1. Introduction
PentestPilot (“we”, “our”, or “us”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you:
- Visit our website
- Engage with our services
- Communicate with us in a professional capacity
PentestPilot operates under the laws of Bangladesh and conducts its data processing activities in accordance with applicable legal and regulatory frameworks, including the Cyber Security Act, 2023, along with internationally recognized data protection and information security practices.
Where our services involve individuals or organizations from other jurisdictions, we endeavor to apply safeguards consistent with relevant international data protection standards, to the extent applicable to the nature and scope of the engagement.
2. Information We Collect
We may collect and process the following categories of information:
2.1 Information You Provide
- Name, email address, and contact details
- Company name and professional role
- Information submitted through forms, emails, or service inquiries
2.2 Technical and Usage Data
- IP address
- Browser type and device information
- Website interaction data (e.g., pages visited, session duration)
2.3 Service-Related Data
In the course of delivering cybersecurity services (including penetration testing), we may process:
- System and application-level technical data
- Network and security logs
- Limited exposure to personal or financial data strictly within authorized scope
Such access is incidental, controlled, and restricted to what is necessary for testing and validation purposes.
3. How We Use Information
We use collected information to:
- Provide, operate, and improve our services
- Communicate with users and clients
- Respond to inquiries and service requests
- Maintain security and prevent unauthorized activity
We do not engage in unauthorized profiling or sell personal data.
4. Legal Basis for Processing
Where applicable, we process personal data based on:
- User consent
- Legitimate business interests (e.g., service delivery, cybersecurity)
- Contractual necessity
All processing is limited to clearly defined and lawful purposes.
5. Data Sharing and Disclosure
We do not sell or rent personal data. We may disclose information only:
- To authorized personnel or contractors under strict confidentiality obligations
- When required by law, regulation, or legal process
- To protect our legal rights, systems, or users
All third-party access is controlled and minimized.
6. Data Security
We implement appropriate technical and organizational safeguards, including:
- Encryption of data in transit and at rest
- Role-based access controls (RBAC)
- Secure handling and monitoring practices
While we take reasonable measures to protect data, no system can be guaranteed to be completely secure.
7. Data Retention
We retain personal data only for as long as necessary to:
- Fulfill the purposes outlined in this Policy
- Comply with legal, regulatory, or contractual obligations
Data is securely deleted or anonymized after the retention period expires.
8. Professional Engagement References
In the context of business-to-business engagements, PentestPilot may reference its professional experience in a limited and non-sensitive manner.
Such references may include:
- The name and/or logo of client organizations
- A high-level description of services provided
These references:
- Do not include confidential, technical, or sensitive information
- Do not disclose vulnerabilities, findings, or internal systems
- Are used solely for informational and professional credibility purposes
Organizations may request removal of such references, and PentestPilot will comply within a reasonable timeframe.
9. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Request correction or deletion
- Withdraw consent where applicable
Requests can be submitted through the contact details provided below.
10. Service Nature and Limitation of Responsibility
PentestPilot provides cybersecurity assessment and advisory services on an “as-is” and “as-available” basis, with the objective of identifying potential vulnerabilities and improving overall security posture.
While PentestPilot applies industry-recognized methodologies and reasonable professional care, users and clients acknowledge that:
- Security assessments are inherently limited and may not identify all vulnerabilities or risks
- The effectiveness of recommendations depends on implementation, system configuration, and operational controls beyond PentestPilot’s scope
Accordingly, to the fullest extent permitted by applicable law, PentestPilot shall not be responsible for:
- Any security incidents, breaches, or damages occurring after completion of services
- Any indirect, incidental, or consequential damages, including loss of profits, data, or reputation
- Any outcomes resulting from reliance on provided reports, findings, or recommendations
PentestPilot’s role is strictly limited to assessment and advisory functions, and its services do not constitute a guarantee or warranty of complete security.
Nothing in this Policy shall exclude or limit liability where such limitation is not permitted under applicable law.
11. International Data Transfers
Where necessary, data may be processed in jurisdictions outside the user’s country. In such cases, appropriate safeguards are implemented to ensure data protection standards consistent with applicable laws.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be reflected by revising the “Effective Date.”
Continued use of our website or services constitutes acceptance of the updated Policy.
13. Contact Information
For questions, requests, or concerns regarding this Privacy Policy: