<p>Gletra maintains a documented incident response plan tested annually through tabletop exercises. Upon confirmed personal data breach, we execute the following response procedures.</p><ol class="mb-3"><li>Contain and assess breach scope within 4 hours of detection</li><li>Notify affected users and the Data Protection Board of India within 72 hours where required by law</li><li>Notify affected EEA/UK users and supervisory authorities per GDPR requirements where applicable</li><li>Provide guidance to affected users on protective measures such as password reset</li><li>Conduct post-incident review and implement remediation to prevent recurrence</li></ol><p>Report suspected security vulnerabilities responsibly to security@gletra.com. We acknowledge valid reports within 48 hours and maintain a responsible disclosure programme for security researchers.</p>