GDPR Statement

1. Scope

This statement applies to personal data of individuals located in the European Economic Area (EEA) and the United Kingdom (UK) who use the Coconut Security Dashboard. Security Brigade Infosec Pvt. Ltd. is committed to processing such data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

2. Data Controller and Data Processor

For audit data (vulnerability findings, reports, compliance data): your organisation is the Data Controller and Security Brigade acts as the Data Processor, processing data on your organisation's behalf and instructions as set out in the Data Processing Agreement (DPA) annexed to the Master Services Agreement.

For account data (name, email, login information): Security Brigade is the Data Controller, processing this data for the purpose of providing and securing Platform access.

3. Lawful Basis for Processing

• Contract: Processing necessary to perform our obligations under the service agreement with your organisation (Art. 6(1)(b)).
• Legitimate Interest: Platform security, error monitoring, fraud prevention (Art. 6(1)(f)).
• Consent: Analytics cookies and tracking (Art. 6(1)(a)) — you may withdraw consent at any time.
• Legal Obligation: Compliance with applicable laws (Art. 6(1)(c)).

4. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we process about you.
• Right to Rectification (Art. 16): Request correction of inaccurate data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent for analytics tracking at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

5. International Data Transfers

Your data is primarily stored and processed in India. India is not currently subject to an adequacy decision by the European Commission. To ensure adequate protection for data transferred from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements with all sub-processors that include appropriate safeguards.

6. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that pose a high risk to data subjects, including the processing of security vulnerability data which may indirectly relate to identifiable individuals.

7. Sub-Processors

We use the following sub-processors:

Sub-Processor	Purpose	Location
Cloud Infrastructure Provider	Platform hosting	India
Sentry / GlitchTip (self-hosted)	Error tracking	India
Mixpanel	Product analytics (with consent)	United States

8. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Art. 33) and, where required, notify affected data subjects without undue delay (Art. 34).

9. Supervisory Authority

If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

10. Contact — Data Protection

For GDPR-related enquiries:
Email: [email protected]
Security Brigade Infosec Pvt. Ltd., Mumbai, Maharashtra, India.