1. Who we are
Xencus Technologies Private Limited (referred to as "Xencus", "we", "us", or "our") is a private limited company incorporated in India. We provide managed operations, legal, HR, finance, and technical services to education businesses and professionals, and we build and operate the Authentix certificate platform.
Xencus decides why and how personal data collected through our website and service engagements is processed, and is responsible for it. The Digital Personal Data Protection Act 2023 calls that role the Data Fiduciary, and we will hold it once the Act's provisions commence.
You can reach our designated contact for data protection matters at info@xencus.com.
2. Information we collect
We collect personal data in the following ways:
Information you provide directly
- Contact and enquiry data: Name, email address, phone number, company name, and the message content when you submit a contact form, book a call, or email us.
- Engagement data: Details you share during onboarding or service delivery including role, organisation, and project requirements.
- Communication records: Records of correspondence between you and Xencus by email, phone, or written communication.
Information collected automatically
- Usage data: Pages visited, time spent, referring URL, and browser or device type, collected through cookies and analytics tools.
- Technical data: IP address, browser type, operating system, and approximate geographic location derived from IP.
Information from third parties
- Business contact information sourced from publicly available professional profiles (for example, LinkedIn) where we are reaching out in a business context.
We do not collect special categories of sensitive personal data (such as biometric data, health data, or financial account numbers) through our website.
3. How we use your information
We use the personal data we collect for the following purposes:
- Responding to enquiries: To understand your requirements and respond to contact form submissions, calls, and emails.
- Delivering services: To onboard you as a client and provide the services you have engaged us for, including managing project communications and reporting.
- Invoicing and compliance: To issue invoices, maintain accounts, and comply with GST and other statutory obligations under Indian law.
- Service improvement: To understand how visitors use our website and identify areas for improvement, using aggregated and anonymised analytics data.
- Marketing communications: To send relevant content, service updates, or case studies where you have consented or where we have a legitimate business interest in contacting you as a professional. You can opt out at any time.
- Legal obligations: To comply with applicable Indian laws including the DPDP Act 2023, the IT Act 2000, and tax regulations.
We do not use automated decision-making or profiling that would have a legal or similarly significant effect on you.
5. Data retention
We retain personal data for as long as necessary to fulfil the purposes described in this policy or as required by applicable law:
- Contact and enquiry data: Up to two years from the date of last contact, unless you become a client.
- Client engagement data: For the duration of the engagement and for a period of seven years thereafter, as required for GST, income tax, and statutory compliance purposes under Indian law.
- Website analytics data: Retained in aggregated or anonymised form for up to twenty-four months.
When we no longer need personal data, we securely delete or anonymise it.
6. Your rights
We honour the following rights now. They are the rights the Digital Personal Data Protection Act 2023 gives you as a Data Principal, and we do not wait for its provisions to commence before granting them:
- Right to access: You can request a summary of the personal data we hold about you and how it is being processed.
- Right to correction: You can ask us to correct inaccurate or incomplete personal data.
- Right to erasure: You can request the deletion of your personal data where we no longer need it for the purpose for which it was collected, subject to our legal retention obligations.
- Right to grievance redressal: You can raise a complaint about how we have handled your personal data by contacting us at info@xencus.com. We will acknowledge your complaint within 72 hours and resolve it within 30 days.
- Right to nominate: You may nominate another individual to exercise your rights on your behalf in the event of your incapacity or death.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please email us at info@xencus.com with a clear description of your request. We may need to verify your identity before fulfilling the request.
8. Third-party services
Our website may contain links to third-party websites. This privacy policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party website you visit.
We use third-party services including but not limited to Google Analytics, communication tools, and CRM platforms. Each of these services operates under its own terms and privacy policy.
9. Google user data
Authentix, our certificate platform, can import a recipient roster from a Google Sheets spreadsheet. This section sets out exactly what we access when you connect a Google account, what we do with it, and how you withdraw that access. It applies only if you choose to connect a Google account.
The only permission we request
Authentix requests a single OAuth scope, https://www.googleapis.com/auth/drive.file. There are no other scopes in our consent flow.
That scope grants access only to the specific files you select yourself through the Google Picker. It gives us no visibility into the rest of your Google Drive.
What we do with it
- We read the spreadsheet you select, to import a recipient roster — recipient names, and email addresses where you include them — for certificate generation.
- We do not access, list, or scan any other file in your Google Drive.
- We do not write to your Google Drive. The spreadsheet you select is read, never modified.
- We do not use Google user data for advertising, and we do not sell it or transfer it to anyone else except as described in section 4 of this policy.
Artificial intelligence and machine learning
We do not use Google user data to develop, train, improve, or fine-tune generalised artificial intelligence or machine learning models. We do not transfer Google user data to any third party for that purpose, and we do not allow any human to read it except where you ask us to for support, where it is necessary for security, or where the law requires it.
How long we keep it
A roster you import becomes part of your Authentix organisation's records, because it is the record of who each certificate was issued to. We keep it for as long as your organisation's account exists and delete it with the account. To have a particular import deleted sooner, write to info@xencus.com.
The access and refresh tokens Google issues are held encrypted and only for as long as the connection is in place. Disconnecting Google in Authentix deletes them.
How to withdraw access
You can disconnect Google inside Authentix at any time. That deletes the stored tokens from our systems, so Authentix can no longer read any spreadsheet.
The permission you granted stays listed in your Google Account until you remove it there yourself. Authentix deliberately does not revoke it for you: Google's revocation applies to the whole application rather than to one connection, so revoking on your behalf would disconnect every other organisation using the same Google account. To remove the permission, go to third-party apps with account access in your Google Account, at myaccount.google.com/permissions.
Limited Use
Authentix's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
10. Data security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted communications, access controls, and regular security reviews of our systems and practices.
While we take every reasonable precaution, no transmission over the internet or electronic storage system is entirely secure. In the event of a personal data breach that is likely to cause harm, we will notify the individuals affected, and the Data Protection Board of India once that Board is constituted and the DPDP Act's breach-notification provisions are in force.
11. Children's privacy
Our website and services are directed at businesses and professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a person under 18, please contact us immediately and we will take steps to delete it.
12. Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.
Continued use of our website or services after the effective date of an updated policy constitutes acceptance of the revised terms, subject to applicable law.
13. Contact us
If you have any questions about this privacy policy, wish to exercise any of the rights set out in section 6, or wish to raise a grievance, please contact us:
- Email: info@xencus.com
- Registered office: B-98, Second Floor, Sector-2, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India
- CIN: U47413UP2023PTC187543
We will acknowledge all data protection queries within 72 hours and aim to resolve them within 30 days.
Grievance Officer
In accordance with rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, Xencus Technologies Private Limited has designated a Grievance Officer to address complaints about the handling of personal data:
- Name: Mayank Priy
- Designation: CTO
- Email: info@xencus.com
- Address: B-98, Second Floor, Sector-2, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India
The Grievance Officer will redress your grievance within one month of receiving it, as those rules require.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once the Board is constituted and operational under the DPDP Act 2023.