DPDP
Notice

The DPDP Act requires a Data Fiduciary to tell individuals, before or when asking for their consent, what personal data is being processed and why, how to exercise their rights, and how to complain. This notice is intended to do that.

Key Terms

• "Data Principal" is the individual to whom the personal data relates, such as a website visitor, a prospective customer, or an authorised representative of a customer.
• "Data Fiduciary" is the party that decides why and how personal data is processed. For the purposes of this notice, that is Trinex Infotech.
• "Data Processor" is a third party that processes personal data on our behalf under a contract.
• "Personal Data" is any data about an individual who is identifiable by or in relation to that data.
• "Board" means the Data Protection Board of India.

Our services are provided mainly to businesses and organisations. Personal data we process is generally that of individuals acting for those businesses, such as directors, employees, authorised signatories, and contact persons, as well as individual customers and website visitors.

We process only the personal data that is necessary for the purposes in this notice. Depending on how you interact with us, this may include:

• Identity and contact data: name, designation, company name, email address, mobile number
• Address data: business, billing, and delivery addresses
• Business and tax data: GSTIN, PAN, or other tax details where required
• KYC and verification data: authorised signatory details, and identity or address proof where required for onboarding or credit assessment
• Transaction data: quotations, orders, rental and lease details, invoices, payment status, and transaction references
• Communication data: enquiry forms, emails, call or chat records, and support requests
• Technical data: IP address, browser, device and operating system information, pages visited, and approximate location

We do not intentionally collect sensitive categories of personal data, such as health or biometric data, for our services. We do not process payment card or UPI credentials on our own systems. These are handled by third-party payment providers.

We process personal data for the following specified purposes:

• Responding to enquiries and preparing quotations and proposals
• Onboarding customers and verifying identity, authority, and credit-related information
• Entering into and performing rental and leasing agreements
• Delivering, installing, supporting, maintaining, and recovering Equipment
• Issuing invoices, processing payments, and maintaining accounting and tax records
• Communicating about your account, service updates, and renewals
• Understanding website usage and measuring advertising performance, where you have consented to the relevant cookies
• Detecting and preventing fraud, misuse, and security incidents
• Complying with legal, tax, and regulatory obligations
• Establishing, exercising, or defending legal claims

We will not process your personal data for a purpose that is not covered by this notice or by a consent you have given, unless the DPDP Act permits it.

Consent

Where we rely on consent, it will be free, specific, informed, unconditional, and unambiguous, and given by a clear affirmative action, such as ticking a box or submitting a form after reading a notice. We will request consent only for the personal data necessary for the stated purpose.

Consent is requested in clear and plain language, and you can ask for the request in English or in any language listed in the Eighth Schedule to the Constitution of India, to the extent we are able to provide it.

Withdrawing Consent

You may withdraw consent at any time. Withdrawing should be as easy as giving consent: you can write to us using the contact details in this notice, or use any consent controls we provide, including cookie preferences. Withdrawal does not affect processing carried out before the withdrawal, and we may be unable to provide a service that depends on the withdrawn consent.

Processing Without Consent

The DPDP Act permits certain "legitimate uses" of personal data without consent. Where applicable, we may process personal data without consent for purposes such as:

• Where you voluntarily provide data for a specified purpose and have not indicated that you do not consent to its use, such as sharing contact details to receive a quotation
• Complying with a law or an order of a court, tribunal, or regulator
• Responding to a medical emergency or a threat to life, or ensuring safety during a disaster
• Purposes related to employment, where applicable
• Other legitimate uses recognised under the DPDP Act

Subject to the DPDP Act and the DPDP Rules, you have the following rights:

Right to Access Information

You may request a summary of the personal data we process about you and the processing activities we carry out. You may also ask for the identities of other Data Fiduciaries and Data Processors with whom we have shared your data, along with a description of the data shared, and any other information about your personal data that we are required to provide by law.

Right to Correction & Erasure

You may ask us to correct inaccurate or misleading data, complete incomplete data, update data, or erase data we no longer need for the purpose it was collected, unless retention is necessary for a specified purpose or required by law.

Right to Grievance Redressal

You have the right to have any grievance about our handling of your personal data or the exercise of your rights addressed promptly. See the grievance section of this notice.

Right to Nominate

You may nominate another person to exercise your rights if you die or become incapacitated. See the nomination section below.

Some rights may not apply in every case. For example, we may be unable to erase data that we must retain to meet tax, accounting, or other legal requirements, or to defend a legal claim. Where we decline a request, we will tell you why.

To exercise any right, email us at sales@trinexinfotech.com or write to our registered office. Please include:

• Your full name and the email address or phone number you used with us
• The right you wish to exercise (access, correction, erasure, withdrawal of consent, or nomination)
• Enough detail about your request for us to locate and act on it
• Any document we reasonably ask for to verify your identity

We will verify your identity before acting, to prevent personal data from being disclosed or changed by someone else. We will respond within the time required by law and aim to be faster wherever we can. There is no charge for making a request.

You may nominate one or more individuals to exercise your rights under the DPDP Act on your behalf if you die or become unable to exercise them because of unsoundness of mind or infirmity.

To make or update a nomination, contact us with the nominee's name and contact details and a signed declaration. We may ask for supporting documents to verify the nomination when the nominee later makes a request.

The DPDP Act also places certain duties on Data Principals. You must:

• Comply with the provisions of all applicable laws while exercising your rights
• Not impersonate another person while providing personal data
• Not suppress material information when providing personal data for a document, unique identifier, proof of identity, or proof of address issued by a public authority
• Not register a false or frivolous grievance or complaint
• Furnish only verifiably authentic information when exercising the right to correction or erasure

If you have a concern about how we process your personal data or how we have handled a request, please contact us first.

We will acknowledge your grievance and respond within the period prescribed by the DPDP Rules, and in any case as quickly as reasonably possible.

Data Protection Board of India

If you are not satisfied with our response, or do not receive one within the prescribed time, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and DPDP Rules. We encourage you to raise the matter with us first so that we can try to resolve it.

We do not sell your personal data. We engage Data Processors to process personal data on our behalf, only under a valid contract that requires them to protect it and use it only for our instructions. They include:

• Website, cloud hosting, and IT service providers
• Email, communication, and customer relationship management providers
• Analytics and advertising measurement providers, where you have consented to the relevant cookies
• Payment service providers and accounting or financial service providers
• Logistics, delivery, and Equipment maintenance providers

We remain responsible for personal data processed on our behalf. We may also disclose personal data to courts, tax authorities, law-enforcement agencies, and regulators where the law requires or permits, and to a successor in a merger, acquisition, or restructuring, subject to applicable law. You can ask us for the names of the Data Fiduciaries and Processors with whom your data has been shared, as described under your right to access.

We keep personal data only for as long as it is needed for the purpose it was collected for, or as long as the law requires. Examples include contract and invoice records kept to meet tax, accounting, and company-law requirements, and records kept to handle disputes or defend legal claims.

When personal data is no longer needed for a specified purpose and we are not required to retain it, we will erase it or remove the means by which it can be linked to you. Where required, we will ask any Data Processor holding it to do the same.

We may keep certain personal data, traffic data, and logs for the minimum period required by law, even after you ask for erasure.

We use reasonable security safeguards to protect personal data, which may include encryption or similar controls, access controls, monitoring, backups, vendor controls, and measures to detect and respond to unauthorised access. We take steps to ensure continued processing and recovery in the event of a compromise.

Personal Data Breaches

If a personal data breach occurs, we will investigate, contain, and remediate it. We will notify the Data Protection Board and each affected Data Principal in the manner and within the time required by the DPDP Act and the DPDP Rules. Our notice to you will describe, in plain language, the nature and likely impact of the breach, what we have done to reduce risk, steps you can take to protect yourself, and who you can contact.

Our website and services are intended for businesses and adults. We do not knowingly process the personal data of anyone under 18 years of age, and we do not track or monitor the behaviour of children or target advertising at them.

If we learn that we have collected personal data of a child without verifiable consent of a parent or lawful guardian, we will delete it. If you believe a child has provided us personal data, please contact us so that we can take action.

Some of our service providers, such as cloud, email, or analytics services, may process personal data on servers located outside India. The DPDP Act permits such transfers except to countries or territories the Central Government may restrict by notification. We will comply with any such restriction and with any other law that applies to us.

We may update this notice from time to time to reflect changes in our practices, services, or the law, including as the DPDP Rules come into effect in stages. When we do, we will revise the "Last Updated" date at the top of this page. Where the law requires, we will give you fresh notice or seek fresh consent for material changes.

For questions about this notice or to exercise your rights, contact us using the details below.