This Privacy Policy explains how VULNHAT (Pvt) Ltd (“VULNHAT”, “we”, “us” or “our”), a company incorporated in Colombo, Sri Lanka, collects, uses, stores, discloses, and protects information when you visit vulnhat.com, communicate with us, or engage our cybersecurity services.

We are a security firm — handling information responsibly is central to what we do. This policy applies to the vulnhat.com website and our direct client engagements. It does not cover third-party websites or services that we link to or that operate on separate subdomains under their own terms.

We collect only the information necessary to deliver and improve our services:

• Information you provide. Name, business name, email address, phone number, and any details you submit through our contact forms, proposals, or correspondence.
• Engagement information. Scope documents, authorisations, technical details, and findings exchanged during a security engagement under a signed agreement.
• Technical information. IP address, browser type, device information, pages visited, and similar log data automatically collected when you use our website.

We do not knowingly collect personal information from anyone under the age of 18, and our services are intended for organisations and professionals only.

We use the information we collect to:

• Respond to enquiries and provide quotations or proposals;
• Deliver, manage, and support the security services you engage us for;
• Communicate about engagements, scheduling, deliverables, and invoicing;
• Maintain the security, integrity, and performance of our website and systems;
• Comply with legal, regulatory, and contractual obligations.

We do not sell your personal information, and we do not use engagement data for any purpose beyond the agreed scope of work.

All client engagements are conducted under strict confidentiality. Technical findings, vulnerabilities, credentials, system details, and any data accessed during an assessment are treated as highly sensitive and are handled only by authorised personnel directly assigned to your engagement.

We do not publish case studies that identify clients, and we do not disclose client identities or findings to third parties except where required by a signed agreement or applicable law.

We process personal information where one or more of the following applies:

• You have given consent (for example, by submitting a contact form);
• Processing is necessary to perform a contract or to take steps before entering one;
• Processing is necessary to meet a legal obligation;
• Processing is in our legitimate interests — such as securing our systems and operating our business — provided those interests are not overridden by your rights.

We may share information only in limited circumstances:

• Service providers. Trusted vendors (e.g. infrastructure, email, or payment processors) who process information on our behalf under confidentiality obligations.
• Legal requirements. Where disclosure is required by law, court order, or to protect our rights, safety, or property.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to equivalent protections.

We never sell, rent, or trade your personal information.

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including encryption in transit, access controls on a need-to-know basis, and secure handling of engagement deliverables.

We retain personal and engagement information only for as long as necessary to fulfil the purposes described in this policy and to comply with our legal, accounting, and contractual obligations. Engagement materials are securely deleted or returned in accordance with the relevant engagement agreement.

Subject to applicable law, you may have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information where there is no overriding obligation to retain it;
• Object to or restrict certain processing;
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, contact us at info@vulnhat.com. We will respond within a reasonable timeframe.

Our website may use a minimal number of cookies and similar technologies to operate correctly, remember preferences, and understand aggregate usage. You can control or disable cookies through your browser settings; some features may not function as intended if cookies are disabled.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates when it was last revised. Material changes will be highlighted where appropriate. Continued use of our website or services after an update constitutes acceptance of the revised policy.