1. Who we are
These websites, www.hackysecurity.ae and store.hackysecurity.ae (together, the "Site"), are run by Hacky Security Private Limited, a company registered in India, at Plot No. 57, Phase-1, Industrial Area Phase II, Chandigarh, Chandigarh, India 160002. Hacky Security Middle East is our team in Dubai. Our Dubai office: Regus Office, RME Holdings - Dubai Branch, R-311-315, Jumeirah Living Marina Gate 3, Mezzanine Floor, Dubai Marina, Dubai 121828, United Arab Emirates, phone 0211 81697061. In this policy "we", "us" and "our" mean Hacky Security Private Limited.
For the personal data described here we are the data fiduciary under India's Digital Personal Data Protection Act, 2023, the controller under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) where it applies, and the controller under the EU and UK General Data Protection Regulations for learners in those regions.
This policy covers the Site, your learner account, the course workspace under /start, our store and certificate verification. The lab platform (lab.hackysecurity.com) is run by us too; where it collects more than is described here, it tells you so.
2. What we collect
We collect only what we need to sell you a course, run your account and keep the Site safe.
- Account details: your name (as it should appear on your certificate), email address and a password. We store the password only as a one-way scrambled value (a hash); nobody at Hacky Security can read it.
- Order and billing details: the course and level you buy, the price and currency, your billing country, your Indian state (India only, for GST), and, if you buy for a business, your company name and tax number (GSTIN, TRN, VAT number or similar).
- Payment details: payments are taken by Razorpay. Your card, UPI, bank or wallet details go directly to Razorpay and never reach our servers. We receive only the Razorpay order and payment reference, the amount, the currency and whether the payment succeeded.
- Learning records: which courses and levels you can open and when they opened, your progress, lab use, exam attempts and results, and the certificates we issue to you.
- Messages and enquiries: what you send us through the Business enquiry form or by email: your name, company, job title, email, phone number, team size and country.
- Coupon use: the coupon code you redeem and the course it opened.
- Security and technical data: your IP address, browser type, the time of each request, and failed sign-in attempts. We use these to keep accounts safe and to stop abuse.
We do not ask for government ID numbers, health information or other sensitive personal data. Please do not include them in messages to us.
3. Why we use it, and our legal basis
- To provide what you bought (contract): creating your account, taking payment, opening your course 48 hours after payment, running labs and exams, and issuing and verifying certificates.
- To meet legal duties (legal obligation): issuing tax invoices, keeping accounting and tax records, and answering lawful requests from authorities.
- To keep the Site and your account safe (legitimate interests / legitimate uses): limiting sign-in attempts, detecting fraud and misuse of labs, and fixing faults.
- To answer you (steps before a contract, or consent): replying to enquiries and support requests.
- To send you news, only if you ask (consent): we do not send marketing emails unless you have agreed. You can withdraw consent at any time; it does not affect anything done before.
We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Cookies and similar storage
We use only what the Site needs to work. We do not use advertising or tracking cookies, and we do not use analytics.
- HSAE (cookie): keeps you signed in on www and store, and protects forms against forged requests. Strictly necessary. Removed when you sign out or after 30 days without use.
- hs_cur (cookie): remembers the currency you chose. Kept for 12 months.
- hs-lang (stored in your browser): remembers the language you chose. Stays until you clear your browser data.
Google Fonts provides the typefaces on the Site, and Razorpay's checkout window loads from Razorpay when you pay. Those services receive your IP address when they load and follow their own privacy policies.
5. Who we share it with
- Razorpay (payment processing), to take your payment and handle refunds.
- Hostinger (hosting and email), which stores the Site, its database and our email on our behalf.
- Our own team in India, the UAE and the UK, only where they need it to support you.
- Professional advisers such as our accountants, auditors and lawyers, under a duty of confidentiality.
- Your employer or the organisation that bought your seat, if a business paid for your course: your progress and certificate status, so they can track their team's training.
- Anyone checking a certificate: when someone enters a certificate ID on /verify, we show only what is printed on that certificate: the holder's name, course, level and issue date.
- Authorities and courts, where the law requires it.
If we sell, merge or restructure all or part of our business, your data may pass to the new owner, who must keep using it in line with this policy.
6. International transfers
We work across India, the UAE and the UK, so your data may be stored or accessed in any of those countries, and our hosting and payment providers may process it in other countries. Where the law requires it, we use safeguards such as contractual protections approved for that purpose, and we only share what the recipient needs.
7. How long we keep it
- Your account and learning records: while your account is open, so your lifetime access, progress and certificates keep working. If you ask us to close your account, we delete them, except what we must keep by law.
- Orders and tax invoices: for as long as Indian tax and company law requires (currently up to eight years).
- Certificates: for as long as the certificate can be verified (they do not expire), unless you ask us to remove it.
- Enquiries: 24 months from your last contact, unless you become a customer.
- Failed sign-in records: 24 hours. Password reset links: 1 hour.
8. How we protect it
All traffic to the Site is encrypted (HTTPS). Passwords are stored only as hashes. Our keys and settings sit in a private folder that cannot be reached from the web. Sign-in is rate-limited, forms are protected against forged requests, and staff access is limited to the people who need it.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulator as the law requires.
9. Your rights
Everyone can ask us to: tell you what personal data we hold about you and who we shared it with; correct or complete it; delete it; and stop using it for anything you consented to.
In India (DPDP Act, 2023) you also have the right to grievance redressal, and to nominate someone to exercise your rights if you die or become unable to.
In the UAE (PDPL) you also have the right to object to some uses, to restrict processing, and to have your data transferred to you in a usable format.
In the EU and UK (GDPR) you also have the right to restrict or object to our use of your data, to data portability, and to complain to your data protection authority, such as the Information Commissioner's Office in the UK.
To use any of these rights, email support@hackysecurity.com with the subject "Privacy request". We may ask you to confirm your identity. We reply within 30 days, or sooner where the law requires. Deleting your account ends your access to your courses.
10. Grievance officer
Gaurav Sharma, Founder & Chief Information Security Officer, Hacky Security Private Limited, Plot No. 57, Phase-1, Industrial Area Phase II, Chandigarh, Chandigarh, India 160002
Email: gaurav.sharma@hackysecurity.com (subject "Privacy grievance") · Phone: +91-8091900310
If you are not satisfied with our answer, in India you may approach the Data Protection Board of India; in the UAE, the UAE Data Office; and in the EU or UK, your local data protection authority.
11. Children
Our courses are for adults. If you are under 18, you may use the Site only with the consent and supervision of a parent or guardian, who must make the purchase. If we learn that we hold data about a child without that consent, we will delete it.
12. Changes to this policy
We may update this policy when the Site or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you by email or on the Site before it takes effect.
13. Contact us
Questions about this policy: support@hackysecurity.com, or call +91-8091900310. Our Dubai office: Regus Office, RME Holdings - Dubai Branch, R-311-315, Jumeirah Living Marina Gate 3, Mezzanine Floor, Dubai Marina, Dubai 121828, United Arab Emirates, phone 0211 81697061.