Effective Date: September 19, 2026

1. Who We Are

Oberon Services Ltd. ("Oberon," "we," "us," or "our") is a private limited company registered in Bangladesh, providing managed cybersecurity services. This Privacy Policy explains how we collect, use, and protect personal information gathered through our public website, oberon-services.com (the "Website").

Registered Address:
House # 31, Road # 02, Block-E, Banasree, Rampura, Dhaka-1219, Bangladesh

Contact for privacy matters: security@oberon-services.com

*[Note: Oberon does not currently have a formally designated Chief Data Officer. This contact email serves as our privacy point of contact. If a Chief Data Officer or dedicated privacy officer is appointed, this section should be updated accordingly.]*

2. Scope of This Policy — Please Read Carefully

This Policy covers only personal information collected through this Website — for example, when you fill out our contact form or otherwise interact with oberon-services.com as a visitor.

This Policy does not cover how Oberon handles data on behalf of our cybersecurity clients. When Oberon delivers managed security services (SOC monitoring, threat detection, incident response, and similar services) to a contracted client, we process security telemetry, logs, and related data strictly under the terms of that client's signed Service Agreement and any applicable Data Processing Agreement — not under this Website Privacy Policy. If you are an Oberon client, please refer to your service contract for how your organization's data is handled.

3. Information We Collect

Contact Form. When you use the contact form on this Website, you may provide your name, email address, company name, and message content. At present, submitting this form opens a pre-filled email in your own email application addressed to security@oberon-services.com — the information you enter is not transmitted to or stored on Oberon's servers through the Website itself. It becomes an ordinary email once you choose to send it, and from that point is handled as part of our normal business correspondence.

*[If this contact form is later connected to a backend system that stores submissions directly, this section must be updated to describe that storage, retention period, and processing basis.]*

No Cookies or Tracking. This Website does not currently use cookies, analytics tools, advertising pixels, or any other tracking technology to monitor visitor behavior.

Administrative Data. Oberon staff who administer this Website (to publish blog posts, manage FAQs, etc.) have individual login credentials (email address and password, securely hashed) stored in our backend systems. This is internal operational data, not data about Website visitors.

4. How We Use Information

We use the information described above solely to:

• Respond to inquiries submitted through our contact form;
• Communicate with prospective and existing clients about our services;
• Maintain and administer the Website itself.

We do not use Website visitor information for advertising, profiling, or automated decision-making.

5. Legal Basis for Processing

Where the Bangladesh Personal Data Protection Act, 2026 (Act No. 63 of 2026) applies, we process personal information on the basis of your consent (for example, by voluntarily submitting the contact form) and our legitimate interest in responding to business inquiries.

6. Where Your Data Is Stored

Oberon uses different infrastructure for different categories of data, consistent with Bangladesh's data localization requirements:

• Website and administrative data (this Website's content management system, including any future contact form submissions and staff admin accounts) is hosted on cloud infrastructure located in the ap-south-1 (Mumbai, India) region.
• Client security service data (SOC monitoring, telemetry, and related information processed while delivering contracted cybersecurity services) is hosted on infrastructure located within Bangladesh, consistent with data localization requirements applicable to sensitive and critical-infrastructure-related data.

7. Data Retention

We retain personal information collected through this Website only for as long as reasonably necessary to fulfil the purposes described in this Policy, or as required by applicable law. We do not retain Website visitor data indefinitely without business justification.

8. Sharing of Information

We do not sell personal information. We may share information collected through this Website with:

• Service providers who help us operate the Website (such as our cloud infrastructure provider), bound by appropriate confidentiality and data protection obligations;
• Authorities or regulators, where required by applicable Bangladeshi law.

9. Your Rights

Under the Personal Data Protection Act, 2026, and subject to its terms and any applicable exemptions, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate information;
• Request erasure of your information, subject to legal retention requirements;
• Withdraw consent to processing, where consent is the basis for that processing;
• Request a copy of your data in a portable format.

To exercise any of these rights, contact us at security@oberon-services.com. We will respond within a reasonable timeframe consistent with applicable law.

10. Data Breach Notification

In the event of a data breach affecting your personal information, we will take appropriate steps consistent with our obligations under applicable Bangladeshi law, including notification to the relevant regulatory authority and, where required, to affected individuals.

*[Note: at the time of drafting, the precise scope and timing of mandatory breach notification obligations under the Personal Data Protection Act, 2026 is unsettled in publicly available legal commentary — some sources describe an authority-notification duty for breaches causing "significant damage," while others suggest the Act lacks a clear mandatory notification requirement. This section should be reviewed and finalized with qualified Bangladeshi legal counsel once the Act's implementing regulations are clarified.]*

11. Children's Privacy

This Website is intended for business audiences and is not directed at children. We do not knowingly collect personal information from individuals under the age of 18 through this Website.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Effective Date" at the top of this page will be updated accordingly. Material changes will be reflected prominently on this page.

13. Contact Us

For any questions about this Privacy Policy or how we handle your information, contact us at:

Oberon Services Ltd.
House # 31, Road # 02, Block-E, Banasree, Rampura, Dhaka-1219, Bangladesh
Email: security@oberon-services.com
Phone: +880 1720-596676

*This document was prepared with reference to publicly available information on the Bangladesh Personal Data Protection Act, 2026, current as of September 2026. It is not a substitute for review by a qualified lawyer licensed in Bangladesh, and should be reviewed by one before publication.*