Privacy notice

Who we are

ZenoPentest is a brand of Zeno Ventures Pvt. Ltd., the company that also operates ZenoCloud. Zeno Ventures Pvt. Ltd. decides how personal data collected through this website is used, and is the data fiduciary under India's Digital Personal Data Protection Act, 2023 and the controller for the purposes of the GDPR and UK GDPR.

• Zeno Ventures Pvt. Ltd.
• CIN: U62099UP2009PTC231728
• Registered address: A-103, iThum, Sector 62, Noida, Uttar Pradesh 201301, India
• Privacy contact: [email protected]

What this notice covers

This notice covers the zenopentest.com website: the pages you read, the cookie notice and the two enquiry forms (scoping and partner). Personal data handled during an engagement, including anything we see while testing, is covered by the written agreement for that engagement, not by this notice.

What we collect through the enquiry forms

When you send an enquiry we receive:

• your name, work email address and organisation;
• the options you chose on the form, such as the type of assessment or partnership;
• any context you type, up to 1,500 characters;
• the page you sent the enquiry from; and
• the country your connection appears to come from, as reported by Cloudflare.

Please keep enquiries high level. Do not send credentials, customer records, deal documents or vulnerability details through the form. If you need to share sensitive material, ask us for a secure route first.

What is collected automatically

• Request data. Cloudflare, which hosts the site, processes your IP address, browser details and the pages you request in order to deliver the site and protect it from abuse.
• Spam check. When you submit a form, Cloudflare Turnstile checks your browser to tell people from bots. We send your IP address to Cloudflare with the check.
• Analytics. Google Analytics 4 records which pages are viewed and how visitors move through the site. See "Analytics and cookies" below.

How we use it

• To reply to your enquiry and to scope and propose a possible engagement.
• To keep a record of enquiries and of any engagement that follows.
• To keep the site and forms secure and to stop spam and abuse.
• To understand which pages are useful, using aggregated analytics.

We do not sell personal data. We do not add you to a marketing list because you sent an enquiry, and we do not use advertising cookies.

Why we are allowed to use it

• India (DPDP Act, 2023). You provide enquiry details voluntarily for a specified purpose: getting a reply about our services. We use them only for that purpose and the related record keeping. Analytics outside the EEA, UK and Switzerland runs by default; you can turn it off at any time with Cookie settings.
• EEA, UK and Switzerland. We rely on our legitimate interests to answer enquiries, to prepare proposals you ask for and to protect the site, and on your consent for analytics cookies.

Who processes it for us

• Cloudflare, Inc. hosts the website, runs the enquiry endpoint, provides Turnstile and sends the enquiry email using Cloudflare Email Sending.
• Google LLC provides Google Analytics 4. Advertising storage, advertising user data and ad personalisation are switched off.
• Our email provider. Each enquiry is delivered as an email to two fixed mailboxes used by Zeno Ventures: the ZenoCloud sales mailbox and a mailbox used by the founder. Replies come from those mailboxes.

We share enquiry details with another organisation only to deliver an engagement you ask for, such as a partner firm named in your proposal, and only after telling you. We may also disclose data when the law requires it.

International transfers

Cloudflare and Google operate globally, and your data may be processed outside your country, including in the United States. Where the GDPR or UK GDPR applies, these providers rely on recognised transfer safeguards such as standard contractual clauses.

How long we keep it

• Enquiry emails: for as long as needed to respond and to manage any engagement that follows, then deleted.
• Analytics data: for the retention period set in Google Analytics.
• Cloudflare request and security data: for Cloudflare's standard retention periods.

Analytics and cookies

In the EEA, the UK and Switzerland, Google Analytics does not load at all until you accept it in the cookie notice. Elsewhere it loads by default in Consent Mode with advertising features switched off. You can change your choice at any time with Cookie settings in the footer.

• zp_cc: your two-letter country code from Cloudflare, kept for one day so the site can show local currency and decide whether to ask for consent.
• zp_consent: your analytics choice, kept for 180 days.
• _ga and _ga_*: Google Analytics cookies, set only where analytics cookies are allowed.
• Cloudflare Turnstile may set a short-lived cookie on pages with a form to tell people from bots.

You can also block or delete cookies in your browser. The site works without analytics cookies.

Security

The site is served only over HTTPS. The enquiry endpoint validates every field, checks Turnstile and sends email only to fixed internal addresses; the address you enter is used only as the reply-to address. Access to enquiry mailboxes is limited to the people who handle enquiries.

Your rights

Depending on where you live, you can ask to access the enquiry data we hold about you, to correct or complete it, to have it erased, to object to or restrict its use, to withdraw consent, and, in India, to nominate someone to exercise your rights. Email [email protected] with "Privacy request" in the subject. We may ask you to confirm your identity.

If you are not satisfied with our response, you may complain to your data protection authority. In India, that is the Data Protection Board of India.

Children

This site is for businesses. It is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

We will update this notice when what we collect, why, or who processes it changes, and change the date at the top of the page.