CRRB Solution Privacy Policy
Learn how CRRB Solution handles website, account, enquiry and security engagement data.
1. Who is responsible for your data
For website enquiries, account administration, marketing preferences and our own business operations, CRRB Solution determines why and how personal data is used.
During a client security engagement, the client may determine the purpose of processing and CRRB Solution may act on its documented instructions. The relevant contract and scope govern that work.
2. Data we collect
Contact and identity data: name, work email, phone number, organisation, role and the information you include in an enquiry.
Account data: login identifiers, profile details, roles, authentication events and security settings. We do not need your password in readable form and will never ask you to send it by email.
Security and technical data: IP address, device/browser information, request and audit logs, timestamps, monitored assets you submit, alerts, support history and activity needed to protect the portal.
Engagement data: scope details, authorised targets, evidence, vulnerability information, uploaded Nessus files, generated reports, remediation notes and auditor attribution.
Communication data: emails, replies, delivery status, consent or unsubscribe choices, and records needed to answer a request.
3. Why we use it
To respond to enquiries, prepare a scope or proposal, provide contracted services and support users.
To authenticate accounts, enforce permissions, investigate misuse, prevent fraud and protect CRRB Solution, our clients and the public.
To generate and retain authorised assessment records, communicate findings, support remediation and meet audit or contractual requirements.
To operate, diagnose and improve the portal, and to send service messages. Promotional updates are sent only where permitted and can be unsubscribed from.
4. Consent and lawful use
We process data for a clear business or service purpose, with consent where consent is the appropriate basis, to perform requested or contracted work, to meet legal obligations, and for legitimate security and administrative needs permitted by applicable law.
You may withdraw consent for future consent-based processing. Withdrawal does not undo processing that was lawful before it, and some records may still be retained where a contract, security need or law requires it.
5. Sharing and service providers
We do not sell or rent personal data. Access inside CRRB Solution is limited by role and business need.
We may use carefully selected infrastructure, hosting, database, email-delivery, monitoring or professional service providers. They receive only the data needed for their task and are expected to protect it under contract and applicable law.
We may disclose information when required by law, a valid legal process, or to investigate and respond to a credible security threat. Client vulnerability data is not published without authorisation; case studies are prepared only after identifying details are removed and publication is approved where required.
6. Storage, transfers and retention
Data may be processed in India and, where a provider operates internationally, in another permitted location with contractual and technical safeguards. Client-specific residency requirements are handled in the engagement documents.
We keep data only while it serves the stated purpose and for any necessary contractual, audit, dispute, security, backup or legal period. Retention depends on the record: an unanswered enquiry, an active account, an incident log and a client assessment report do not have the same lifecycle.
At the end of the applicable period, data is deleted, anonymised or placed beyond routine use. Backup deletion may follow the backup rotation cycle.
7. Security
We use measures appropriate to the data and risk, including access control, authentication safeguards, encryption in transit, audit logging, input validation, rate limiting, backups and security review. No internet service can promise absolute security, so we also maintain processes to identify, contain and respond to incidents.
If a personal data breach requires notification under applicable law, we will notify the appropriate authority and affected people in the required form and timeframe.
8. Cookies and browser storage
The portal may use essential cookies or browser storage for sessions, authentication, security controls and user preferences. With your consent from the cookie banner, we also use Google Analytics to understand aggregate site traffic. See our Cookie Policy for the full list and how to control it.
Third-party links, including LinkedIn, are governed by the privacy practices of the destination service. Opening such a link takes you outside CRRB Solution’s control.
9. Your choices and rights
Subject to applicable law and identity verification, you may ask what personal data we hold about you, request correction or completion, seek erasure where retention is no longer required, withdraw consent, opt out of marketing, or raise a grievance.
A request may be limited where disclosure would expose another person’s data, confidential security information, legal privilege, an active investigation, or information that must be retained by law or contract. We will explain the applicable reason.
10. Children
Our website and professional services are intended for businesses and adults. We do not knowingly solicit personal data from children. If you believe a child has submitted data without appropriate authorisation, contact us so we can review and remove it where required.
11. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version will remain available on this page with its effective and review dates. Material changes may also be communicated through the portal or email where appropriate.
