Privacy notice.
How NexenMinds handles personal data, on our website and in NexenOne, under India's Digital Personal Data Protection Act, 2023 and its Rules.
Who we are
NexenMinds Technologies Private Limited ("NexenMinds", "we", "us") builds and operates NexenOne, a compliance operating system delivered as software as a service, and runs the website nexenminds.com.
Registered office: Plot No. 74, 23rd Street, Padmavathy Nagar Extension, Madambakkam, Chennai 600126
This notice explains how we process personal data when you visit our website, contact us, book a demo, download a resource, apply for a job, partner with us, or sign in to NexenOne. We process personal data in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Digital Personal Data Protection Rules, 2025, and other laws that apply to us.
Our two roles under the DPDP Act
Under the DPDP Act, we play two different roles, and your rights work differently in each.
When we are the Data Fiduciary
We decide why and how your personal data is processed when you:
- visit our website or use Ask NexenMinds, our website assistant
- contact us, book a demo or a scoping call, or download a checklist or guide
- are a partner, supplier or job applicant
- are a customer's account administrator, billing contact or NexenOne user, for the account and sign-in details we need to run the service
This notice covers all of these.
When we are a Data Processor
Our customers put their own information into NexenOne: policies, risks, evidence, audit records and the names of the people involved ("Customer Data"). For Customer Data, the customer is the Data Fiduciary. We process it only on the customer's instructions, under our customer agreement and data processing terms.
If your personal data is in a customer's NexenOne workspace, please contact that organisation to exercise your rights. If you contact us instead, we will pass your request to them.
Personal data we collect
| When | What we collect |
|---|---|
| You book a demo, a scoping call or contact us | Name, work email, company, the areas and services you're interested in, and your message. If you choose to include it, the summary of what you explored on our website ("Your NexenOne plan"). |
| You download a resource or subscribe to updates | Work email address. |
| You use Ask NexenMinds | The questions you type, used only to answer you during your visit. They are not stored. If you then send us a request or ask for a summary by email, we keep what you send as a demo or contact request. Please don't share personal or confidential information in the assistant. |
| You use NexenOne | Name, work email, role, sign-in details from your organisation's Microsoft Entra ID, and a record of actions you take in the platform (the audit trail). |
| You browse our website | Technical data needed to run the site securely, such as IP address, browser and device type. Analytics data only if you agree to analytics cookies. |
| You apply for a job or partner with us | Your CV, contact details and the information you choose to share. |
What you explore on our website, such as your role, the demos you try and your plan, stays in your browser while you're on the page. It is not stored or sent to us unless you choose to include it in a request.
Why we use it, and on what basis
We process personal data only for clear, specified purposes:
- to reply to you, arrange demos and calls, and send what you asked for
- to provide, secure and support NexenOne for our customers
- to send updates you subscribed to
- to improve our website, if you agree to analytics cookies
- to consider job and partner applications
- to meet our legal obligations and protect our rights
Under the DPDP Act, we rely on your consent, given after a clear notice, or on a legitimate use the Act permits, such as information you voluntarily give us for a specific purpose, or processing required by law.
Consent, and withdrawing it
Where we rely on consent, we ask for it clearly, for a specific purpose, before we collect your data. You can withdraw consent at any time, and it is as easy to withdraw as it was to give: use the unsubscribe link in any email, change your choices in our cookie settings, or write to us.
Withdrawing consent does not affect processing that happened before you withdrew it. Where the law allows, we will also accept requests made through a Consent Manager registered with the Data Protection Board of India.
Who we share it with
We do not sell personal data. We share it only with:
- Service providers who help us run our website and NexenOne, such as hosting, email delivery and analytics providers. They act on our instructions under contract and must protect your data.
- Professional advisers, such as auditors and lawyers, where needed.
- Authorities, when the law requires it.
- A buyer or successor, if our business is reorganised or sold, under the same protections.
Where your data is stored
NexenOne gives every customer organisation a dedicated database. Data is hosted in India. If personal data is transferred outside India, we do so only as permitted by the DPDP Act and any restrictions notified by the Central Government.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires, and then we erase or anonymise it:
- Demo and contact requests: 24 months after our last contact with you, unless you become a customer. This includes any summary of what you explored that you chose to send us or have emailed to you.
- Ask NexenMinds conversations: not stored. Your questions are used only to answer you during your visit and are cleared when you leave the page.
- Job applications: 12 months after the role is filled, or longer if you agree to be considered for future roles.
- Newsletter and updates: until you unsubscribe.
- Website analytics: 14 months, and only if you agreed to analytics cookies.
- NexenOne account details and Customer Data: for the subscription term. After it ends, Customer Data can be exported for 30 days and is then deleted within a further 60 days, including from backups.
Records and logs of processing are kept for at least one year, as the DPDP Rules require.
How we protect it
We take reasonable security safeguards to prevent personal data breaches, including:
- a dedicated database for each customer organisation
- single sign-on with Microsoft Entra ID, Google Workspace or Zoho, and role-based access
- a complete, time-stamped audit trail of actions in NexenOne, kept for the full term of your subscription
- locked, electronically signed and checksum-protected approved documents
- Data encrypted in transit and at rest
If a breach happens
If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require. We will tell you what happened, the likely impact, and what we are doing and what you can do. For Customer Data, we will inform the customer without undue delay so they can meet their own obligations.
Your rights
As a Data Principal under the DPDP Act, you have the right to:
- Access information about the personal data we process, how we process it, and who we have shared it with
- Correct, complete, update or erase your personal data
- Withdraw consent you have given
- Have your grievances addressed by us
- Nominate someone to exercise your rights if you die or become unable to do so
To use these rights, email privacy@nexenminds.com. We may need to confirm your identity first. We will acknowledge your request within 7 days and respond in full within 30 days. If a request is complex and needs more time, we will tell you why, and we will always respond within the period set by the DPDP Rules.
Grievances
If you have a concern about how we handle your personal data, contact our Grievance Officer:
- Name and designation
- Grievance Officer name and designation
- privacy@nexenminds.com
- Address
- Plot No. 74, 23rd Street, Padmavathy Nagar Extension, Madambakkam, Chennai 600126
If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.
Children
Our website and NexenOne are for organisations and are not directed at children. We do not knowingly process the personal data of anyone under 18. If we learn that we have, without verifiable consent from a parent or lawful guardian, we will erase it.
AI in our services
Ask NexenMinds, our website assistant, answers questions using the content of this website.
NexenPilot, the AI inside NexenOne, processes Customer Data within the customer's own workspace to raise insights and draft suggestions. It never saves, approves or acts on its own: every decision is made by a person and recorded on the audit trail.
Confirm: Customer Data is not used to train AI models
Cookies
We use only the cookies needed to run the website securely, plus analytics cookies if you agree. See our Cookie notice for details and to change your choices.
Changes to this notice
We may update this notice from time to time. We will change the "last updated" date and, if a change is significant, tell you by email or on our website before it takes effect.
Contact us
For anything about this notice or your personal data: privacy@nexenminds.com, or write to NexenMinds Technologies Private Limited, Plot No. 74, 23rd Street, Padmavathy Nagar Extension, Madambakkam, Chennai 600126.