Effective Date: 01-07-2026 · Last Updated: 01-07-2026

Welcome to Security BSides Mumbai ("BSides Mumbai", "we", "our", or "us").

At BSides Mumbai, we are committed to respecting your privacy and protecting your personal data. This Privacy Policy explains how we collect, use, store, disclose, and otherwise process your personal data when you visit our website, register for our events, subscribe to our communications, or interact with us in any manner.

This Privacy Policy is intended to comply with the applicable laws of India, including the Digital Personal Data Protection Act, 2023 ("DPDP Act").

By accessing or using our website, or by providing your personal data, you acknowledge that you have read and understood this Privacy Policy.

1. Identity of the Data Fiduciary

For the purposes of the DPDP Act, BSides Mumbai is the Data Fiduciary responsible for determining the purpose and means of processing your personal data.

For any questions regarding this Privacy Policy or the processing of your personal data, please contact:

Email: mahaganlegal@gmail.com

2. Personal Data We Collect

We collect only such personal data as is necessary for the purposes described in this Privacy Policy. Depending on your interaction with us, we may collect:

• Full name;
• Email address;
• Mobile phone number;
• Event registration details;
• Ticketing information;
• Communication and subscription preferences;
• Information voluntarily provided through enquiry forms, surveys, or correspondence; and
• Any other information you choose to provide while interacting with us.

We request that you provide only accurate and up-to-date information.

3. Purpose of Processing

We process your personal data only for lawful, specific, and legitimate purposes, including to:

• register you for BSides Mumbai events;
• process and manage event registrations;
• notify you regarding ticket availability and confirmations;
• send event schedules, announcements, reminders, and important updates;
• communicate with you regarding enquiries or support requests;
• administer and improve our events and related services;
• send newsletters or future event communications where you have expressly chosen to receive them;
• maintain records relating to registrations and participation; and
• comply with applicable legal, regulatory, or contractual obligations.

We shall not process your personal data for any purpose that is incompatible with the purposes stated above unless permitted under applicable law or with your consent.

4. Lawful Basis for Processing

Where required under applicable law, we process your personal data based on your consent.

By voluntarily submitting your personal data through our website, registration forms, or other communication channels, you consent to its processing for the purposes specified in this Privacy Policy.

You may withdraw your consent at any time by contacting us using the details provided below. Withdrawal of consent shall not affect any processing undertaken prior to such withdrawal.

5. Ticketing and Payment Processing

Event registrations and ticket purchases may be facilitated through our authorised ticketing partner, MeraEvents.

Any payment-related information, including debit card details, credit card details, UPI credentials, banking information, or other payment credentials, is collected and processed directly by MeraEvents.

BSides Mumbai does not collect, receive, process, or store your payment credentials.

The processing of payment information is governed solely by MeraEvents' applicable privacy policy and terms of service.

6. Disclosure of Personal Data

We respect your privacy and do not sell, rent, trade, license, or otherwise disclose your personal data to sponsors, advertisers, or other third parties for their independent marketing or commercial purposes.

We may disclose or share your personal data only to the extent reasonably necessary for the purposes described in this Privacy Policy, including:

• with trusted third-party service providers engaged to support the operation of our website and the administration of BSides Mumbai events;
• with service providers responsible for website hosting, event registration, ticketing, payment processing, email communications, and other technology or operational support services;
• where disclosure is required to comply with applicable law, judicial order, regulatory requirement, or directions issued by a competent governmental authority;
• to establish, exercise, or defend our legal rights, or in connection with legal proceedings; or
• in connection with any merger, acquisition, corporate restructuring, business transfer, or other similar transaction, subject to applicable legal requirements.

Our trusted service providers currently include:

• Cloudflare, which provides website hosting and related infrastructure services, including edge compute (Workers) and key-value storage (KV); and
• MeraEvents, which facilitates event registration, ticketing, and payment processing.

These service providers process personal data solely on our behalf, only to the extent necessary to perform the services for which they are engaged, and in accordance with their respective privacy policies, contractual obligations, and applicable data protection laws.

We require our service providers to implement appropriate technical and organisational measures to safeguard the personal data processed on our behalf. Where personal data is processed outside India by our authorised service providers, we take reasonable steps to ensure that such processing is carried out in accordance with applicable legal and contractual safeguards.

7. Cross-Border Processing of Personal Data

Some of our authorised third-party service providers may process or store personal data outside India in connection with the services they provide to us, such as website hosting, email communications, or other technology services.

Where such processing occurs, BSides Mumbai takes reasonable steps to ensure that your personal data is protected through appropriate contractual, technical, and organisational safeguards, and that such processing is carried out in accordance with the applicable provisions of the Digital Personal Data Protection Act, 2023 and other applicable laws.

8. Data Retention

We retain your personal data only for as long as it is necessary to fulfil the purposes for which it was collected, including:

• administration of event registrations;
• responding to enquiries;
• sending communications for which you have opted in;
• complying with legal, accounting, tax, regulatory, or reporting obligations; and
• establishing, exercising, or defending legal claims.

Upon expiry of the applicable retention period, your personal data shall be securely deleted or anonymised unless continued retention is required under applicable law.

9. Security of Personal Data

We implement reasonable technical, organisational, and administrative safeguards designed to protect your personal data against unauthorised access, disclosure, alteration, misuse, accidental loss, or destruction.

While we strive to use commercially reasonable measures to protect your personal data, no method of electronic transmission or storage can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.

10. Your Rights

Subject to the provisions of the Digital Personal Data Protection Act, 2023, you may have the right to:

• obtain information regarding the personal data processed by us;
• request correction or updating of inaccurate or incomplete personal data;
• request erasure of your personal data where applicable;
• withdraw consent for future processing;
• nominate another individual to exercise your rights in accordance with applicable law; and
• seek redressal of grievances relating to the processing of your personal data.

Requests relating to your personal data may be submitted by emailing: mahaganlegal@gmail.com

We shall endeavour to respond to such requests within the timelines prescribed under applicable law.

11. Cookies and Similar Technologies

Our website may use cookies or similar technologies to enhance user experience, improve website functionality, analyse website traffic, and maintain website security.

Where required by applicable law, we shall obtain your consent before placing non-essential cookies on your device.

You may configure your browser settings to reject or remove cookies; however, doing so may affect certain features or functionality of the website.

12. Third-Party Websites

Our website may contain links to third-party websites or platforms.

This Privacy Policy applies solely to BSides Mumbai. We are not responsible for the privacy practices, security measures, or content of third-party websites, and we encourage you to review their respective privacy policies before providing any personal information.

13. Children's Privacy

Our website and event registration services are intended for individuals who are legally competent to provide consent under applicable law.

If we become aware that personal data relating to a child has been collected in violation of applicable law, we shall take appropriate steps to delete such information, unless retention is required by law.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, business practices, or operational needs.

The revised Privacy Policy shall become effective upon publication on this website. The "Effective Date" above will indicate the latest revision.

We encourage users to review this Privacy Policy periodically.

15. Grievance Redressal

If you have any questions, concerns, or grievances relating to this Privacy Policy or the processing of your personal data, you may contact our designated Grievance Officer.

Grievance Officer — BSides Mumbai Email: mahaganlegal@gmail.com

We will acknowledge and endeavour to resolve grievances within the timelines prescribed under applicable law.

16. Contact Us

For any questions regarding this Privacy Policy or your personal data, please contact us at:

BSides Mumbai Email: mahaganlegal@gmail.com