PRIVACY POLICY AND DATA PROTECTION NOTICE
Last Updated: September 2026
Platform: Zivic Nexus (https://zivicnexus.com)
Operated from: Alambagh, Lucknow, Uttar Pradesh - 226005, India
1. INTRODUCTION AND DPDP ACT 2023 COMPLIANCE
Zivic Nexus ("we", "us", "our", or "Platform") is committed to safeguarding the privacy and personal data of our users. This Privacy Policy is formulated in strict accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act, 2023"), the Information Technology Act, 2000 ("IT Act"), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
In respect of digital personal data collected and processed through our platform, Zivic Nexus acts as a "Data Fiduciary", and you, the user, are the "Data Principal". This policy explains the nature of personal data collected, the specified lawful purpose for its processing, and your statutory rights under Indian law.
2. BILINGUAL ACCESSIBILITY NOTICE
In accordance with Section 5 of the DPDP Act, 2023, this notice is made accessible to all users in both English and Hindi. Users may toggle between language versions at any time using the platform interface.
3. CATEGORIES OF PERSONAL DATA COLLECTED
We collect only such digital personal data as is strictly necessary to fulfill specified, lawful purposes:
(a) Account & Contact Information: Name, business name, official email address, mobile phone number, and physical billing/office address.
(b) KYC & Verification Data:
- Masked Aadhaar: In strict compliance with the Aadhaar Act, 2016, we collect and store only the last four digits of your Aadhaar (format: XXXX-XXXX-1234). We strictly prohibit and do not store full 12-digit Aadhaar numbers.
- Identity Documents: Government-issued photo IDs (PAN Card, Passport, or Masked e-Aadhaar with first 8 digits redacted).
- Live Verification Media: A live webcam photograph captured solely for matching against provided identity documentation.
- Business Identifiers: GSTIN number, corporate registration certificate, and contact person credentials.
(c) Financial & Transactional Data: Payment transaction references, order IDs, invoice records, and settlement details. Note: All card, UPI, and net banking transactions are processed securely through RBI-authorized payment aggregators (e.g. Razorpay). We never store raw debit/credit card CVV or banking credentials.
(d) Technical & Usage Data: IP address, device fingerprints, browser specifications, operating system, and platform access timestamps.
4. SPECIFIED PURPOSES OF DATA PROCESSING
Your personal data is processed solely for the following specified, legitimate purposes:
(a) To create and administer your user account (Client or Vendor role);
(b) To verify vendor authenticity, build marketplace trust, and issue verified profile badges;
(c) To enable direct communication, proposals, order fulfillment, and workflow management between Clients and Vendors;
(d) To process service payments, milestone escrow disbursements, and platform fee reconciliations;
(e) To prevent fraud, malicious bids, impersonation, and illegal activities;
(f) To discharge statutory obligations under Indian tax, cybersecurity, and intermediary guidelines.
5. KYC PRIVACY GUARANTEE AND STORAGE SANITIZATION
(a) Storage Security: All uploaded KYC identity documents and live verification photos are placed in private, non-public storage with encrypted access. They are NEVER publicly accessible or indexable by search engines.
(b) Immediate Deletion: In accordance with our data minimization principle, once an administrator completes the review of your verification application (approved or rejected), the underlying identity document files and live verification photos are permanently and irrevocably deleted from our storage servers. Only the verification outcome status (approved/rejected) and masked ID reference (e.g. XXXX-XXXX-1234) are retained.
6. CERT-IN MANDATORY 180-DAY LOG RETENTION
In accordance with the cybersecurity directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000:
(a) Zivic Nexus mandatorily maintains system access logs, user login records, IP addresses, transaction timestamps, and communication metadata for a rolling period of at least one hundred and eighty (180) consecutive days.
(b) These logs are securely maintained for cybersecurity auditing, incident response, and lawful assistance to designated investigative agencies of the Government of India.
7. RIGHTS OF DATA PRINCIPALS UNDER DPDP ACT, 2023
As a Data Principal under the DPDP Act, 2023, you enjoy the following statutory rights:
(a) Right to Access: You have the right to obtain a summary of your personal data being processed and the processing activities undertaken.
(b) Right to Correction and Erasure: You have the right to request correction of inaccurate data, completion of incomplete data, or erasure of personal data that is no longer necessary for the specified purpose (subject to mandatory legal retention requirements like CERT-In logs).
(c) Right to Grievance Redressal: You have the right to register a grievance with our Data Protection Officer regarding the processing of your data.
(d) Right to Nominate: You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.
(e) Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time through account settings or by contacting our Data Protection Officer.
8. DATA SECURITY AND ENCRYPTION
Zivic Nexus employs industry-standard security safeguards including TLS 1.3 encryption in transit, AES-256 encryption at rest, secure edge API authorization, and role-based access controls to prevent unauthorized access, loss, or disclosure.
9. DATA PROTECTION OFFICER (DPO) AND GRIEVANCE CONTACT
If you have any questions, requests, or complaints regarding this Privacy Policy or your personal data, you may reach our designated Data Protection Officer:
- Designation: Data Protection & Grievance Officer, Zivic Nexus
- Address: Alambagh, Lucknow, Uttar Pradesh, PIN - 226005, India
- Privacy Email:
[email protected]
- Grievance Email:
[email protected]
- Response Timeline: Acknowledgment within 24 hours, resolution within 15 days.
You also retain the right to appeal or approach the Data Protection Board of India in accordance with the provisions of the DPDP Act, 2023.