Privacy Policy

Last updated: 13 August 2026

This Privacy Policy explains how OpenSecurity India (“OpSecX”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you visit opsecx.com, create an account, purchase courses, learn on our platform, or contact us. OpSecX provides professional security education and related services.

By using our website and services, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use our services.

This is not legal advice. If you have questions about your specific legal obligations or rights, consult qualified counsel.

1. Who we are

Data controller: OpenSecurity India
Location: Bangalore, India
Website: opsecx.com
Privacy & data requests: cs@opsecx.com

For India’s Digital Personal Data Protection Act, 2023 (DPDP Act), OpenSecurity India is the data fiduciary responsible for personal data processed through OpSecX, unless we state otherwise.

2. Information we collect

We collect personal information in the following categories, depending on how you use OpSecX.

2.1 Account and authentication

• Email address — used to sign in, receive one-time verification codes, and send service-related messages.
• Display name and optional username — shown in your account and, where relevant, on certificates or support threads.
• Authentication data — we use passwordless login: short-lived one-time codes (stored only as secure hashes, not plain text) and, if you choose, WebAuthn passkeys (we store credential identifiers and public key material required for passkey login; we do not store passwords).
• Profile avatar — we may request an avatar image from Gravatar using a one-way hash of your email address. If you have no Gravatar profile, a default is shown.

2.2 Checkout, billing, and orders

• Billing details — such as name, company, address, city, state, postal code, country, and phone number when you checkout or save billing information to your profile.
• Order information — courses purchased, amounts, currency, payment status, timestamps, and a billing snapshot captured at the time of order (for invoices and support).
• Payment processing — payments for new orders are handled by PayPal or PayU. We receive confirmation and metadata from the payment provider (for example transaction references and status). We do not store full payment card numbers on our servers.
• Historical orders — some older orders migrated from our previous platform may reference legacy payment methods; those records are kept for accounting and customer support.

2.3 Learning, certificates, and course activity

• Enrollments — which courses you are enrolled in, enrollment status, and completion dates.
• Lesson progress — which lessons you have completed and when.
• Certificates — issued certificates, issue dates, and a unique credential identifier. Public verification at /verify/… is available only if you explicitly opt in to make a certificate publicly verifiable; private certificates are not disclosed to third parties through that page.

2.4 Support and instructor messaging

• Course messages — if you contact an instructor through our asynchronous, course-scoped messaging feature, we store the thread subject, message content, timestamps, and read status.
• Customer support — if you email us or contact support, we process the information you provide to respond to your request.

2.5 Technical, security, and usage data

• Session and security cookies — HTTP-only authentication session cookies and a CSRF protection cookie used for secure account actions (see Section 6).
• Browser storage — your shopping cart may be stored in your browser’s local storage until checkout or until you clear it.
• Security and abuse prevention — we may process IP address, user agent, and related technical data in connection with login attempts, rate limiting, fraud prevention, and platform security. Admin actions on sensitive settings are recorded in an audit log.
• Analytics and site scripts (optional) — we may configure third-party analytics or similar tools (for example Google Analytics) through our site settings. When enabled, those providers may set cookies or collect usage data according to their own policies. Non-essential analytics, where required by law, are used only with appropriate consent mechanisms.

3. How we use your information

We use personal information to:

• Provide, operate, and improve the OpSecX platform and courses you purchase or access.
• Authenticate you, maintain your account, and manage passkeys if you register them.
• Process orders, deliver course access, issue invoices, and provide certificates.
• Respond to support requests and course-related messages.
• Send transactional emails (for example login codes, order confirmations, and service notices) via our email provider.
• Protect the security and integrity of our platform, investigate abuse, and enforce our terms.
• Comply with legal, tax, and accounting obligations.
• Measure site usage where analytics tools are enabled, to understand and improve our services.

We do not sell your personal information.

4. Legal bases (EEA, UK, and similar jurisdictions)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that requires a lawful basis, we rely on:

• Contract — processing necessary to provide accounts, courses, checkout, and support you request.
• Legitimate interests — platform security, fraud prevention, service improvement, and internal reporting, balanced against your rights (you may object where applicable).
• Consent — where required for non-essential cookies or analytics, or for optional features such as public certificate verification.
• Legal obligation — retaining certain records (for example order and invoice data) as required by applicable law.

5. India (DPDP Act)

If you are in India, we process your personal data for lawful purposes connected to delivering OpSecX services, with appropriate security safeguards. Under the DPDP Act and related rules, you may have rights including:

• Access to information about personal data we process about you.
• Correction and erasure of personal data, subject to legal retention requirements.
• Nomination of another individual to exercise your rights in certain circumstances.
• Grievance redressal through our contact channel below.

To raise a privacy grievance or exercise rights under Indian law, contact cs@opsecx.com. We will respond within timelines required by applicable law.

6. Cookies and similar technologies

OpSecX uses the following types of cookies and browser storage:

You can control cookies through your browser settings. Disabling essential cookies may prevent you from signing in or completing checkout. Clearing local storage removes saved cart items.

7. Sharing and subprocessors

We share personal information only as needed to operate OpSecX, comply with law, or protect rights and safety. Our service providers process data on our instructions and under contractual confidentiality and security obligations.

Categories of recipients include:

• Payment processors — PayPal (Privacy Policy) and PayU (Privacy Policy) for checkout and payment confirmation.
• Email delivery — Zoho Mail (Privacy Policy) for transactional messages such as login codes and order-related email.
• Avatars — Gravatar (Privacy Policy) when displaying profile images derived from your email hash.
• Analytics (if configured) — providers such as Google (Privacy Policy).
• Infrastructure providers — Amazon Web Services (Privacy Policy) and DigitalOcean (Privacy Policy).

We may also disclose information if required by law, court order, or governmental request, or when we believe disclosure is necessary to protect our users, platform, or legal rights.

We do not share personally identifiable information with third parties for their independent marketing without your consent.

8. International transfers

OpSecX is operated from India. We store and process personal data primarily on servers located in the United States through our infrastructure providers (Amazon Web Services and DigitalOcean).

When you pay in INR through PayU, your payment information is processed by PayU in India according to PayU's privacy policy and applicable law. Other account, learning, and order data described in this policy is not transferred to India for storage solely because you use PayU.

Some subprocessors (for example PayPal, Google Analytics if enabled, or Zoho Mail) may also process limited data in other countries where they operate. Where required by applicable law, we rely on appropriate safeguards such as contractual protections offered by our providers.

9. Security

As a security education company, we take reasonable technical and organizational measures to protect personal information, including encryption in transit (TLS), access controls, secure authentication practices, input validation, content security policies, and administrative audit logging for sensitive changes.

No method of transmission or storage is completely secure. If you believe your account or data has been compromised, contact cs@opsecx.com promptly.

For information about reporting security vulnerabilities, see our Security page.

10. Retention

We retain personal information only as long as necessary for the purposes described in this policy:

• Active accounts — while your account exists and you use our services.
• Orders and invoices — for the period required for tax, accounting, dispute resolution, and legal compliance, even if you later request erasure of other profile data.
• Certificates — retained to honour verification and course completion records; public verification applies only when you opt in.
• Authentication codes — deleted or expired shortly after use or expiry.
• Security logs — retained for a limited period appropriate for security monitoring and incident response.
• Erased accounts — when we honour an erasure request, we anonymize personal identifiers (for example email and billing profile) and disable login, while retaining non-identifying order history where we must.

11. Your rights

Depending on your location, you may have the right to:

• Access personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion or anonymization of personal information, subject to legal exceptions.
• Receive a portable copy of certain information you provided.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent (without affecting prior lawful processing).
• Lodge a complaint with a supervisory authority — for example your EU/EEA data protection authority, the UK Information Commissioner’s Office (ICO), or the relevant authority under India’s DPDP framework.

12. How to exercise your rights

Email cs@opsecx.com with the subject line “Privacy request” and tell us what you are asking for (access, correction, export, or erasure). We may need to verify your identity before fulfilling the request.

We aim to respond within 30 days, or within any shorter period required by applicable law. If we need more time for complex requests, we will let you know.

Export and erasure:

• You may request a copy of personal data associated with your student account.
• You may request erasure of personal data. We will anonymize your account and remove associated learning activity where appropriate.
• Exceptions: we may retain order records, invoice data, and certificate records where required for legal, tax, or accounting purposes or to establish, exercise, or defend legal claims. Erased accounts cannot be restored.

Self-service export and erasure tools may be added to your account dashboard in the future; until then, submit requests by email.

13. Children

OpSecX offers professional security training intended for adults and older learners. Our services are not directed at children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact cs@opsecx.com and we will take appropriate steps to delete it.

14. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.

15. Third-party links

Our site may link to third-party websites (for example payment providers or external resources). Their privacy practices are governed by their own policies. We encourage you to read those policies before providing personal information to third parties.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and revise the “Last updated” date at the top. Continued use of OpSecX after changes take effect constitutes acknowledgment of the updated policy, where permitted by law.

17. Contact us

OpenSecurity India
Bangalore, India
Email: cs@opsecx.com

For terms governing use of the platform, see our Terms and Conditions.