What you agree to, and what is still open.

1 · Who these terms are between

To be confirmed

"Security BSides Dehradun" is the name of an event. There is no registered company, society or trust behind it today. One is intended before it is needed, and it could be a society, a trust, a company or an LLP, so naming a form now would be describing an intention as though it were a fact. That single decision settles who you are contracting with, who is liable, and who a refund would come from, so it is not a detail to guess at, and this section names the answer the day there is one.

Until it is filled in, read every "we" below as the volunteer organising team of Security BSides Dehradun 0x03, reachable at [email protected]. The event is run independently under the Security BSides framework; Security BSides is not a party to these terms and does not organise this event.

2 · Using this website

There is no visitor account to create. Most pages are static; the contact and CTF forms are handled by server-side functions. Analytics run only after you accept them, and no advertising script runs on any page. Accept analytics and two tools set cookies; decline and neither analytics tool runs. The privacy page names both tools and lists the cookies, and it explains the contact form, CTF registration and email correspondence.

You may read, quote, print and link to anything here without asking, including deep links to a specific section; we try not to break them. The words and the design are the organising team's work. The Security BSides name and mark belong to Security BSides and are used here under their framework, which does not put us in a position to license them onward to you.

What we ask in return is ordinary: do not attempt to disrupt the site or the infrastructure behind it, and do not present yourself as the organising team. If you find a security problem we would genuinely like to hear about it, /.well-known/security.txt says how to report one and what to expect back.

3 · Tickets and registration

To be confirmed

Conference ticket sales are not open yet. When they open they will run through KonfHub, a third party, which means the payment and the ticket itself are handled under that platform's own terms and privacy policy as well as this page. Card details never reach us and we do not store them.

The prices on the home page are the intended tiers rather than a live price list, and the student tier needs a valid college or university ID at entry. There is no refund for missing or invalid ID, except where required by law. A ticket admits one person for the days it covers. Corporate passes include priority seating at talks, subject to room capacity, but no pass guarantees a seat in a particular talk or workshop. Some rooms are smaller than the conference, and the villages floor is first come, first served.

Refunds and transfers are not finalised for publication. The organising team is checking the intended policy against the ticket platform and obtaining legal review. The final refund and transfer terms will appear here and on the ticket page before one ticket is sold.

Age, and anything a ticket includes that has its own limit. The conference itself sets no minimum age. Corporate passes include an after-party invite. The venue and entry conditions, including any age restriction, are not confirmed yet and will be printed on the ticket page before sales open. The final refund policy must also say what happens if a buyer cannot use an included element because of such a restriction. Sales remain closed until those details are published.

4 · Code of conduct

The code of conduct applies to everyone at the event and in its online spaces: attendees, speakers, sponsors, volunteers and organisers, with no group exempt. By registering or attending you agree to it. It is a term of this agreement, not a suggestion sitting alongside it.

It sets out what is expected, what is not acceptable, how to report an incident, and what the organising team can do in response, up to and including removal from the venue. Reports go to [email protected], and the code of conduct lists two other routes, one of them to the founder and lead organiser. Where a consequence would interact with money already paid, section 3 governs, and section 3 has not been finalised for publication.

5 · Photography and recording

To be confirmed

Consent for photographing people is already settled, and it is settled in the code of conduct rather than here: ask before you photograph or record an identifiable person, and accept the answer. Wide shots of a full room, a stage or the venue may be taken by the team and by press. That is the rule on the floor and nothing below changes it.

We plan to record talks where equipment and venue conditions allow. A speaker may decline recording without affecting selection. Before confirming a place, each accepted speaker will be asked separately whether they agree to recording and publication. A yes covers a complete recording on our official YouTube channel, a link or embed on this website, and short excerpts on our official social channels as one choice. We will not seek a second approval for each clip. No talk recording is published without the speaker's agreement.

Audience questions may be audible in a recorded session, as the code of conduct explains. We plan to mark recorded rooms at the entrance. The formal recording permission, including who receives it and how long it lasts, still needs legal review.

6 · Speakers and content

To be confirmed

Speakers keep ownership of the talks, slides and other material they create, and may reuse them elsewhere. Speaking here transfers no copyright or exclusive rights. Submissions are read on merit through the call for papers, with sponsorship, employer and reputation left out of that reading.

After a speaker accepts an invitation, we may publish their name, accepted talk title and abstract in the programme and event announcements. We ask separately before publishing a bio or photo; a photo is optional. We publish a final slide deck only if the speaker supplies it for public sharing and agrees to that use. A deck is not required with a CFP submission, and submitting one does not permit us to publish it.

Speakers should only offer third-party material for public sharing when they have the rights needed to do so. If a rights concern arises, we will work with the speaker to resolve it, which may include removing affected material. We have no planned automatic removal date for recordings or decks; a later removal request will be considered individually, without a promise that every request can be granted.

The formal speaker permission is still to be confirmed, including the identified recipient, licence scope and duration, and any future change of organiser. We will not assume an automatic transfer to an entity that does not yet exist. The full wording needs legal review and publication here and in the speaker invitation before the call for papers opens on 25 October 2026.

On content itself: a talk may describe attacks, tooling and real vulnerabilities. That is the field. It may not disclose somebody else's unpatched vulnerability with no disclosure process behind it, release material you do not have the right to release, or demonstrate against systems you are not authorised to touch. The review board will raise it with you if a submission looks like it crosses one of those lines, rather than rejecting it silently.

7 · Sponsorship

No sponsor is confirmed for 0x03 yet. Sponsorship is agreed in writing, one sponsor at a time, and that written agreement, not the sponsors page, and not this page, governs the relationship. The tier names and inclusions published there are the current prospectus and can change until a particular one is signed.

The two boundaries stated on that page are terms rather than marketing: sponsorship does not buy a speaking slot, and it does not buy the attendee list. Attendee data is not sold, shared or handed to a sponsor in any tier, at any price.

8 · Liability and force majeure

To be confirmed

This is the section that most obviously needs a lawyer, and the one where a template would do the most damage. A limitation of liability not written for a specific legal entity, in a specific jurisdiction, for an event at a specific venue is not protection. It is a paragraph that reads like protection. Section 1 has to be answered before this one can be.

What can be said plainly now: come to a conference in a hill town in April with the care you would take anywhere. Look after your own laptop and your own bag. This is a room full of people who find things interesting. The venue has its own rules and its own safety requirements, and while you are on their premises those apply to you. If you have a medical condition a volunteer might need to know about, tell us at the desk.

Force majeure is the other half of it. An event can be stopped by things nobody chose: weather, a public-health order, a venue withdrawing, a transport shutdown. The intended ticket response to cancellation or postponement needs platform and legal review alongside section 3 before it becomes a published term.

9 · Changes to the programme

The programme will change. Speakers withdraw, talks get swapped, a village lands or does not, and a schedule published in December is not the schedule you will walk around in April. The current version is always the one on this site, and material changes are announced here and to ticket holders.

Coming because one particular talk is on the schedule is a reasonable thing to do, so it is worth saying that no individual session is guaranteed. The dates, 3–4 April 2027, are the part we would only move for something serious, and any move would be announced rather than quietly edited into a page. The venue is still to be announced, and it will go up the same way, in the open.

10 · Governing law

To be confirmed

Which law applies, and which courts would hear a dispute, follows from section 1: it depends on what the legal entity turns out to be and where it is registered. The event is held in Dehradun, Uttarakhand, and everyone organising it is in India, so Indian law is the near-certain answer, but near-certain is not decided, and naming a specific court before the entity exists would be inventing a fact rather than recording one.

Separately from all of that: if you have a problem with something we did, write to [email protected] first. That is the founding team and the team leads, which is as close to an escalation as a volunteer conference has. There is no adversarial machinery here and nobody wants any. Almost everything that goes wrong at one is fixed by an email and an apology.

11 · About this document

Version 0.13, last updated 4 October 2026. It sits below 1.0 because six sections are still open. When the last chip goes, the version becomes 1.0 and this page stops being partly a description of what is not yet final. Version 0.12 made the current speaker recording plan and permission choices visible while leaving the formal licence open. Version 0.13 adds the Student ID rule and Corporate seating and after-party disclosures.

It was written by the organising team, not by a lawyer, and has not yet received a complete legal review. An advocate should review it before 0x03 ticket sales open, and the reviewed text should replace this page rather than sit beside it. Nothing on this page is legal advice, and nobody organising this conference is in a position to give any.

If something here is unclear, or you think a section is wrong, tell us, a term nobody understands is not a term worth having. The contact form reaches the team, or write to [email protected]. The privacy page covers what happens to personal data and is versioned separately from this one.