Privacy Policy

1. Introduction and Scope

Nexois Infotech ("we," "our," or "us") respects your privacy. This Privacy Policy explains what personal data we collect through our website https://nexois.co.in and in connection with our enquiries and services, why we collect it, how we use and protect it, and the choices and rights you have.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the Data Fiduciary for personal data we collect from website visitors and prospective clients. This policy should be read together with our Terms & Conditions.

When we process personal data on behalf of a client while delivering a project, the client is the Data Fiduciary and we act as a Data Processor under the terms of the project agreement. This policy does not cover that processing.

2. Personal Data We Collect

Data you give us directly, when you use our contact form, email us, call us, or schedule a meeting:

• Identity and contact details: your name, email address, phone number, and company name
• Enquiry details: the message you send and any project information, requirements, or files you choose to share
• Correspondence: records of our communication with you, such as proposals, estimates, and follow-ups

3. Data Collected Automatically

When you visit our website, we and our service providers automatically collect technical data such as your IP address, approximate location derived from it, browser type and version, device and operating system, referring URL, pages viewed, time spent, and access times. This data is collected through cookies and similar technologies described below.

We do not intentionally collect sensitive personal data (such as financial account details, health information, or government identifiers) through this website. Please do not include such information in your messages.

4. Why We Process Your Data

• To respond to your enquiries and provide the information or services you request
• To prepare and send proposals, estimates, and follow-up communication
• To manage business relationships, contracts, invoicing, and support
• To operate, secure, and improve our website and services
• To analyse website usage and measure the effectiveness of our advertising
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations and to establish, exercise, or defend legal claims

We process your personal data with your consent, which you give by submitting a form, contacting us, or accepting non-essential cookies, or for certain legitimate uses permitted by the DPDP Act, such as responding to an enquiry you voluntarily made, or complying with law.

5. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. The categories are:

• Essential cookies: required for the website to function and stay secure; these cannot be switched off
• Analytics cookies (for example, Google Analytics): help us understand how visitors use the website so we can improve it
• Advertising and conversion tracking (Google Ads, gtag.js): measure whether our advertising leads to enquiries

Analytics and advertising cookies are used only if you accept them, where a cookie choice is offered. You can also control or delete cookies through your browser settings or use Google's opt-out tools. Blocking some cookies may affect how parts of the website work.

6. Who We Share Data With

We do not sell your personal data. We may share it only with:

• Service providers who process data for us under contract, such as website hosting, email and communication tools, CRM and scheduling software, and analytics and advertising platforms (including Google)
• Professional advisers such as lawyers, auditors, and accountants, who are bound by confidentiality
• Government, regulatory, or law-enforcement authorities where disclosure is required by law or legal process
• A successor entity, if we are involved in a merger, acquisition, or sale of our business, subject to this policy continuing to protect your data

We require our service providers to use your data only for the purposes we specify and to keep it protected. Third-party platforms such as Google have their own privacy policies, which govern their independent use of data they collect.

7. Transfers Outside India

Some of our service providers, including analytics, email, and hosting platforms, may store or process data on servers outside India. We transfer personal data abroad only to the extent permitted by the DPDP Act and any restrictions notified by the Government of India, and we take reasonable steps to ensure such providers protect your data.

8. Data Security

We use reasonable technical and organisational safeguards to protect personal data against unauthorised access, loss, alteration, or disclosure, including encrypted connections (HTTPS), access controls, and limiting access to personnel who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as required by law.

9. Data Retention

We keep personal data only as long as needed for the purposes in this policy. Unless a longer period is required by law or by a contract, we retain enquiry and contact-form data for up to 24 months after our last interaction with you, and website analytics data for the period set in our analytics settings. If you become a client, records related to the engagement are retained as long as needed for contractual, tax, accounting, and legal purposes. After that, we delete or anonymise the data.

10. Your Rights

Under the DPDP Act, you have the following rights as a Data Principal:

• Access: obtain a summary of the personal data we process about you, the processing activities, and the parties we have shared it with
• Correction and completion: ask us to correct inaccurate data or complete incomplete data
• Erasure: ask us to delete your personal data, unless we must retain it by law
• Grievance redressal: raise a complaint with us about how your data is handled
• Nomination: nominate another person to exercise your rights if you die or become incapacitated
• Withdrawal of consent: withdraw any consent you gave us at any time (see below)

To exercise these rights, email us at the address in the Contact section. We may need to verify your identity first, and we aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after first raising the matter with us.

If you are located outside India, local data protection laws (such as the GDPR or UK GDPR) may give you additional rights, and we will honour them where they apply.

11. Withdrawing Consent

You can withdraw consent at any time by emailing us or, for cookies, by changing your browser settings or cookie preferences. Withdrawal does not affect processing done before you withdrew, and it may mean we can no longer respond to your enquiry or provide certain services. Withdrawing consent should be as easy as giving it.

12. Children's Privacy

Our website and services are intended for businesses and adults, and are not directed at anyone under 18. Under the DPDP Act, a child is a person under 18 years of age. We do not knowingly collect personal data from children without verifiable parental or guardian consent, and we do not track or target advertising at children. If you believe a child has given us personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version is always available on this page with its "Last updated" date. If we make material changes to how we use personal data, we will give you appropriate notice and, where the law requires, ask for your consent again.

15. Contact Us

For any questions about this Privacy Policy, or to read how our services are governed, see our Terms & Conditions or contact us: