Website Security & Responsible Disclosure Policy

Effective Date: 22 September 2026
Last Updated: 22 September 2026

At BrandRipple InfoTech (“BRIT”, “BrandRipple InfoTech”, “we”, “us”, “our”, or “the Company”), we take the security, integrity and availability of our Website, digital systems and customer-facing services seriously.

This Website Security & Responsible Disclosure Policy (“Security Policy”) explains BRIT’s general approach to Website security, account security, online payments, Digital Product access, security incidents, vulnerability reporting and responsible disclosure.

This Policy applies to:

• https://brandrippleinfotech.com/;
• BRIT customer accounts, where available;
• online shopping and checkout functionality;
• Digital Product delivery systems;
• download systems;
• Website forms;
• customer-support systems;
• publicly accessible Website interfaces;
• other BRIT-controlled digital systems made available to users; and
• security concerns relating to these systems.

This Policy should be read together with BRIT’s:

• Terms & Conditions;
• Privacy Policy;
• Refund, Cancellation & Digital Product Delivery Policy;
• Digital Product License & Usage Policy;
• Cookie Policy;
• Website Disclaimer;
• Intellectual Property & Copyright Policy;
• Grievance Redressal Policy; and
• other applicable policies.

By accessing or using the Website, you agree to comply with the security-related requirements described in this Policy and the Terms & Conditions.

1. Purpose of This Policy

The purpose of this Policy is to:

• protect the Website and its users;
• establish reasonable security expectations;
• explain responsible vulnerability reporting;
• discourage unauthorized access and misuse;
• provide a channel for security-related concerns;
• support appropriate incident response; and
• clarify the limitations applicable to Website security.

2. Our Security Approach

BRIT aims to use reasonable technical, administrative and organisational measures appropriate to the nature of its Website and Services.

Depending on the systems involved, these measures may include:

• access controls;
• authentication;
• secure communications;
• software updates;
• backups;
• monitoring;
• restricted administrative access;
• malware and abuse protections;
• payment-provider security controls;
• account protections;
• download protections; and
• other reasonable security measures.

The exact security controls may change as the Website and underlying technology evolve.

3. No System Can Be Guaranteed Completely Secure

Although BRIT takes reasonable precautions, no Website, server, database, cloud service, software application, network or electronic transmission can be guaranteed to be completely secure.

Accordingly, BRIT does not represent or warrant that the Website will always be:

• free from vulnerabilities;
• free from malicious software;
• continuously available;
• immune from cyberattacks;
• immune from unauthorized access; or
• completely error-free.

4. Security of Website Communications

Where appropriate, BRIT may use secure communication technologies such as HTTPS/TLS for Website traffic.

Users should verify that they are interacting with the official BRIT Website before providing personal information, payment information or account credentials.

5. Customer Account Security

Where BRIT provides customer accounts, users are responsible for maintaining the security of their:

• username;
• password;
• authentication information;
• email account;
• device; and
• other account credentials.

Users should:

• use strong passwords;
• avoid reusing passwords across services;
• avoid sharing credentials;
• protect their devices;
• log out from shared devices; and
• notify BRIT promptly if unauthorized access is suspected.

6. Prohibited Account Sharing

Customers must not knowingly allow unauthorized persons to use their BRIT account where account access is intended for an individual or authorized business users.

This is particularly relevant to:

• Digital Product access;
• download facilities;
• order information;
• customer records; and
• other account-protected functions.

Account sharing may result in suspension or termination subject to the applicable Terms & Conditions.

7. Online Payment Security

Payments made through BRIT’s Website may be processed by third-party payment gateways and financial service providers.

These providers may use their own:

• encryption;
• authentication;
• fraud detection;
• transaction monitoring;
• security controls; and
• other protective measures.

BRIT does not control the internal security systems of independent payment providers.

8. Payment Credentials

BRIT does not ask customers to provide sensitive payment authentication information through ordinary customer-support channels.

Customers should never disclose:

• UPI PIN;
• card PIN;
• online banking password;
• OTP;
• CVV;
• ATM PIN;
• private API keys; or
• other confidential authentication credentials

to BRIT personnel through email, social media, messaging applications or ordinary Website forms.

9. Fraud Prevention

BRIT may use technical controls and third-party services to identify suspicious activity relating to:

• online payments;
• customer accounts;
• Digital Product downloads;
• automated requests;
• unusual login activity;
• repeated failed transactions;
• unauthorized access attempts; or
• other potentially fraudulent behavior.

Such controls may occasionally result in legitimate activity being delayed, challenged or restricted.

10. Digital Product Security

Where BRIT sells Digital Products, reasonable technical measures may be used to protect downloadable resources.

These may include:

• secure download links;
• login authentication;
• access tokens;
• download limits;
• time-limited access;
• account-based delivery;
• transaction verification; and
• other access controls.

Attempting to bypass or disable such controls is prohibited.

11. Unauthorized Digital Product Access

Users must not attempt to:

• access another customer’s downloads;
• guess or manipulate download URLs;
• bypass access restrictions;
• extract protected files;
• circumvent download limits;
• obtain Products without payment; or
• otherwise access Digital Products without authorization.

Such conduct may violate the Terms & Conditions, Digital Product License and applicable law.

12. Website Security and Intellectual Property

Security controls may protect BRIT’s:

• Website;
• Digital Products;
• source materials;
• software;
• account systems;
• confidential information;
• creative assets; and
• other intellectual property.

Unauthorized attempts to access protected resources may also constitute intellectual-property misuse.

13. Prohibited Security Activities

Unless expressly authorized in writing by BRIT, users must not:

• conduct penetration testing;
• perform vulnerability scanning;
• conduct automated security testing;
• attempt privilege escalation;
• perform denial-of-service testing;
• conduct brute-force attacks;
• attempt credential stuffing;
• test authentication bypasses;
• exploit Website vulnerabilities;
• introduce malware;
• attempt SQL injection;
• attempt cross-site scripting;
• manipulate APIs;
• access restricted files;
• access another user’s account;
• interfere with Website availability; or
• otherwise test or attack BRIT systems.

Even security research intended in good faith may negatively affect live systems and should not be performed without authorization.

14. Automated Scanning

Automated crawlers, scanners, scripts or bots must not be used to probe or test BRIT systems for vulnerabilities without prior written authorization.

Ordinary search-engine indexing or normal user interaction is not considered security testing merely because it involves automated requests.

15. Denial-of-Service and Availability Testing

Users must not intentionally generate excessive traffic or requests intended to:

• slow the Website;
• exhaust resources;
• disrupt services;
• interfere with other users;
• overwhelm servers; or
• cause an outage.

This includes distributed or coordinated denial-of-service activity.

16. Brute-Force and Credential Attacks

Users must not attempt to obtain unauthorized access through:

• password guessing;
• credential stuffing;
• brute-force attacks;
• session hijacking;
• authentication bypass;
• token manipulation; or
• similar methods.

17. Malware and Malicious Code

You must not upload, transmit, distribute or execute malicious software or code through BRIT systems.

Examples include:

• viruses;
• worms;
• ransomware;
• spyware;
• keyloggers;
• malicious scripts;
• trojans;
• cryptominers; and
• other malicious code.

18. Phishing and Impersonation

Users must not use BRIT’s:

• Website;
• brand name;
• logos;
• email infrastructure;
• customer communications;
• Digital Products; or
• other digital assets

to conduct phishing, impersonation, fraud or other deceptive activities.

19. Reporting Suspicious Activity

Users are encouraged to notify BRIT if they identify:

• suspicious Website behavior;
• unauthorized account activity;
• fraudulent payment requests;
• compromised download links;
• suspected malware;
• suspicious redirects;
• impersonation;
• phishing involving BRIT; or
• another material security concern.

20. Responsible Vulnerability Disclosure

BRIT encourages responsible reporting of genuine security vulnerabilities affecting BRIT-controlled systems.

A person who identifies a potential vulnerability should report it privately rather than publicly disclosing the issue before BRIT has had a reasonable opportunity to investigate.

21. Security Contact

Security vulnerabilities and security-related concerns may be reported to:

Security Contact Email:
brandrippleinfotech@gmail.com

Website:
https://brandrippleinfotech.com/

BrandRipple InfoTech
Puducherry, India

Please use the latest security contact information published on the Website.

22. Information to Include in a Vulnerability Report

A useful vulnerability report should, where reasonably possible, include:

• a clear description of the issue;
• affected URL, endpoint or feature;
• steps required to reproduce the issue;
• expected behavior;
• actual behavior;
• screenshots or evidence where appropriate;
• affected account type, without disclosing unnecessary personal information;
• potential security impact; and
• any relevant technical information.

The more precise the report, the easier it may be for BRIT to investigate.

23. Do Not Include Unnecessary Sensitive Data

When reporting a vulnerability, do not send:

• passwords;
• payment credentials;
• UPI PINs;
• OTPs;
• private encryption keys;
• unnecessary personal data;
• unrelated customer records; or
• other confidential information

unless BRIT specifically requests it and appropriate secure arrangements have been established.

24. Minimal Testing Principle

Security researchers and other reporters should use the minimum level of testing reasonably necessary to demonstrate a vulnerability.

You should not:

• access data belonging to other customers;
• modify or delete data;
• download large amounts of information;
• disrupt services;
• establish persistent unauthorized access;
• perform destructive testing;
• conduct social engineering against BRIT personnel; or
• create unnecessary operational risk.

25. No Destructive Testing

Reports should not require:

• destruction of data;
• modification of production records;
• service interruption;
• deletion of customer information;
• disabling security controls;
• denial-of-service activity; or
• other destructive actions.

A vulnerability should be demonstrated with the least invasive method reasonably available.

26. No Access to Other Users’ Information

If a vulnerability appears capable of exposing another person’s information, stop testing as soon as the issue has been sufficiently demonstrated.

Do not access, download, copy, retain, publish or distribute data belonging to other users.

If limited exposure occurs unintentionally, report the incident immediately and securely delete any inadvertently obtained information where legally and technically appropriate.

27. Responsible Disclosure Timeline

After receiving a security report, BRIT may:

1. acknowledge receipt;
2. assess the reported issue;
3. request additional information;
4. reproduce the issue;
5. determine severity and scope;
6. implement appropriate corrective measures;
7. coordinate with affected providers where necessary; and
8. communicate an appropriate resolution or status where practicable.

Response and remediation timelines may vary according to:

• severity;
• complexity;
• affected systems;
• third-party dependencies;
• operational risk;
• availability of a fix; and
• other circumstances.

28. Vulnerability Severity

BRIT may evaluate reported vulnerabilities based on factors such as:

• likelihood of exploitation;
• confidentiality impact;
• integrity impact;
• availability impact;
• affected users;
• attack complexity;
• authentication requirements;
• business impact; and
• exploitability.

BRIT may use recognized security assessment methodologies as appropriate, but does not guarantee that every reported vulnerability will be assigned a particular severity classification.

29. Third-Party Vulnerabilities

Some security issues may originate from:

• hosting providers;
• plugins;
• themes;
• payment gateways;
• cloud systems;
• software libraries;
• APIs;
• analytics tools;
• e-commerce platforms;
• AI providers; or
• other third-party systems.

Where appropriate, BRIT may notify or coordinate with the relevant provider.

BRIT cannot guarantee the remediation schedule or security decisions of an independent third party.

30. Vulnerabilities in Third-Party Systems

Where a vulnerability exists solely within a third-party system that BRIT does not control, BRIT may direct the reporter to the relevant provider’s security or vulnerability-reporting channel.

BRIT may nevertheless investigate whether the issue has an impact on BRIT’s own systems.

31. Safe Harbor for Good-Faith Reports

BRIT appreciates good-faith security research that complies with this Policy.

Where a person:

• acts in good faith;
• avoids unnecessary access;
• does not intentionally disrupt services;
• does not obtain or disclose unnecessary personal information;
• promptly reports the issue privately; and
• complies with applicable law,

BRIT will consider the report as responsible security research.

Nothing in this Policy creates immunity from liability under applicable law or guarantees that BRIT will refrain from taking action in every circumstance.

32. No Authorization to Test

The existence of this Responsible Disclosure Policy does not automatically grant permission to conduct penetration testing, scanning or exploitation against BRIT systems.

If a proposed test requires more than minimal verification of a potential vulnerability, written authorization should be obtained before conducting the test.

33. No Security Research Against Third Parties

This Policy applies only to systems under BRIT’s control.

It does not authorize security testing against:

• payment gateways;
• banks;
• hosting providers;
• social-media platforms;
• customer systems;
• third-party Websites;
• software vendors;
• cloud services; or
• other external infrastructure.

Researchers should follow the relevant third party’s vulnerability-reporting policy.

34. Customer Security Responsibilities

Users are expected to take reasonable steps to protect themselves, including:

• maintaining secure passwords;
• protecting devices;
• installing security updates;
• avoiding suspicious links;
• verifying payment requests;
• avoiding unauthorized software;
• protecting account credentials; and
• reporting suspected compromise promptly.

35. Phishing and Fraudulent Communications

BRIT will not ordinarily request confidential authentication credentials through ordinary email or messaging.

Users should be cautious of messages falsely claiming to be from BRIT that request:

• payments;
• passwords;
• OTPs;
• UPI PINs;
• card information;
• account credentials;
• software installation; or
• unusual downloads.

Suspected impersonation or phishing involving BRIT should be reported through the official security or customer-support contact.

36. Security Incident Response

If BRIT identifies a suspected security incident, BRIT may take reasonable steps to:

• investigate;
• contain;
• mitigate;
• preserve evidence;
• secure affected systems;
• restore services;
• assess affected information;
• coordinate with service providers;
• notify affected parties where required; and
• comply with applicable legal or regulatory obligations.

37. Cybersecurity Incident Reporting

Where applicable legal or regulatory requirements impose reporting obligations on BRIT or a relevant service provider, BRIT will take appropriate steps to comply with those obligations.

CERT-In is India’s national agency for responding to computer-security incidents, and its 28 April 2022 directions cover areas including incident reporting, logging and specified categories of cyber incidents.

The CERT-In directions list, among other categories, unauthorized access, website intrusion/defacement, data breaches, data leaks, attacks affecting e-commerce applications and incidents affecting digital-payment systems.

The specific legal obligations applicable to BRIT will depend on BRIT’s legal status, systems, service providers, nature of the incident and the law applicable at the relevant time.

38. Security Logs and Records

BRIT may maintain security-related records and logs for purposes such as:

• security monitoring;
• incident investigation;
• fraud prevention;
• troubleshooting;
• service administration;
• legal compliance; and
• protection of BRIT and its users.

Retention will be subject to applicable legal, operational and security requirements.

39. Privacy During Security Investigations

Security investigations may involve information such as:

• IP addresses;
• timestamps;
• account information;
• device information;
• logs;
• transaction references;
• technical identifiers; and
• other security-related information.

Such information will be handled in accordance with BRIT’s Privacy Policy and applicable law.

40. Security Incident Notification

Where a security incident affects personal data or creates another legally reportable event, BRIT may provide notices or reports where required by applicable law.

The timing, content and recipients of such notifications may depend on:

• the nature of the incident;
• affected information;
• legal requirements;
• regulatory directions;
• available facts; and
• security considerations.

41. Evidence Preservation

Where a material security incident occurs, BRIT may preserve relevant:

• system logs;
• transaction records;
• account information;
• access records;
• communications;
• technical evidence; and
• other information

for investigation, legal compliance or enforcement purposes.

42. Cooperation with Authorities

Where legally required or appropriate, BRIT may cooperate with:

• CERT-In;
• law-enforcement agencies;
• courts;
• tribunals;
• regulators;
• payment providers;
• cybersecurity specialists; and
• other competent authorities or service providers.

Information may be disclosed subject to applicable law.

43. CERT-In Contact Information

Where a cyber incident is legally required to be reported to CERT-In, BRIT may use the official reporting mechanism specified by CERT-In.

CERT-In currently identifies incident@cert-in.org.in as its incident-reporting contact and provides its official contact information on its Website.

This reference does not mean that every Website user should directly report ordinary customer-support issues to CERT-In. Users should ordinarily contact BRIT first regarding BRIT-specific Website or transaction issues unless immediate reporting to an appropriate authority is otherwise required or appropriate.

44. Security Advisories

BRIT may issue security notices, updates or advisories where reasonably necessary.

Security communications may be provided through:

• Website notices;
• email;
• customer accounts;
• support channels; or
• other appropriate communication methods.

45. Security Updates and Maintenance

BRIT may periodically:

• update software;
• patch vulnerabilities;
• modify configurations;
• replace plugins;
• change hosting arrangements;
• update security controls;
• modify account protections; or
• temporarily disable features.

These activities may occasionally affect Website availability.

46. Security-Related Service Interruptions

BRIT may temporarily restrict or disable Website functions where necessary to:

• investigate a security incident;
• prevent abuse;
• apply security updates;
• protect customer information;
• protect payment systems;
• mitigate an active threat; or
• perform emergency maintenance.

Where practical, BRIT may provide appropriate communication regarding significant interruptions.

47. Security of Third-Party Integrations

BRIT may integrate third-party services into the Website.

Security of those integrations may depend on:

• API configuration;
• provider controls;
• software updates;
• authentication;
• provider infrastructure; and
• third-party vulnerabilities.

BRIT will make reasonable efforts to use appropriate integrations but cannot guarantee the security of infrastructure completely outside its control.

48. Security and Digital Payments

Digital payment functionality may be dependent on external financial infrastructure.

Security issues involving:

• payment gateways;
• banks;
• UPI networks;
• card networks;
• financial institutions; or
• other payment intermediaries

may require coordination with those providers.

49. Security and Customer Accounts

If a customer suspects account compromise, the customer should:

• change the relevant password where possible;
• secure the associated email account;
• contact BRIT through the official support/security channel; and
• notify the relevant financial provider if financial information may be affected.

50. Security and Digital Product Downloads

If a customer believes a Digital Product download link has been compromised or publicly exposed, they should notify BRIT promptly.

BRIT may:

• disable the link;
• issue a replacement link;
• review access logs;
• investigate unauthorized use; and
• take other reasonable protective measures.

51. Security and Intellectual Property

Security-related access to Digital Products, source files, templates or Website content does not create ownership rights.

Unauthorized access remains subject to the applicable intellectual-property and licensing restrictions.

52. Public Disclosure of Vulnerabilities

Security vulnerabilities should not be publicly disclosed before giving BRIT a reasonable opportunity to investigate and respond, except where disclosure is otherwise required or protected by applicable law.

Public disclosure of an unresolved vulnerability may increase risk to:

• BRIT;
• customers;
• Website users;
• payment systems; or
• third parties.

53. Coordinated Disclosure

Where a vulnerability involves BRIT and a third-party provider, BRIT may coordinate disclosure with that provider.

Timing of public disclosure may therefore depend on:

• BRIT;
• the third-party provider;
• availability of a mitigation;
• severity; and
• applicable law.

54. Security Research Communications

BRIT may communicate with security researchers to:

• request clarification;
• confirm reproduction steps;
• discuss remediation;
• request additional evidence; or
• coordinate responsible disclosure.

Researchers should use the official security contact for such communication.

55. Recognition of Security Researchers

BRIT may, at its discretion, acknowledge responsible security researchers who report valid vulnerabilities.

Any public recognition may depend on:

• researcher preference;
• confidentiality;
• severity;
• legal considerations;
• the availability of a verified fix; and
• BRIT’s internal practices.

Recognition is not guaranteed and does not constitute compensation.

56. No Monetary Reward Unless Expressly Offered

Unless BRIT expressly publishes a bug bounty or reward program, this Security Policy does not create an entitlement to monetary compensation, employment, Services or any other reward for vulnerability reports.

57. Bug Bounty Programs

If BRIT establishes a formal bug bounty program in the future, that program may contain separate:

• eligibility requirements;
• scope;
• exclusions;
• severity criteria;
• rewards;
• disclosure conditions; and
• other rules.

Where such a program exists, its specific terms will govern eligible reports.

58. Out-of-Scope Systems

Unless expressly authorized, security testing should not target:

• customer systems;
• employee systems;
• third-party infrastructure;
• payment provider infrastructure;
• external hosting systems;
• external domains;
• social-media accounts;
• unrelated applications; or
• other systems not explicitly included in a written authorization.

59. Security Reports Without Exploitation

Where possible, a vulnerability should be reported with:

• description;
• reproduction steps;
• evidence;
• impact; and
• remediation suggestions,

without unnecessary exploitation.

60. No Data Exfiltration

Researchers and users must not intentionally exfiltrate data from BRIT systems.

If an application flaw appears capable of exposing data, testing should stop after obtaining only the minimum information needed to demonstrate the vulnerability.

61. No Modification of Production Data

Unless explicitly authorized, users must not:

• modify customer records;
• modify orders;
• change payments;
• alter account permissions;
• modify Website content;
• delete records; or
• otherwise alter production data as part of security testing.

62. No Social Engineering

Security testing must not involve attempting to deceive or manipulate BRIT employees, customers or contractors unless BRIT has expressly authorized a controlled security exercise.

This includes:

• phishing;
• pretexting;
• impersonation;
• credential requests;
• fraudulent support requests; and
• other social-engineering techniques.

63. No Physical Security Testing

This Policy does not authorize:

• physical intrusion;
• attempts to access restricted premises;
• theft or removal of equipment;
• badge testing;
• tailgating; or
• other physical security tests.

Written authorization is required for any such assessment.

64. No Denial of Service

Denial-of-service testing is prohibited unless expressly authorized under a written security-testing arrangement.

65. Security Policy Does Not Replace Contractual Security Agreements

Enterprise clients or partners may have separate:

• information-security agreements;
• data-processing agreements;
• NDAs;
• vendor-security requirements;
• penetration-testing arrangements; or
• incident-response procedures.

Where applicable, those agreements may govern the specific relationship.

66. Customer and Client Security Requirements

Where a client provides systems, credentials, APIs or other access to BRIT for a project, the client remains responsible for:

• granting appropriate permissions;
• maintaining its own security;
• revoking access when appropriate;
• protecting credentials;
• maintaining backups where applicable; and
• informing BRIT of relevant security restrictions.

67. Responsible Access Management

BRIT may use role-based access, least-privilege principles or other access controls where appropriate to limit access to sensitive systems.

The precise implementation may vary based on the system and business requirements.

68. Security and Employee/Contractor Access

BRIT may provide authorized employees, consultants or contractors with access to systems where reasonably necessary to perform their responsibilities.

Access may be limited according to role and business need.

69. Security and Service Providers

Third-party service providers may have access to certain systems or information where necessary to provide:

• hosting;
• cloud infrastructure;
• payments;
• security;
• analytics;
• support;
• e-commerce;
• email;
• Digital Product delivery;
• software; or
• other services.

Such access is subject to the applicable contractual and operational arrangements.

70. Security and Privacy

The collection and processing of personal information for security purposes is governed by BRIT’s Privacy Policy and applicable data-protection law.

Security logs and technical records may be retained where reasonably necessary for security, legal, operational or compliance purposes.

71. Data Protection Framework

India’s Digital Personal Data Protection Act, 2023 establishes a legal framework concerning processing of digital personal data. The Act includes obligations concerning reasonable security safeguards and personal-data breach matters, subject to the applicable provisions and their commencement.

BRIT will comply with applicable data-protection requirements relevant to its operations when the relevant provisions are in force and applicable.

72. Incident Response and Legal Requirements

Security incidents may be subject to different legal obligations depending on:

• the nature of the incident;
• type of information involved;
• systems affected;
• entity classification;
• contractual obligations; and
• applicable laws or regulatory directions.

BRIT will assess incidents according to the circumstances and applicable requirements.

73. No Guaranteed Response to Every Report

BRIT cannot guarantee that:

• every report will receive a particular response time;
• every reported issue will be classified as a vulnerability;
• every report will result in a security change;
• every reported issue will be publicly acknowledged; or
• a reporter will receive a specific outcome.

However, genuine and sufficiently detailed reports may be reviewed through appropriate channels.

74. Security Reports May Be Retained

BRIT may retain vulnerability reports and related communications for:

• investigation;
• remediation;
• security monitoring;
• legal compliance;
• audit;
• future reference;
• incident response; and
• protection of BRIT’s systems.

Information will be handled in accordance with the Privacy Policy and applicable law.

75. No Waiver

Failure by BRIT to immediately enforce a security-related provision does not constitute a waiver of the Company’s right to enforce it later.

76. Changes to This Security Policy

BRIT reserves the right to modify, amend, revise, replace, update, supplement or otherwise change this Website Security & Responsible Disclosure Policy from time to time, subject to applicable law.

Changes may occur because of:

• new Website features;
• new e-commerce systems;
• Digital Product delivery changes;
• payment-system changes;
• new security threats;
• security improvements;
• changes in technology;
• changes in service providers;
• changes in applicable law;
• regulatory developments; or
• other legitimate security or operational reasons.

The latest version will be published on the Website together with the applicable “Last Updated” date.

77. Acceptance of Updated Security Policy

By continuing to access or use the BRIT Website after an updated version of this Policy has been published, you acknowledge the updated Policy to the extent permitted by applicable law.

This applies regardless of whether the Website is accessed through:

• desktop;
• laptop;
• mobile phone;
• tablet;
• browser;
• application;
• direct link;
• email;
• social media;
• search engine;
• advertisement; or
• any other current or future device or access method.

Where a specific legal notice, authorization, consent or contractual agreement is required, that requirement shall prevail.

78. Relationship with Terms & Conditions

This Security Policy forms part of BRIT’s broader Terms & Conditions.

The Terms & Conditions govern general Website use, transactions, Products, Services, intellectual property, liability and disputes.

This Policy specifically addresses security and responsible disclosure.

79. Relationship with Privacy Policy

Security-related collection and processing of information is governed by the BRIT Privacy Policy and applicable data-protection law.

80. Relationship with Intellectual Property Policy

Unauthorized access, copying, extraction or redistribution of BRIT Digital Products or Website materials may also violate BRIT’s Intellectual Property & Copyright Policy and applicable law.

81. Relationship with Grievance Redressal Policy

Ordinary customer complaints should generally be submitted through the BRIT Grievance Redressal mechanism.

Security vulnerabilities should preferably be submitted through the dedicated security contact where one is available.

82. Relationship with Refund Policy

Security incidents affecting payments or Digital Product delivery may also be addressed under the Refund, Cancellation & Digital Product Delivery Policy where applicable.

83. Governing Law

This Security Policy shall be governed by the laws of India, subject to applicable mandatory statutory rights and protections.

84. Dispute Resolution

Any dispute relating to this Security Policy shall be handled in accordance with the dispute-resolution provisions contained in the applicable Terms & Conditions or Project Agreement, subject to applicable law.

85. Contact BrandRipple InfoTech

For general security concerns, suspected Website vulnerabilities, phishing involving BRIT, unauthorized account activity or other security-related matters:

Security Contact Email:
brandrippleinfotech@gmail.com

Customer Support Email:
brandrippleinfotech@gmail.com

Website:
https://brandrippleinfotech.com/

BrandRipple InfoTech
Puducherry, India

Please use the latest official contact information published on the Website.

86. Final Security Acknowledgement

By accessing or using the BRIT Website, customer account, online store, Digital Product delivery system or other digital service, you acknowledge that:

1. BRIT implements reasonable security measures appropriate to its systems and operations;
2. no internet-based system can be guaranteed to be completely secure;
3. users are responsible for maintaining the security of their own accounts and devices;
4. unauthorized security testing, access, exploitation or disruption is prohibited;
5. genuine vulnerabilities may be reported through the responsible-disclosure mechanism;
6. security reports should be submitted privately and responsibly;
7. BRIT may investigate and respond to security incidents in accordance with applicable requirements;
8. third-party providers may be involved in Website, payment and digital-service security;
9. BRIT may modify this Security Policy from time to time; and
10. continued use after an update constitutes acknowledgement and acceptance of the revised Policy to the extent permitted by applicable law.

BrandRipple InfoTech
Building Brands With Creativity, Technology & Purpose.