Privacy Policy

Notice version: 1.0 · Effective date: 1 October 2026

This notice is given under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025. It is available in English and Hindi. The version number is recorded with every consent you give.

1. Who we are

Nexvanta Universal Private Limited (“Nexvanta”, “we”, “us”) operates the Nexvanta Auctions website, portal and mobile apps. For the purposes of the DPDP Act, we are the Data Fiduciary for the personal data described in this notice. You, the person the data relates to, are the Data Principal.

2. Personal data we collect

We follow data minimisation and collect only what we need for each purpose.

Categories of personal data, examples and sources
Category	What it includes	Source
Account data	Full name, email address, mobile number, preferred language, password (stored only as a salted hash)	You, at registration
Consent records	Which purposes you consented to, the notice version, the time, and a one-way hash of your IP address	Generated when you consent or withdraw
KYC data	Identity verification status and the details needed to verify you as a bidder	You, during KYC
Dealer data	Business name, GSTIN, PAN (encrypted, shown masked), business address, contact phone	You, in a Dealer application
Transaction data	Bids, auctions won, payment status and related records	Your use of the portal
Security logs	Sign-in events, failed attempts, IP address and device information, request trace identifiers	Generated automatically
Live chat	Name, email, chat topic, your messages and the agent’s replies, time stamps, your rating, and your account ID if you are signed in	You, when you start a live chat
Grievance and feedback	Name, email, subject and description you submit	You, through our forms

Your mobile number is encrypted at rest and shown masked (for example ******1234). Bidder identities are always masked in public views and to Dealers (for example “Bidder ••3f2a”).

3. Why we use your data

To provide the service (consent): to create and manage your account, verify your identity, run auctions, record bids, notify winners and process payments.
To keep the platform safe (legitimate uses): to prevent fraud, shill bidding and abuse, rate-limit requests, lock accounts after repeated failed sign-ins, and investigate security incidents.
To meet legal obligations (legitimate uses): to keep tax and transaction records, respond to lawful requests, and meet CERT-In log retention and incident-reporting requirements.
Marketing (optional consent): to send you news about upcoming auctions, but only if you opt in. This is never required to use the service.
To handle grievances and feedback: to respond to you and to improve our service.

4. Consent and withdrawal

We ask for consent separately for each purpose, using unticked checkboxes: Terms of Service (required), Privacy notice (required) and Marketing (optional). Your consent must be free, specific, informed, unconditional and unambiguous.

You can withdraw consent as easily as you gave it, at any time, from the Privacy Centre in the portal. Withdrawing Marketing consent takes effect immediately. The Terms and Privacy consents are needed to run your account, so withdrawing them means closing your account. The portal will explain this before you confirm. Withdrawal does not affect processing that was lawful before you withdrew.

5. Your rights as a Data Principal

Right to access information: get a summary of the personal data we hold and the processing we do. You can download it at any time from the Privacy Centre.
Right to correction, completion and updating: edit your profile in the portal, or ask us to correct inaccurate data.
Right to erasure: close your account to have your personal data erased or anonymised. We may keep records that the law requires, such as financial records, for the period the law sets.
Right to grievance redressal: complain to our Grievance Officer (see section 11).
Right to nominate: nominate another person to exercise your rights if you die or become incapacitated.

As a Data Principal you also have duties under section 15 of the DPDP Act. These include not impersonating anyone, not suppressing material information and not filing false or frivolous complaints.

6. Sharing your data

We do not sell your personal data. We share it only with service providers who process it for us under contract (Data Processors), such as cloud hosting, KYC verification, payment and email providers. We also share it with authorities where the law requires. The Dealer selling an item you win receives only the details needed to complete the sale.

7. Cross-border transfer

We store and process personal data primarily in India. Where a service provider processes data outside India, we transfer it only to countries that the Central Government has not restricted under section 16 of the DPDP Act, and with contractual safeguards. Security logs are kept in India as CERT-In requires.

8. Retention

Account data is kept while your account is active. We erase it when you close your account, or after a period of inactivity of which we notify you in advance.
Transaction and financial records are kept for the periods required by tax and company law.
Security logs are kept for 180 days, as CERT-In requires.
Live chat transcripts are kept for 180 days and then deleted automatically (see section 9).
Grievance records are kept for 3 years after resolution.

9. Live chat

You can chat with our support team from any page of this website and the portal. Starting a chat is voluntary, and we ask for your consent (an unticked checkbox) before the chat begins.

Data we collect: your name and email address, the topic you choose, the messages you and our agents send, time stamps, your optional rating and comment, your preferred language, and, if you are signed in, a link to your account. A random chat token is kept in your browser’s session storage so you can resume the chat if you reload the page. It is deleted when you close the tab.
Purpose: to answer your query, follow up by email if we are offline or the chat ends before we resolve it, check service quality, and keep a record if your query becomes a grievance. We do not use chat data for marketing.
Who sees it: only authorised Nexvanta support agents and administrators. Every agent action is recorded in an audit log.
Redaction: please never share passwords, OTPs or card numbers in chat. As a safeguard, our system automatically replaces card-like numbers, OTPs and Aadhaar-like 12-digit numbers in messages with a placeholder (for example “[redacted card number]”) before they are stored or shown to anyone.
Retention: chat transcripts are kept for 180 days from the end of the chat and then deleted by an automated job, unless a law or an open grievance requires us to keep them longer.
Your rights: you can ask for a copy of a chat (you can also download the transcript yourself at any time during the chat), or ask us to delete it, by writing to the Grievance Officer (section 11).

10. Security safeguards and breach notification

Our safeguards include encryption in transit (TLS 1.2 or higher) and at rest for sensitive fields, salted password hashing, short-lived access tokens, account lockout, access controls, audit logging and regular security reviews. If a personal data breach happens, we will inform the Data Protection Board of India and every affected Data Principal, as the DPDP Rules require. We will also report cyber incidents to CERT-In within 6 hours.

11. Grievance Officer

If you have a concern about how we handle your personal data, contact our Grievance Officer:
Grievance Officer, Nexvanta Universal Private Limited
Email: grievance@nexvanta.in
You can also use our online grievance form. We will resolve your grievance within 30 days.

12. Data Protection Board of India

If our response does not resolve your grievance, you may complain to the Data Protection Board of India once you have used our grievance process. Find out more on the Ministry of Electronics and Information Technology website (external website, opens in a new tab)

13. Children

Our services are only for people aged 18 or older. You must confirm your age when you register. We do not knowingly process the personal data of children. If we learn that we have, we will delete it.

14. Cookies and local storage

This public website does not use advertising or tracking cookies. It stores your text-size and high-contrast choices in your browser’s local storage. This data never leaves your device. If you use live chat, a chat token is kept in session storage until you close the tab (section 9). The portal uses strictly necessary storage to keep you signed in.

15. Changes to this notice

If we make material changes, we will publish a new notice version with a new effective date and, where required, ask for your consent again. Earlier versions are available on request.