Privacy policy and data protection

Last updated: 11 September 2026

This privacy policy explains how Nexority Infotech Private Limited (“Nexority Infotech”, “we”, “us” or “our”) collects, uses, shares and protects personal data through this website and in our work with clients.

Who we are and what this policy covers

Nexority Infotech is a company registered in India, with its registered office at Unit 508, 5th Floor, Tower 4, Assotech Business Cresterra, Sector 135, Noida, Uttar Pradesh 201305, India. Nexority Tech and Nexority EdTech are our brands. We are responsible for the personal data this policy describes: the “data fiduciary” under Indian law and the “controller” under EU and UK law.

The policy covers this website, in English and Hindi, its forms, and our correspondence with clients, prospective clients and their staff. It does not cover the use of our software products, which is governed by the agreement for that product, or personal data we process for a client under a client agreement, where the client’s privacy notice applies.

It is designed to meet India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Information Technology Act, 2000, with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). Where they apply to you, it also covers the EU and UK General Data Protection Regulation (the “GDPR”) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”).

What we collect

Information you give us through the website

We collect what you type, record or upload in a form. The inquiry, voice message, application and download forms ask you to tick a consent box; the newsletter asks you to confirm by email.

Inquiry and contact forms (general, division, service and product inquiries): your name, email address and message and, if you add them, your phone number, company, what you are looking for and how you heard about us.
Voice messages: your name, email address, an optional note and a recording of up to two minutes, or an audio file you attach. Your browser asks for microphone permission first. The recording stays in your browser, where you can replay or redo it, until you press send.
Job applications: your name, email address, resume (PDF, DOC or DOCX, up to 4 MB) and the role and, if you add them, your phone number, a LinkedIn or portfolio link and a cover note.
Newsletter: your email address and, if you give it, your name. We also record the part of the site you signed up from (Tech or EdTech), which we treat as your interests, and when you confirm or unsubscribe.
Resource downloads: your name, email address and the resource you asked for and, if you add them, your company and role.

Please leave sensitive information, such as bank details, health information or government ID numbers, out of messages, recordings and resumes. We do not need it.

Information collected automatically

Each form submission is stored with the page you sent it from, the language version you used, your IP address, your browser’s user agent (a short description of your browser and device) and, for most forms, the referring page. Inquiry forms also keep any campaign (UTM) parameters from the link that brought you here. We use these details to route inquiries, see which pages and campaigns work, and investigate spam and abuse.

Analytics. If you accept analytics in the cookie banner, Google Analytics 4 records the pages you visit and your device, browser and approximate location. IP anonymization is on and advertising storage is denied. If you decline or make no choice, it does not load.

Map. The map on our contact page loads nothing from Google until you tap it. After that, Google receives your IP address and may set its own cookies, under its own privacy policy.

Information from our clients

If you are a client or work for one, we keep your business contact details and our correspondence so that we can deliver and manage our work. Project materials a client shares may contain personal data, for example in content we convert, translate or make accessible. We handle that data only on the client’s instructions and under our written agreement.

How we use your information

To answer your inquiry: we send it to the right team, email you a confirmation, reply and follow up. As the inquiry form says, we keep your message for follow-up and nothing else.
To consider you for a job: our hiring team reviews your application and contacts you about the role and, as the form says, about similar roles.
To send you a resource: we email you a download link and may follow up about it.
To send the newsletter: only after you confirm your address.
To run, protect and improve the website: to keep forms working, stop spam and abuse, and see which pages and campaigns lead to inquiries.
To serve our clients: to deliver our agreed services and keep in touch with the people we work with.
To meet legal duties: to keep records the law requires and answer lawful requests from authorities.

Legal bases

India. Under the DPDP Act, we rely on your consent, which you give by ticking a form’s consent box or confirming your newsletter subscription. We may also rely on a legitimate use the Act allows, such as details you give us voluntarily for a stated purpose.

EU and UK. Under the GDPR, we rely on:

Consent: for analytics cookies, the newsletter, your voice recording, and keeping your application on file for similar roles.
Steps before a contract: to answer inquiries about our services and assess job applications.
Legitimate interests: to reply to and follow up on inquiries and resource requests, keep the website secure, understand which campaigns work, and manage client relationships. You can object to this at any time.
Legal obligation: where the law requires us to keep or disclose information.

Cookies and local storage

This is everything the website sets or stores in your browser:

nx_consent (local storage, necessary): remembers whether you chose Accept or Decline in the cookie banner. It stays until you clear this site’s data.
nx_unlocked (cookie, necessary): set when you fill in a resource download form, so you can skip the form next time. It is signed, hidden from page scripts, holds no name or email address, and expires after 30 days.
Google Analytics cookies (analytics, only if you accept): _ga and _ga_ followed by an ID, which Google Analytics uses to tell visits apart and measure how the site is used. Google sets how long they last.
payload-token (cookie, staff only): set when our staff sign in to the content management system. Visitors never receive it.

Changing your analytics choice. Use the Cookie settings link at the bottom of any page to see the banner again and accept or decline. If you withdraw consent, analytics stops loading from your next page view; to remove cookies it has already set, clear this site’s cookies in your browser settings.

We do not sell personal data, and we do not share the newsletter list with anyone for their own use. We share personal data only as follows.

Our own teams. Inquiries go to the team for the relevant practice, Tech or EdTech, and job applications go to our hiring team, all within Nexority Infotech.

Service providers. These companies process personal data on our behalf, and only to provide their service:

Vercel, which hosts the website and processes your IP address and request details to deliver pages.
MongoDB Atlas, which hosts the database that stores form submissions.
Amazon Web Services S3, which stores resumes, voice recordings and downloadable resources.
An email delivery provider, which sends our notifications, confirmations, download links and newsletters.
Google, for Google Analytics, only if you accept it.

Authorities and legal claims. We disclose information when the law or valid legal process requires it, or to establish, exercise or defend legal claims.

Business changes. If Nexority Infotech is involved in a merger, acquisition or sale of assets, personal data may pass to the new owner, who must keep protecting it in line with this policy.

International transfers

We are based in India, and our service providers may process personal data elsewhere, including in the United States. The DPDP Act allows transfers outside India except to countries the Government of India restricts. For EU and UK visitors, where a transfer needs a safeguard, we rely on a recognized one, such as the standard contractual clauses in our providers’ data processing terms. Ask us for details.

How we protect it

These are the safeguards the website actually uses:

Encrypted connections: the site uses HTTPS only, and browsers are told to keep using HTTPS on future visits (HSTS).
Security headers: a content security policy limits what our pages can load. Our pages cannot use your camera or location, and only our own pages can ask for your microphone.
Role-based access: only sales and admin staff can see inquiries, voice messages and newsletter subscribers, and only HR and admin staff can see job applications and resumes. Nothing you submit is public.
Private files: resumes, voice recordings and downloadable resources sit in private storage and open only through short-lived signed links. Download links we email you work for 24 hours.
Upload checks: resumes and recordings are limited to 4 MB and checked by their content, not just their file name.
Spam and abuse protection: a hidden field that only bots fill in, a signed timing check that rejects forms sent impossibly fast, and a limit on how many forms one IP address can send in a short time.
Staff sign-in: accounts lock for a time after repeated failed sign-in attempts.
Limited exports: staff exports of inquiries, applications and subscribers leave out IP addresses, browser details and internal notes.

No website is completely secure. If a personal data breach affects you, we will tell you and the relevant authorities where the law requires it.

How long we keep it

We keep personal data only as long as we need it for its purpose, or longer where the law requires. After that we delete it or remove what identifies you.

Inquiries, voice messages and resource requests: as long as we need them to reply, follow up and manage any business relationship that results.
Job applications and resumes: an automatic process deletes each application and its resume 180 days after submission, as the application form says. Applications that reach the interview, offer or hired stage are kept as hiring records for as long as that purpose and the law require.
Newsletter: while you are subscribed. After you unsubscribe, we keep your email address and the date, so we do not email you again. If you never confirm, we send nothing further.
Technical details: kept with the submission they belong to and deleted with it. Rate-limit counters based on your IP address expire on their own within a short time.
Analytics: for the retention period set in our Google Analytics account.
Client correspondence and project data: for as long as we work together, and afterwards as our agreement and the law require.

Your rights

Depending on where you live, you have some or all of the rights below, and we will not treat you differently for using them. Withdrawing consent does not affect what we did before, and we may keep what the law requires.

India

Under the DPDP Act and the SPDI Rules, you can:

Get a summary of the personal data we process about you, how we use it and who we have shared it with.
Have your data corrected, completed, updated or erased.
Withdraw consent as easily as you gave it, though we may then be unable to answer your inquiry or consider your application.
Nominate someone to exercise your rights if you die or become unable to act.
Have a grievance handled by our Grievance Officer and, if you are not satisfied, complain to the Data Protection Board of India.

EU and UK

If the GDPR applies to you, you can also ask us to restrict our use of your data or give it to you in a portable format. You can object to processing based on our legitimate interests, including follow-ups. You can complain to your local data protection authority; in the UK, that is the Information Commissioner’s Office.

California

If the CCPA applies to you, you can ask to know, access, correct and delete your personal information. The categories we collect, and have collected in the past 12 months, are identifiers (such as name, email address and IP address), professional information (such as company, role and resume), internet activity (through analytics you accept) and audio (voice messages). We collect them from you and your device and disclose them only to the service providers above. We do not sell personal information or share it for cross-context behavioral advertising. You may use an authorized agent.

How to exercise your rights

Email our Grievance Officer at info@nexorityinfotech.com with the subject line “Privacy request”, or write to the address below. Tell us what you want and which email address you used on the website. We may ask you to confirm your identity, for example by replying from that address. We aim to respond within one month.

Children

This website is for businesses, professionals and job seekers, not children. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us some, contact us and we will delete it.

Confirmation first: signing up sends a confirmation email, and nothing else arrives until you press the confirm button on the page it links to.
Easy to leave: every newsletter email has an unsubscribe link, and many email apps show a one-click unsubscribe button. Unsubscribing works at once and disables the links in earlier emails.
Inquiries are not subscriptions: an inquiry, voice message, application or download request never adds you to the newsletter. After a download, we may follow up about that resource, as the form says.
Stopping follow-ups: reply to the email or write to info@nexorityinfotech.com.

Grievance Officer and contact

Questions, requests and complaints about personal data go to our Grievance Officer:

Email: info@nexorityinfotech.com, with the subject line “Privacy request”
Post: Grievance Officer, Nexority Infotech Private Limited, Unit 508, 5th Floor, Tower 4, Assotech Business Cresterra, Sector 135, Noida, Uttar Pradesh 201305, India
Hours: Monday to Friday, 9:00 to 18:00 IST

We aim to resolve grievances within one month of receiving them. For anything else, use our contact page.

Changes to this policy

We update this policy when the website or our practices change, and the date at the top shows the latest version. We will point out significant changes here and, where the law requires, ask for your consent again.

Privacy policy