Privacy Policy

RootRecon (“RootRecon”, “we”, “us”, or “our”) respects the privacy of individuals and is committed to protecting personal information entrusted to us.

RootRecon provides cybersecurity and information-security services, which may include web application security testing, API security testing, mobile application security testing, network and infrastructure security assessments, vulnerability assessments, penetration testing, cloud security assessments, security configuration reviews, security consulting, security research, and related services.

This Privacy Policy explains how RootRecon collects, uses, processes, stores, discloses, and protects personal information when you visit or use the RootRecon website, contact us, request information about our services, engage us for services, communicate with our personnel, participate in recruitment activities, or otherwise interact with us in connection with our business.

This Privacy Policy applies to personal information processed by RootRecon through its website, online forms, email and business communications, client onboarding and engagement processes, cybersecurity projects and assessments, recruitment processes, conferences and business-development activities, and other legitimate business interactions.

Where RootRecon processes personal information strictly on behalf of a client as part of a cybersecurity engagement, the client may determine the purposes and means of processing. In such circumstances, RootRecon will process the information according to the applicable contract, statement of work, rules of engagement, and applicable law.

This Privacy Policy does not necessarily apply to information processed solely by a client through systems owned or controlled by that client.

Depending on how you interact with RootRecon, we may collect different categories of information.

3.1 Information You Provide Directly

You may voluntarily provide information such as:

• Full name
• Job title or designation
• Company or organization name
• Business email address
• Telephone or mobile number
• Business address
• Country or region
• Information contained in enquiries or messages
• Information relating to requested services
• Project requirements
• Meeting or communication details
• Billing and invoicing information
• Information required to establish or manage a business relationship
• Any other information you voluntarily provide to us

We request only information that is reasonably necessary for the relevant purpose.

When you access our website, certain technical information may be automatically collected. This may include your Internet Protocol (IP) address, browser type and version, device type, operating system, language or regional settings, date and time of access, pages visited, referring website or source, approximate geographic information derived from technical data, website interaction information, error and diagnostic information, and other technical information necessary for website security and operation.

This information may be used for security monitoring, troubleshooting, website administration, analytics, performance improvement, and prevention or investigation of malicious activity.

Because RootRecon provides cybersecurity services, certain engagements may require access to information that is significantly different from ordinary website information.

Depending on the scope of an authorized engagement, RootRecon may process application data, API requests and responses, network information, system logs, authentication-related information, security configuration information, vulnerability evidence, screenshots, test results, security findings, system and infrastructure metadata, source-code or configuration information where expressly authorized, test credentials, user-account information, domain and subdomain information, device information, cloud-resource information, and other information contained within systems that the client has expressly authorized RootRecon to assess.

RootRecon will only access or process client systems and information within the scope of the applicable authorization and engagement.

RootRecon does not intentionally seek access to personal information that is unnecessary for the authorized security assessment.

Where access to personal information occurs incidentally during testing, RootRecon will handle such information according to the applicable engagement terms, confidentiality obligations, rules of engagement, and applicable law.

RootRecon may process personal information for legitimate business and operational purposes, including the following.

RootRecon seeks to process personal information in a lawful, fair, and transparent manner.

Depending on the circumstances, processing may be based on your consent; your request for services or information; performance of a contract or steps taken before entering into a contract; compliance with applicable legal obligations; legitimate business and security purposes where legally permitted; or another lawful basis available under applicable law.

Where consent is required, RootRecon will seek consent in an appropriate manner and will process information consistently with the scope for which consent was provided.

Where applicable law provides a right to withdraw consent, you may request withdrawal using the contact information provided in this Privacy Policy. Withdrawal of consent does not affect processing lawfully carried out before withdrawal and may not affect processing that RootRecon is otherwise legally permitted or required to perform.

RootRecon takes particular care when processing information during cybersecurity engagements.

A client may authorize RootRecon to assess a particular application, API, infrastructure, cloud environment, domain, network, device, or other technology environment.

RootRecon will perform testing only within the agreed scope, follow applicable rules of engagement, use information for authorized security purposes, restrict access to personnel who require it for the engagement, apply appropriate technical and organizational safeguards, maintain confidentiality obligations, and handle assessment information according to the applicable contract.

Clients are responsible for ensuring that they have the necessary rights, permissions, and authorizations to instruct RootRecon to conduct the relevant security assessment.

RootRecon does not knowingly authorize its personnel to conduct security testing against systems outside the agreed scope.

Some information may receive additional protection under applicable law.

Depending on the nature of an engagement, RootRecon may encounter information such as passwords or authentication credentials, financial information, health-related information, biometric information, identity documents, employee information, or other information that may be legally classified as sensitive or specially protected.

RootRecon does not intentionally request sensitive personal information through its public website unless it is reasonably necessary for a specific and lawful purpose.

Where such information is processed as part of a client engagement, RootRecon will apply appropriate contractual, technical, and organizational safeguards.

Unless specifically requested as part of an authorized engagement, you should not submit through public website forms passwords, private keys, authentication tokens, payment-card numbers, highly sensitive personal information, confidential client information, proprietary source code, production database exports, secret credentials, or other confidential security material.

If such information is required for a cybersecurity engagement, RootRecon will establish an appropriate secure transfer and handling mechanism.

RootRecon may use cookies and similar technologies to operate, secure, analyze, and improve the website.

Cookies may be used for essential website functionality, security, session management, analytics, performance monitoring, remembering preferences, and improving user experience.

The specific cookies and technologies used by RootRecon may change over time. For additional information, please refer to our Cookie Policy.

RootRecon may use third-party services to support website operations, analytics, communications, hosting, security, or other business functions.

Depending on the services actually deployed, these providers may process limited technical or personal information on RootRecon’s behalf.

RootRecon will seek to use service providers that provide appropriate safeguards and will limit information shared with them to what is reasonably necessary for the relevant purpose.

Third-party services may have their own privacy policies and terms. RootRecon recommends reviewing those policies where appropriate.

Before publication, RootRecon should identify the actual providers used on the production website, such as analytics, hosting, email, forms, CRM, payment, or customer-support providers.

RootRecon does not sell personal information as a business practice.

We may disclose information where reasonably necessary to service providers that support hosting, infrastructure, email, analytics, communications, security, customer relationship management, document management, payment processing, professional services, or other business operations.

We may also disclose relevant information to clients where information is processed as part of an engagement, subject to the applicable contract and scope; to professional advisors where reasonably necessary; to government or law-enforcement authorities where required or permitted by applicable law; and in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, subject to applicable requirements.

RootRecon may use infrastructure or service providers located outside India. Where personal information is transferred, stored, or processed across jurisdictions, RootRecon will seek to implement safeguards required by applicable law and contractual arrangements.

Depending on the circumstances, information may be processed in countries other than the country in which you reside.

RootRecon retains personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing services, maintaining business records, completing contractual obligations, resolving disputes, maintaining security records, complying with legal or regulatory obligations, protecting legitimate business interests, and establishing or defending legal claims.

Retention periods may vary depending on the nature and sensitivity of the information.

For cybersecurity engagements, client data and security-test artifacts may be retained according to the applicable statement of work, contract, rules of engagement, or agreed data-retention period.

When information is no longer required, RootRecon will take reasonable steps to securely delete, anonymize, or otherwise dispose of it, subject to legal or contractual retention requirements.

RootRecon is a cybersecurity company and recognizes the importance of protecting personal information and confidential client information.

Depending on the nature of the information and processing activity, RootRecon may implement safeguards including access controls, authentication mechanisms, least-privilege access, encryption where appropriate, secure communication channels, logging and monitoring, vulnerability management, secure development practices, employee confidentiality obligations, security awareness and training, backup and recovery controls, incident-response procedures, and physical, technical, and organizational safeguards.

No method of electronic transmission or storage can be guaranteed to be completely secure. Accordingly, while RootRecon works to protect information using reasonable and appropriate safeguards, it cannot guarantee absolute security.

RootRecon maintains procedures intended to identify, investigate, contain, and respond to security incidents involving personal information.

Where required by applicable law or contractual obligations, RootRecon may notify affected parties, clients, regulators, or other appropriate persons regarding a relevant security incident.

The timing, content, and recipients of any notification will depend on the circumstances, applicable law, contractual requirements, and security considerations.

Depending on applicable law and your relationship with RootRecon, you may have rights relating to your personal information. These may include, where applicable, requesting information about processing, requesting access to personal information, requesting correction of inaccurate information, requesting deletion of information, withdrawing consent where consent is the basis of processing, requesting information about how personal information is processed, raising a privacy-related grievance, and exercising other rights available under applicable law.

The availability and scope of these rights may depend on the applicable legal framework and circumstances of processing.

Where RootRecon processes information on behalf of a client, requests relating to that information may need to be directed to the relevant client or data controller/data fiduciary.

To submit a privacy request, correction request, deletion request, consent withdrawal, or privacy grievance, contact us using:

Please include sufficient information for us to understand and verify your request.

We may request reasonable information necessary to verify the identity of the person making a request, particularly where the request concerns access to or deletion of personal information.

We will process requests within the time required by applicable law.

RootRecon’s services are intended primarily for businesses, organizations, professionals, and individuals capable of entering into legally binding arrangements.

Our website and services are not intentionally directed toward children where applicable law requires parental or guardian involvement.

RootRecon does not knowingly collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to RootRecon without appropriate authorization, please contact us so that we can evaluate and take appropriate action.

RootRecon may collect information about companies and organizations, including company names, business contact details, organizational information, project information, contractual information, billing information, security requirements, and information relating to business relationships.

Some business information may not constitute personal information under applicable law. However, where such information relates to an identifiable individual, RootRecon will handle it in accordance with this Privacy Policy and applicable law.

Cybersecurity engagements may involve highly confidential information belonging to our clients.

RootRecon treats client confidential information separately from ordinary website information and may be subject to confidentiality agreements, non-disclosure agreements, statements of work, rules of engagement, security requirements, contractual data-processing provisions, and client-specific security requirements.

Where a client contract imposes stricter privacy or security requirements than this Privacy Policy, the applicable contractual terms may govern the relevant client information.

Our website may contain links to third-party websites, platforms, or services.

RootRecon does not control the privacy practices of those third parties.

When you leave the RootRecon website or interact with a third-party service, that third party’s privacy policy and terms may apply.

RootRecon is not responsible for the privacy, security, or content practices of third-party websites.

If you contact RootRecon by email, we may retain the communication and related information for responding to your request, maintaining business records, providing services, managing client relationships, security monitoring, dispute resolution, or complying with legal obligations.

Marketing communications, where used, will be handled in accordance with applicable law.

You may request that RootRecon stop sending non-essential marketing communications by following the relevant unsubscribe mechanism or contacting us.

RootRecon may occasionally communicate with existing clients, prospective clients, or business contacts about RootRecon services, cybersecurity updates, events, reports, security research, company announcements, or other relevant business information.

Where required, RootRecon will obtain appropriate consent or provide applicable opt-out mechanisms.

You may opt out of marketing communications at any time.

If you apply for employment or work with RootRecon, we may process information such as your name, contact details, resume/CV, educational information, professional qualifications, employment history, skills, references, interview information, and other information reasonably necessary for recruitment.

Such information may be processed for recruitment, evaluation, onboarding, employment administration, and legal compliance.

RootRecon seeks to collect and process information that is reasonably necessary for the relevant purpose.

We do not intend to collect personal information merely because it is available.

For cybersecurity engagements, testing activities should be designed to minimize unnecessary access, collection, copying, or retention of personal information.

Where feasible and appropriate, RootRecon may recommend or use test data, synthetic data, masked data, or other alternatives to reduce exposure to real personal information.

RootRecon seeks to maintain accurate and reasonably current personal information where necessary for the purposes for which it is processed.

You should provide accurate information and notify us where relevant information changes.

You may request correction of inaccurate or incomplete personal information where such a right is available under applicable law.

RootRecon does not currently intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing.

If this changes, RootRecon will review applicable legal requirements and update its practices and policies as appropriate.

RootRecon may update this Privacy Policy periodically to reflect changes to our services, technology, data-processing practices, applicable law, regulatory developments, or privacy practices.

When we make material changes, we may update the “Last Updated” date and, where appropriate, provide additional notice.

We encourage you to review this Privacy Policy periodically.

This Privacy Policy shall be interpreted in accordance with the laws applicable to RootRecon and its processing activities.

Where legally appropriate, matters concerning this Privacy Policy shall be subject to the jurisdiction specified in RootRecon’s contractual terms or Terms of Service.

If you have questions, concerns, requests, or complaints regarding this Privacy Policy or RootRecon’s privacy practices, please contact us.

If you believe that RootRecon has processed your personal information improperly or that your privacy rights have not been adequately addressed, you may contact our designated privacy contact using the information above.

We will review the complaint and take appropriate steps in accordance with applicable law and our internal procedures.

Where applicable law provides a right to approach a regulatory authority or adjudicatory body, nothing in this Privacy Policy is intended to restrict that right.

By using the RootRecon website or voluntarily providing personal information to RootRecon, you acknowledge that you have had an opportunity to review this Privacy Policy.

Where consent is legally required for a particular processing activity, RootRecon will seek such consent separately and in an appropriate manner.

This Privacy Policy does not override specific contractual privacy, confidentiality, security, or data-processing obligations agreed between RootRecon and a client.