Privacy Policy — plain and complete

Effective date: 8 July 2026 · Applies to: www.addroitnexus.com and services delivered by Addroit Nexus, Lucknow.

1. Who we are

Addroit Nexus ("we", "us") is a proprietorship firm of Prabhat, registered at Office No. 12, Second Floor, JD Tower, Kanpur Road, The Piccadilly, LDA Colony, Lucknow, Uttar Pradesh 226012, India, GSTIN 09AOJPP9190B1ZL, Udyam UDYAM-UP-50-0012971. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the data fiduciary for personal data collected through this website, and as a data processor for data our clients entrust to us inside their hosted systems.

2. Personal data we collect

2.1 Data you give us

• Query & contact forms: name, email address, phone number, company/organisation (optional), service of interest, and the message you write.
• Direct communication: anything you share with us by phone, WhatsApp, or email.
• Commercial engagement: billing details (legal name, address, GSTIN, PAN/TAN where applicable) needed for invoices and statutory compliance.

2.2 Data collected automatically

• Form security metadata: the page a query was submitted from, submission time, IP address and browser user-agent — kept for spam prevention, rate-limiting and audit.
• Essential cookies: one session cookie (".AddroitNexus.Session") that makes the captcha work, and an anti-forgery cookie that protects forms. We run no advertising trackers, no analytics beacons, and no third-party marketing cookies on this site.
• Server logs: standard web-server logs (URL, timestamp, IP, status) retained briefly for security and troubleshooting.

2.3 Data we do not want

Please do not send passwords, card numbers, Aadhaar numbers or other sensitive identifiers through the query form. If such data is required for a project, we collect it through agreed, secured channels under a signed engagement.

3. Why we process your data (purposes)

• To respond to your enquiry and provide quotations you asked for — based on your consent, given when you submit the form;
• To deliver contracted services, raise GST invoices and maintain accounts — as a legitimate use connected to a contract and legal obligations;
• To secure our systems: spam filtering, rate-limiting, abuse investigation;
• To comply with law — tax records, lawful requests from authorities, CERT-In directions.

We do not use your data for third-party advertising, and we do not sell or rent personal data to anyone.

4. Where your data lives & how it's protected

Query-form submissions are stored in an encrypted-at-rest capable database on servers under our control, hosted in India. Access is restricted to authorised personnel on a need-to-know basis; transport is protected with TLS; administrative access requires authentication and is logged. While no system can promise absolute security, we apply reasonable security practices consistent with the IT Act, 2000 (including the SPDI Rules, 2011) and DPDP Act obligations, and we review them periodically.

5. Sharing & disclosure

• Service providers (processors): infrastructure, email delivery and similar vendors who process data strictly on our instructions under contract;
• Professional advisers: accountants/auditors for statutory compliance, bound by confidentiality;
• Legal: where disclosure is required by law, court order or a competent authority;
• Business transition: if the business is restructured, data transfers with equivalent protections and notice on this page.

6. Retention

• Query submissions: up to 24 months from last contact, then deleted or anonymised (unless a live engagement or legal obligation requires longer);
• Invoicing and tax records: as mandated by GST and income-tax law (typically 6–8 years);
• Security logs: typically 90–180 days, or longer where CERT-In directions require.

7. Your rights (DPDP Act, 2023)

As a data principal you may, free of charge:

• Access — ask what personal data of yours we hold and how it is used;
• Correction & completion — have inaccurate or incomplete data fixed;
• Erasure — have data deleted where it is no longer necessary and no law requires retention;
• Grievance redressal — complain to our Grievance Officer and receive a reasoned response;
• Nomination — nominate a person to exercise these rights in case of death or incapacity;
• Withdraw consent — at any time, with effect for future processing.

If you are unsatisfied with our response, you may approach the Data Protection Board of India as provided under the DPDP Act.

8. Grievance Officer

Name: Prabhat (Proprietor)
Email: [email protected]
Phone: +91 63909 99366 (Mon – Sat, 10:00 – 19:00 IST)
Address: Office No. 12, Second Floor, JD Tower, Kanpur Road, The Piccadilly, LDA Colony, Lucknow, Uttar Pradesh 226012, India
We acknowledge grievances within 72 hours and aim to resolve them within 15 days, and in any case within timelines prescribed under applicable law.

9. Children

This website and our services are intended for businesses and adults. We do not knowingly collect personal data of children; where a client project involves minors' data (for example, EdTech platforms), processing follows the DPDP Act's requirements — including verifiable parental consent obtained by the data fiduciary — under a written agreement.

10. Third-party links & embedded content

Pages may embed a Google Maps view and load fonts from Google Fonts, and may link to external sites (for example, WhatsApp). Those services have their own privacy policies; we encourage you to read them. We do not control data those providers collect when you interact with their embeds.

11. Changes to this policy

We update this page when practices or law change, revising the effective date above. Material changes affecting your rights will be highlighted here for at least 30 days.

12. Contact

Questions about this policy: [email protected] or +91 63909 99366. For rights requests, contacting the Grievance Officer (Section 8) is fastest.