Privacy Policy
Last updated: October 2, 2026
PentestProviders UK is operated by BugFoe Private Limited ("BugFoe", "we", "us"), registered in India with its office in Ahmedabad, Gujarat. This notice sets out the personal information this website gathers, the reasons we need it, the people who can see it and the choices open to you. Questions about any of it can go to sales@bugfoe.com.
1. Who controls your information
For UK data protection purposes, meaning the UK GDPR and the Data Protection Act 2018, BugFoe is the controller of information collected through this site. Indian law, specifically the Digital Personal Data Protection Act, 2023, treats BugFoe as the Data Fiduciary for the same information.
2. Information we gather
- From you directly: name, business email address, employer, an optional telephone number, the kind of testing you want, any audit or compliance reason, target dates, headcount band and the text of your message.
- From your browser: IP address, browser and operating system, the pages you open and when. These records help us protect the site, filter junk submissions and slow down automated abuse.
- Through cookies: explained separately in the Cookie Notice.
Our forms are not the place for passwords, access keys, details of unpatched weaknesses or anybody else's personal information. When scoping needs sensitive material, we will set up a secure route for it.
3. Purposes and lawful bases
| What we do with it | UK GDPR lawful basis |
|---|---|
| Replying to an enquiry and drawing up a proposal | Pre-contract steps taken at your request; legitimate interests |
| Delivering a test or retest you have commissioned | Performance of a contract |
| Defending the website against spam, fraud and misuse | Legitimate interests |
| Measuring visits, if analytics is active | Consent |
| Serving adverts on Resources pages, if advertising is active | Consent |
| Tax, accounting and other statutory duties | Legal obligation |
4. Google AdSense advertising
Adverts from Google AdSense may appear on some Resources pages. We keep adverts off service descriptions, pricing, quote requests and contact pages.
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to this site and/or other sites on the Internet.
- To switch off personalised ads from Google, use Google Ads Settings. Many other ad vendors offer the same choice through www.youronlinechoices.eu and www.aboutads.info.
- For Google's own account of how it handles data gathered on partner websites like this one, see Google's partner sites policy page.
People browsing from the UK, the EEA or Switzerland are asked first, through a Google-certified consent tool, whether they accept advertising and analytics cookies. Nothing of that kind is placed until they agree, and the "Privacy and cookie settings" link on ad-bearing pages lets anyone change their mind later.
5. Analytics
If we turn on Google Analytics 4, it reports aggregate figures such as visits and referring sites. Consent Mode keeps analytics cookies off until a visitor opts in, and Google Analytics 4 neither logs nor stores IP addresses.
6. Recipients
Personal information is not sold or hired out. The only parties who receive it are:
- Hostinger, which hosts the site, and the email services that carry our messages, each acting on our instructions;
- Google, for analytics and adverts as set out above, and only where you have allowed it;
- lawyers, accountants and other advisers, plus public bodies when a legal duty requires disclosure.
7. International transfers
Because BugFoe is based in India, information sent from the UK is processed there and wherever our suppliers host their systems. When UK law requires a safeguard for such a transfer, we use one it recognises, for example approved contract clauses.
8. Retention
Enquiry records are held for a maximum of 24 months from our last exchange, longer only if an active engagement needs them. Engagement material is kept for the period your contract sets. Security logs are cleared after no more than 12 months.
9. What you can ask us to do
The UK GDPR lets you request a copy of your information, correction of anything wrong, deletion, restriction of use, a portable copy, and to object to processing or take back consent. Similar rights may apply to you under India's DPDP Act 2023 or certain US state laws. We do not sell personal information. Google's advertising cookies on Resources pages are the only form of sharing for cross-context behavioural advertising, and you can turn them off using the options in section 4.
Write to sales@bugfoe.com with the subject line "Privacy Request" and we will respond inside a month. You also have the right to raise a concern with the Information Commissioner's Office, which regulates data protection in the UK.
10. Security of this site
All traffic to the site is encrypted with HTTPS. Submitted forms are screened for spam, kept in access-restricted storage and opened only by staff who need to reply.
11. Under-18s
The site serves businesses and other organisations. It is not designed for people under 18, and we do not set out to collect their information.
12. Changes
If we revise this notice, the date at the top of the page will change, and anything significant will be flagged here.