Privacy Policy | Nexeraa

Draft under legal review. Text in highlighted brackets will be completed before this policy takes effect.

Who we are

This website and the Nexeraa portal are operated by [company legal name], [registered address] ("Nexeraa", "we", "us"). We are the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 (DPDP Act).

What we collect

Enquiries: your name, email address and message when you use the contact form.
Job applications: name, email, phone number, resume and any message you send.
Investor accounts: name, mobile number, email, address, PAN, the last four digits of your Aadhaar number (we do not store the full number), KYC documents, bank account and IFSC details, demat broker and account IDs, your SIP plan, instalment records, plot allotment and share holding records, and a history of changes made to your account.
Team accounts (partners and consultants): contact details, designation, employee code, joining date and salary.
Security data: the IP address and login ID used for sign-in attempts, kept for up to 15 minutes to block password guessing, and standard server logs.

How we use it

To reply to enquiries and assess job applications.
To open and manage your investor account: verifying KYC, recording SIP instalments, determining plot allotment eligibility and keeping your account history.
To let you and your assigned partner or consultant view your account in the portal.
To send service emails such as password reset links.
To keep the portal secure and to meet legal, tax and regulatory obligations.

We process this data on the basis of your consent and, where applicable, for legitimate uses permitted by the DPDP Act. We do not sell personal data and do not use it for advertising.

Who can see it

Within Nexeraa, only people who need it: the franchise partner and consultants who manage your account, and authorised Nexeraa administrators.
Service providers who host the website, store data or send email for us, under contract and only for these purposes: [hosting provider], [email provider].
Authorities, when required by law.

Pages load fonts from Google Fonts and scripts from code.jquery.com and cdnjs.cloudflare.com. These services receive your IP address when your browser fetches those files.

How we protect it

The portal requires sign-in, and each user only sees the accounts they are responsible for. KYC documents and resumes are never served as public files: every download checks who is signed in. Passwords are stored as one-way hashes, repeated wrong passwords lock the sign-in temporarily, and the site is served over HTTPS.

Cookies and storage

We use only the cookies needed to run the site: a session cookie that keeps you signed in and a security cookie that protects forms. If you change the text size, your browser remembers that choice locally. We do not use analytics or advertising cookies.

How long we keep it

Enquiries: [period]. Job applications: [period]. Investor and team account data: for as long as the account is active and then for [period] to meet legal and tax record-keeping requirements.

Your rights

Under the DPDP Act you can ask us to tell you what personal data we hold and how it is used, correct or complete it, erase it when it is no longer needed for the purpose or a legal requirement, withdraw consent, and nominate someone to exercise these rights for you. Withdrawing consent does not affect processing already done, and may mean we cannot continue to provide the service.

Grievances

Contact our Grievance Officer, [name], at [email address]. We will respond within [number] days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Children

Our services are meant for adults. We do not knowingly open accounts for anyone under 18.

Changes

We will post any changes on this page with a new effective date, and tell account holders about significant changes.

Questions about this policy: use our contact page. See also our Terms of Use.