How we handle your personal data.

1. Who we are

nxsvs (NexusSec Virtual Server) is operated by NexusSec, Navi Mumbai, India ("we", "us"). Under the DPDP Act we are the Data Fiduciary for the personal data described here. Our Grievance Officer can be reached at [email protected].

2. What we collect

Data	Examples	When
Account data	Name, email address, phone number, company name, password (stored only as a one-way hash)	When you create an account or contact us
Service data	Server labels, hostnames, IP addresses, plan, operating system, tickets and requests you send us	When you order or manage a service
Consent records	Which version of this notice you accepted, when, and from which IP address	At registration and whenever you change a consent
Technical data	IP address, browser type, sign-in times, security logs	Automatically when you use the portal
Billing data	Invoice details, GST number, payment references (we do not store card numbers)	When you are invoiced

We do not collect data from anyone under 18. Accounts are for adults only.

3. Why we use it and on what basis

• To provide the service you asked for - creating your account, provisioning and supporting servers, answering tickets, sending service emails (verification, approvals, order and action updates). Basis: your consent given at registration (Section 6 of the DPDP Act) and the legitimate use of providing a service you requested (Section 7).
• To keep the platform secure - sign-in throttling, audit logs, abuse prevention. Basis: legitimate use.
• To meet legal obligations - tax invoices, responding to lawful requests. Basis: legal obligation.
• Marketing emails about new plans, locations and offers - only if you tick the optional box, and you can untick it any time from your account page. Basis: consent.

4. Consent and how to withdraw it

Consent is asked for with a clear, unticked checkbox and is recorded with the notice version, time and IP address. You can withdraw consent at any time from Account → Your data & privacy in the portal, or by emailing [email protected]. Withdrawing consent does not affect processing that already happened; it does mean we can no longer run your account, so active services are cancelled and your data is erased except where the law requires us to keep it (see retention).

5. Who we share it with

We do not sell personal data. We share only what is needed with: the datacentre and network partners that host our infrastructure (in India); our email delivery provider, to send service emails; payment and invoicing providers; and authorities where the law requires it. Each processor works under our instructions.

6. Where it is stored and how it is protected

Our servers and backups are in India (Tamil Nadu datacentre; Mumbai coming soon). Passwords are hashed, connections are encrypted (TLS), access is limited to staff who need it, and staff actions on your account are logged. If a breach affects your data we will notify the Data Protection Board of India and you, as the DPDP Act requires.

7. How long we keep it

Data	Retention
Account and service data	While your account is active, then erased within 30 days of closure
Consent and audit records	Kept (without your identity after erasure) as evidence of consent and security events for up to 3 years
Security logs, sign-in history	90 days
Invoices and tax records	As required by Indian tax law (currently up to 8 years)
Unverified registrations	Deleted after 30 days if the email is never verified

8. Your rights

• Access - see what we hold about you. Portal: Account → Download my data gives you a JSON export at any time.
• Correction and completion - edit your name, company and phone in the portal; email us for anything else.
• Erasure - close your account and have your personal data erased (subject to the retention table above). Portal: Account → Withdraw consent & close account.
• Grievance redressal - write to the Grievance Officer at [email protected]. We acknowledge within 2 working days and respond within the period the DPDP Rules require, and in any case within 30 days.
• Nominate - you may nominate a person to exercise these rights for you if you are unable to; email the Grievance Officer to set this up.
• If you are not satisfied with our response you may complain to the Data Protection Board of India.

9. Cookies

Cookie	Purpose	Type	Lifetime
nxsvs_session	Keeps you signed in to the portal	Strictly necessary	Until you sign out or close the browser
nxsvs_remember	"Keep me signed in" on this device (only if you tick it)	Strictly necessary	30 days
nxsvs_consent	Remembers your cookie choice	Strictly necessary	180 days
Analytics	None today. If we add analytics, it will load only after you choose "Accept all".	Optional	-

Change your choice any time with the Cookie settings link in the footer.

10. Changes

When this notice changes in a way that matters, the version date changes and the portal asks you to read and confirm it again before you continue.

Version 2026-09-20. This page is a draft prepared for NexusSec and should be reviewed by a lawyer before publication.