Privacy Policy
Governed by the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025, the Information Technology Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended). Jurisdiction: Ahmedabad, Gujarat, India.
Data Fiduciary
CARDQR is operated by Nexavora Design Labs, Ahmedabad, Gujarat, India, which is the Data Fiduciary for personal data processed through CARDQR under the DPDP Act, 2023.
A. Personal data we collect and how
1. Itemised categories (Section 5 DPDP Act; Rule 3 DPDP Rules)
| Category | Data points | Who |
|---|---|---|
| Personal identifiers | Full name, email, mobile and phone numbers, addresses, company, designation, date of birth (for the 18+ check). | All users |
| Account & authentication | Password hashes, session identifiers, two-step verification records, consent records (time, IP, terms version). | All registered users |
| Digital card content | Bio, photos, logos, links, products, HS codes, trade roles and Indian credentials (GSTIN, PAN/CIN, Udyam, IEC) you choose to add, plus your public/private visibility choices. | Individuals, enterprises, officials |
| Event data | Registrations, form answers, pass type, pass codes and entry scan records. | Organisers, attendees, scanners |
| Matchmaking data | Trade interests, HS-code selections and intent text you submit for matching. Contact details are never disclosed without your choice. | Opted-in event participants |
| Commercial & billing | Billing name and Indian address, GSTIN, invoice records, payment references and status (never card, UPI or banking credentials). | Paying users |
| Technical metadata | IP address, browser/device details, timestamps, card view and scan counts, security event logs. | Visitors and users |
2. How we collect it
- Directly from you — sign-up, profile and card editing, event registration, checkout and support requests.
- Automatically — technical and security logs when you use CARDQR, and view/scan counts on public cards.
- From our processors — payment status from Razorpay and delivery status of system emails.
3. Eligibility and absolute exclusion of minors
CARDQR is only for individuals aged 18 or older with full capacity to contract under Section 11 of the Indian Contract Act, 1872. Date of birth is compulsory at registration and any registration below 18 is automatically rejected and blocked at submission. We do not knowingly process children's data, so verifiable parental consent under Section 9 of the DPDP Act, 2023 does not apply.
B. Lawful grounds, purposes and infrastructure
1. Lawful grounds (Sections 6 and 7 DPDP Act)
- Consent — free, specific, informed and unbundled consent given at sign-up for each purpose, logged with time, IP and terms version.
- Legitimate uses — services you requested (cards, passes, subscriptions), security and fraud prevention.
- Legal obligations — GST invoicing, IT Act log retention and lawful orders of courts or government agencies.
2. Purposes
Running your account, publishing only the card fields you mark public, issuing and verifying event passes, opt-in matchmaking, billing and GST invoices, preventing misuse, and meeting legal obligations. We never sell, rent or trade your data. Matchmaking stays anonymous until you choose exactly what to share.
3. Infrastructure and Data Processors (Section 8(1) DPDP Act)
Nexavora Design Labs remains fully accountable. Processors act only on our documented instructions under written data-protection terms.
Enterprise Cloud Database & Storage Infrastructure
Domestic — Mumbai, India
Managed database, authentication, media storage and audit logging.
Razorpay Software Private Limited
Domestic — India
Payment gateway, subscriptions and transaction processing under RBI tokenisation and PCI-DSS standards. CARDQR never stores card, UPI or net-banking credentials.
Enterprise Edge Delivery & Web Security Network
Transient network transit
Edge runtime, short-lived caching of public cards, DDoS and web application firewall protection. Data is processed in transit only and not stored persistently at edge nodes.
Managed Transactional Email Infrastructure
Authorised sender: notify.nexavoradesignlabs.com
Verification, security, billing and service notices only — no marketing email.
4. Data residency
All personal data at rest — profiles, cards, event records, matchmaking data, billing records and encrypted audit logs — is stored in India (Mumbai). Edge delivery and email transit handle data only transiently while it is being delivered, under contractual safeguards consistent with Section 16 of the DPDP Act, 2023.
5. Cookies and local storage
cq_rt— secure HttpOnly, SameSite=Strict sign-in cookie.sidebar_state— layout preference.cq_cookie_notice_v1— remembers that you dismissed the cookie notice.
We use no tracking, profiling, advertising or third-party marketing cookies.
C. Your rights, consent, retention and grievances
1. Your rights (Sections 11–14 DPDP Act)
- Access — a summary of your data, processing activities and the processors it is shared with.
- Correction, completion, updating and erasure — most of it self-serve from My Account.
- Grievance redressal — through the officer below.
- Nomination — name a person to exercise your rights on death or incapacity.
2. Withdrawing consent
You can withdraw consent at any time as easily as you gave it — from My Account settings or by writing to contact@nexavoradesignlabs.com. Withdrawal stops future processing; it does not affect processing already done lawfully. Where you use a Consent Manager registered with the Data Protection Board of India (Section 6(7) DPDP Act), we will honour consent given or withdrawn through it.
3. Retention and erasure (Section 8(7) DPDP Act; Rule 8 DPDP Rules)
- Personal data is erased once its purpose is complete or you withdraw consent or delete your account, whichever is earlier.
- Security, traffic and registration logs are kept in encrypted, access-restricted form for at least 180 days, and up to one year where the DPDP Rules or IT Rules require, then permanently deleted.
- GST invoices are kept for the period required by Indian tax law.
- A one-way hashed email is kept only to prevent repeat free trials; it cannot be used to contact you.
4. Security incidents and personal data breaches
- CERT-In — reportable cybersecurity incidents are reported within six (6) hours of detection, under Section 70B of the IT Act, 2000 and the CERT-In Directions, 2022.
- Data Protection Board and affected users — personal data breaches are notified without delay, followed by a detailed report to the Board within seventy-two (72) hours, under Section 8(6) of the DPDP Act, 2023 and Rule 7 of the DPDP Rules.
- Notices to you describe what happened, the likely impact, what we have done and what you can do.
5. Grievance Officer and escalation
Grievance Officer, Nexavora Design Labs
Legal & Compliance, Ahmedabad, Gujarat, India
- Acknowledgement with a reference number within 24 hours.
- Resolution within 7 days, and in any case within 15 days.
- Appeal to the Grievance Appellate Committee (Rule 3A, IT Rules) within 30 days of our decision.
- Complaint to the Data Protection Board of India (Section 27 DPDP Act) for unresolved DPDP matters.
CARDQR by Nexavora Design Labs. This policy is reviewed against updates from MeitY and the Data Protection Board of India.