, ERP and infrastructure monitoring products, together with the installation, hosting and support services that go with them (together, the “Products”), and we operate the website welmansec.online.
This policy is written to comply with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the rules made under it, and other applicable Indian law.
2. Scope and our role
We handle personal data in two different capacities, and our responsibilities differ in each:
- As a Data Fiduciary: for personal data we collect for our own purposes, such as when you visit our website, contact us, request a demo, buy from us, or log in to a customer portal we provide. This policy applies in full to that data.
- As a Data Processor: for personal data contained in the systems we deploy, host, monitor or support on behalf of our customers, such as security logs, tickets, ERP records and monitoring data. In these cases our customer is the Data Fiduciary, and we process the data only on their instructions. See section 5.
3. Personal data we collect
We follow the principle of data minimisation: we collect only the personal data needed for the purposes described below.
| Category | Examples | Source |
|---|---|---|
| Business contact data | Name, job title, company, work email, phone number | You, when you contact us, request a demo or become a customer |
| Account and portal data | Username, email address, password (stored only in hashed form), role and permissions | You or your organisation's administrator |
| Order, billing and delivery data | Billing name and address, GSTIN, delivery address for hardware, purchase orders, invoices and payment records | You and our payment providers |
| Support data | Support requests, call notes, remote session records, and our replies | You and our support team |
| Technical data | IP address, browser and device type, access times and error logs when you use our website or portals | Collected automatically |
We do not intentionally collect sensitive information such as health data, biometric data or financial account passwords for our own purposes.
4. How and why we use it
Under the DPDP Act, we process personal data either with your consent or for legitimate uses permitted by Section 7 of the Act, such as where you have voluntarily provided data for a specified purpose. We use it to:
- respond to enquiries, give demos and prepare quotations;
- deliver, install, configure, host and support the Products you buy;
- ship and service hardware appliances;
- manage customer accounts and portal access;
- issue invoices, collect payments and comply with tax laws, including GST;
- keep our website, portals and systems secure, and prevent fraud and misuse;
- send service notices such as security advisories, maintenance windows and renewal reminders;
- send product news, only if you have opted in. You can unsubscribe at any time; and
- comply with legal obligations and lawful requests from authorities.
When we rely on consent, we will ask for it through a clear notice that describes the personal data and purpose. You may withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it.
We do not sell or rent personal data to anyone.
5. Data in your systems
Our Products are designed to process your organisation's operational data, which may include personal data. For example, security logs can contain usernames and IP addresses, tickets can contain the details of the people who raised them, and ERP records can contain employee and customer information (“Customer Data”).
- You remain the Data Fiduciary for Customer Data and decide what is collected and why. You are responsible for having a lawful basis to process it and for giving any notices required under the DPDP Act to your own employees, customers and users.
- We act as your Data Processor. We process Customer Data only to deploy, host, maintain and support the Products for you, under your instructions and our agreement with you, and never for our own purposes.
- Where Products run on your own infrastructure or on a hardware appliance at your premises, Customer Data stays in your environment. We access it only when you authorise us to, for example during installation or a support session.
- At the end of our engagement, we will return or delete Customer Data held by us, as you instruct, unless the law requires us to keep it.
Requests from individuals about Customer Data should be directed to the organisation that uses our Products. If we receive such a request, we will pass it on to that organisation.
6. Cookies
Our website does not use advertising or tracking cookies. Customer portals and hosted Products use a small number of strictly necessary cookies to keep you signed in and protect against attacks. These cannot be switched off without breaking the service. If we ever introduce optional analytics cookies, we will ask for your consent first.
7. Who we share it with
We share personal data only where necessary, and only with:
- Service providers acting as our Data Processors, such as cloud hosting, email delivery, payment processing, and logistics partners for hardware delivery. They act on our instructions under written contracts.
- Government or law enforcement authorities, where required by law or a valid legal order.
- A successor entity, if Welmansec is involved in a merger, acquisition or sale of assets. We will notify you before your data becomes subject to a different privacy policy.
A list of our key service providers is available on request.
8. Where data is stored
We prefer to store data in India. Some service providers may process data in other countries. Any transfer outside India will comply with Section 16 of the DPDP Act, and we will not transfer personal data to any country or territory that the Central Government has restricted by notification. Hosted Products can be located in India on request.
9. How long we keep it
- Enquiry and lead data is kept for up to 24 months after our last contact, unless you become a customer or ask us to delete it sooner.
- Customer account and support data is kept for the duration of our relationship and for a reasonable period afterwards to handle warranty, support and legal claims.
- Billing records are kept for the period required by Indian tax and accounting laws (generally eight years).
- Security and access logs are kept for the minimum period required under applicable law, including the DPDP Rules, and then deleted.
- Customer Data is kept as instructed by the customer and as set out in our agreement with them.
10. Security and breaches
Security is our business. We take reasonable security safeguards to protect personal data, as required by Section 8(5) of the DPDP Act, including encryption in transit, access controls limited to staff who need them, multi-factor authentication for administrative access, logging and monitoring, and regular backups.
If a personal data breach occurs involving data for which we are the Data Fiduciary, we will notify the Data Protection Board of India and each affected person in the manner and within the time required by the DPDP Act and Rules. If a breach affects Customer Data, we will notify the customer without undue delay so they can meet their own obligations.
11. Your rights
As a Data Principal under the DPDP Act, you have the right to:
- Access information (Section 11): get a summary of the personal data we process about you, the processing activities, and the identities of others we have shared it with.
- Correction, completion, updating and erasure (Section 12): ask us to fix inaccurate or incomplete data, update it, or erase data that is no longer needed, unless we must keep it by law.
- Withdraw consent (Section 6): stop processing that is based on your consent, at any time.
- Grievance redressal (Section 13): raise a complaint with us and receive a response.
- Nominate (Section 14): nominate another person to exercise your rights in the event of your death or incapacity.
To exercise these rights, email contact@welmansec.online. We may need to verify your identity before acting on a request. Exercising these rights is free of charge. The DPDP Act also places duties on Data Principals (Section 15), including not providing false information and not filing frivolous complaints.
12. Children
Our Products and website are intended for businesses and are not directed at children (anyone under 18). We do not knowingly process children's personal data for our own purposes without verifiable consent from a parent or lawful guardian, as required by Section 9 of the DPDP Act. If you believe a child has given us personal data, please contact us and we will delete it.
13. Grievance redressal
If you have a concern about how we handle your personal data, please contact our Grievance Officer:
- Grievance Officer, Welmansec
- Email: contact@welmansec.online (subject line “Privacy grievance”)
We will acknowledge your grievance promptly and aim to resolve it within 30 days, and in any case within the period prescribed under the DPDP Act and Rules. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India after first exhausting this process, as provided under Section 13(3) of the DPDP Act.
14. Changes to this policy
We may update this policy as our Products or the law change. We will post the new version on this page with a new “Last updated” date. If a change materially affects how we use your personal data, we will notify customers by email before it takes effect and, where required, ask for consent again.
15. Contact us
For privacy questions or requests, write to contact@welmansec.online. For general enquiries, write to info@welmansec.online.