The terms, and the six we have not settled yet.

1 · Who these terms are between

To be confirmed

"Security BSides Dehradun" is the name of an event. There is no registered company, society or trust behind it today. One is intended before it is needed, and it could be a society, a trust, a company or an LLP, so naming a form now would be describing an intention as though it were a fact. That single decision settles who you are contracting with, who is liable, and who a refund would come from, so it is not a detail to guess at, and this section names the answer the day there is one.

Until it is filled in, read every "we" below as the volunteer organising team of Security BSides Dehradun 0x03, reachable at info@bsidesdehradun.com. The event is run independently under the Security BSides framework; Security BSides is not a party to these terms and does not organise this event.

2 · Using this website

This site is a set of static files. There is no account to create, analytics run only after you accept them, and no advertising script runs on any page. Accept analytics and two tools set cookies; decline and none are set at all. The privacy page names both tools and lists the cookies, and it also covers the two cases where you deliberately send us something, the contact form and an email.

You may read, quote, print and link to anything here without asking, including deep links to a specific section; we try not to break them. The words and the design are the organising team's work. The Security BSides name and mark belong to Security BSides and are used here under their framework, which does not put us in a position to license them onward to you.

What we ask in return is ordinary: do not attempt to disrupt the site or the infrastructure behind it, and do not present yourself as the organising team. If you find a security problem we would genuinely like to hear about it, /.well-known/security.txt says how to report one and what to expect back.

3 · Tickets and registration

To be confirmed

Registration is not open yet. When it opens it will run through KonfHub, a third party, which means the payment and the ticket itself are handled under that platform's own terms and privacy policy as well as this page. Card details never reach us and we do not store them.

The prices on the home page are the intended tiers rather than a live price list, and the student tier needs a valid student ID at the door. A ticket admits one person for the days it covers. It is not a reserved seat in any particular talk or workshop, some rooms are smaller than the conference, and the villages floor is first come, first served.

Refunds and transfers are the unsettled part. Whether a ticket can be refunded, up to what date, and whether it can be passed to somebody else are three decisions the organising team has not made. Writing a plausible-sounding refund window here and arguing about it later is the worst of the available options. Both will be stated on this page, and on the ticket page, before one ticket is sold.

Age, and anything a ticket includes that has its own limit. The conference itself sets no minimum age. Individual things a ticket can include may have one, an evening event or a venue with a bar being the usual case, set by the venue or by law rather than by us. Whether any 0x03 ticket includes an element like that has not been decided. If one does, the limit is printed on the ticket page next to the price, before you pay rather than after, and the refund policy above has to say what happens for a ticket holder who cannot use an included element because of it. Selling somebody a ticket to something they are not old enough to be admitted to is our failure, not their mistake.

4 · Code of conduct

The code of conduct applies to everyone at the event and in its online spaces: attendees, speakers, sponsors, volunteers and organisers, with no group exempt. By registering or attending you agree to it. It is a term of this agreement, not a suggestion sitting alongside it.

It sets out what is expected, what is not acceptable, how to report an incident, and what the organising team can do in response, up to and including removal from the venue. Reports go to conference@bsidesdehradun.com, and the code of conduct lists two other routes, one of them to the founder and lead organiser. Where a consequence would interact with money already paid, section 3 governs, and section 3 is not settled yet.

5 · Photography and recording

To be confirmed

Consent for photographing people is already settled, and it is settled in the code of conduct rather than here: ask before you photograph or record an identifiable person, and accept the answer. Wide shots of a full room, a stage or the venue may be taken by the team and by press. That is the rule on the floor and nothing below changes it.

What is open is the separate question of whether talks are recorded and published at all, whether there is a camera in every room, whether the recordings go up, on whose channel, and how long they stay there. The code of conduct commits to the floor already: no recording of a talk is published without the speaker agreeing to it. Everything above that floor is undecided, and part of it depends on kit we may not have.

6 · Speakers and content

To be confirmed

Two things are certain. You keep the copyright in your talk, your slides and your material, presenting at a BSides transfers ownership of nothing. And your submission is read on merit through the call for papers, with sponsorship, employer and reputation left out of that reading.

What is open is the licence you grant us by presenting: what we may do with your title and abstract, your deck, a recording if one exists, and your name and photograph in conference material. The honest position today is that we would ask for the narrowest licence that lets us publish a programme and, if talks are recorded, put the recording up. The wording will be on this page, and in the speaker email, before the call for papers opens on 1 October 2026, not after you have submitted.

On content itself: a talk may describe attacks, tooling and real vulnerabilities. That is the field. It may not disclose somebody else's unpatched vulnerability with no disclosure process behind it, release material you do not have the right to release, or demonstrate against systems you are not authorised to touch. The review board will raise it with you if a submission looks like it crosses one of those lines, rather than rejecting it silently.

7 · Sponsorship

No sponsor is confirmed for 0x03 yet. Sponsorship is agreed in writing, one sponsor at a time, and that written agreement, not the sponsors page, and not this page, governs the relationship. The tier names and inclusions published there are the current prospectus and can change until a particular one is signed.

The two boundaries stated on that page are terms rather than marketing: sponsorship does not buy a speaking slot, and it does not buy the attendee list. Attendee data is not sold, shared or handed to a sponsor in any tier, at any price.

8 · Liability and force majeure

To be confirmed

This is the section that most obviously needs a lawyer, and the one where a template would do the most damage. A limitation of liability not written for a specific legal entity, in a specific jurisdiction, for an event at a specific venue is not protection. It is a paragraph that reads like protection. Section 1 has to be answered before this one can be.

What can be said plainly now: come to a conference in a hill town in April with the care you would take anywhere. Look after your own laptop and your own bag. This is a room full of people who find things interesting. The venue has its own rules and its own safety requirements, and while you are on their premises those apply to you. If you have a medical condition a volunteer might need to know about, tell us at the desk.

Force majeure is the other half of it. An event can be stopped by things nobody chose: weather, a public-health order, a venue withdrawing, a transport shutdown. Whether that means a refund, a credit against the next edition, or neither, is a refund question, so it is open for exactly the reason section 3 is.

9 · Changes to the programme

The programme will change. Speakers withdraw, talks get swapped, a village lands or does not, and a schedule published in January is not the schedule you will walk around in April. The current version is always the one on this site, and material changes are announced here and to ticket holders.

Coming because one particular talk is on the schedule is a reasonable thing to do, so it is worth saying that no individual session is guaranteed. The dates, 3–4 April 2027, and the venue, UPES Bidholi Campus, Dehradun, are the parts we would only move for something serious, and moving either would be announced rather than quietly edited into a page.

10 · Governing law

To be confirmed

Which law applies, and which courts would hear a dispute, follows from section 1: it depends on what the legal entity turns out to be and where it is registered. The event is held in Dehradun, Uttarakhand, and everyone organising it is in India, so Indian law is the near-certain answer, but near-certain is not decided, and naming a specific court before the entity exists would be inventing a fact rather than recording one.

Separately from all of that: if you have a problem with something we did, write to conference@bsidesdehradun.com first. That is the founding team and the team leads, which is as close to an escalation as a volunteer conference has. There is no adversarial machinery here and nobody wants any. Almost everything that goes wrong at one is fixed by an email and an apology.

11 · About this document

Version 0.10, last updated 27 August 2026. It sits below 1.0 because six of its ten sections are still open. When the last chip goes, the version becomes 1.0 and this page stops being partly a description of what we have not decided.

It was written by the organising team, not by a lawyer, and nobody qualified has read it yet. An advocate will, before the site takes a registration, and the reviewed text replaces this page rather than sitting beside it. Nothing on this page is legal advice, and nobody organising this conference is in a position to give any.

If something here is unclear, or you think a section is wrong, tell us, a term nobody understands is not a term worth having. The contact form reaches the team, or write to info@bsidesdehradun.com. The privacy page covers what happens to personal data and is versioned separately from this one.