1. How we respond
When we detect or are told about a potential incident, we follow a defined sequence: detect → triage (assess severity within a few hours) → contain (revoke access, rotate credentials, preserve evidence) → notify (regulators and affected people within the timeframes their law requires) → review (root-cause analysis and corrective actions). We keep an incident log and run a post-incident review after every confirmed incident.
2. CERT-In 6-hour reporting (India)
EEVSEC PRIVATE LIMITED is an Indian-incorporated company (CIN U62013GJ2026PTC177190) and is therefore subject to CERT-In Direction No. 20(3)/2022 (effective 27 June 2022). For in-scope cybersecurity incidents, we are committed to reporting to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of becoming aware, to incident@cert-in.org.in, in addition to any data-protection notifications below.
3. Regulatory notification timelines
Where a breach affects personal data, our notification duties depend on where the affected individuals are. The headline timelines we work to:
| Framework | Who we notify | By when |
|---|---|---|
| CERT-In (India) | CERT-In | Within 6 hours of awareness (in-scope incidents) |
| DPDPA 2023 (India) | Data Protection Board of India & affected individuals | Promptly, per the prescribed rules |
| GDPR (EU/EEA) | Lead supervisory authority | Within 72 hours of awareness, where there is a risk |
| GDPR (high risk) | Affected individuals | Without undue delay |
| UK GDPR | ICO & affected individuals | Within 72 hours / without undue delay |
| UAE PDPL | UAE Data Office & affected individuals | Without undue delay, per PDPL and its executive regulations |
| CCPA/CPRA (California) | Affected residents (and the AG above 500) | In the most expedient time, without unreasonable delay |
If we can’t confirm full details inside a deadline, we file an initial notification and supplement it as we learn more.
4. How we’ll tell you
If an incident affects your data, we will contact you using the email associated with your account or waitlist entry, and post a notice where appropriate. Our notice will say, in plain language: what happened, what data was involved, what we’re doing about it, and what you can do to protect yourself. Enterprise customers receive notification within any tighter timeframe set in their contract or Data Processing Addendum.
5. How to report an incident to us
If you believe you’ve found a vulnerability or that an incident is in progress, please tell us right away. Follow our responsible-disclosure policy, email hi@eevsec.com with the subject “Security report”, or use the machine-readable contacts at /.well-known/security.txt. We acknowledge reports within two business days.
6. Contact
Data Protection Officer: dpo@eevsec.com
EEVSEC PRIVATE LIMITED, CIN U62013GJ2026PTC177190
401, Garud Apartment, Opp: Mahabaleshwar Flat, Jodhpur Char Rasta, Ahmedabad, Gujarat 380015, India