Privacy Policy

This policy applies to anyone who visits Fluxeentra, creates an account, contacts us, submits a technical brief or buys a service. It is prepared under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the reasonable security practices rules made under the Information Technology Act, 2000.

Two terms from the DPDP Act are used throughout. The Data Principal is you, the individual the data relates to. The Data Fiduciary is us, the organisation that decides why and how the data is processed and is responsible for protecting it.

This policy does not apply to third-party websites we link to, platforms you sign in to separately, or systems you own that we work in during an engagement. Section 6 covers that last situation.

The Data Fiduciary is FLUXENTRA LABS PRIVATE LIMITED, 4th Floor, No. 92, VB Arcade, ITI Employees Layout,Nagarabhavi, Mallathahalli, Bengaluru, Bengaluru Urban, Karnataka, 560056..

Formal requests and complaints are handled by the Grievance Officer referred to in section 16. Each request is assigned to one named person from the time we receive it.

We collect five categories of data, limited to what is needed to provide our services.

• Account data: name, email address, mobile number, business name if you provide one, and a one-way hash of your password. Passwords are never stored in readable form, so neither we nor anyone who obtained the database could recover yours.
• Billing data: billing name, address, city, state, PIN code and, if you provide it, your GSTIN. We need these to issue a valid tax invoice.
• Order data: the services purchased, amounts, order numbers, payment status, gateway transaction references, invoices and refund records.
• Technical brief: the information you give us so the work can be carried out, such as repository and environment names, architecture notes, the problem to be solved, access instructions and attached files. This is mainly business information, but it often includes names and work email addresses.
• Site and device data: IP address, browser and device type, pages viewed, referring source and approximate city, collected through analytics and server logs.

We do not collect or store card numbers, CVV codes, UPI PINs or net banking credentials at any stage. We do not ask for identifiers such as Aadhaar or PAN unless a specific legal requirement makes it necessary, and if that happens we will explain why at the time.

Each purpose below is specific. Data collected for one purpose is not reused for an unrelated one.

We do not build advertising profiles or use behavioural retargeting, and we do not sell, rent or trade personal data.

We process personal data on two grounds under the DPDP Act.

• Consent: given freely, for a specific purpose, on an informed basis and unambiguously, when you submit a form, create an account, complete a brief or opt in to updates. Each request states the purpose before you provide the data.
• Legitimate uses: processing needed to perform the contract formed when you pay, and processing required by law, such as keeping tax records under Indian law.

You can withdraw consent at any time, as easily as you gave it, by writing to the Grievance Officer. Withdrawal stops further processing that relies on consent. It does not affect processing already carried out lawfully, or records that the law requires either of us to keep. If withdrawal would prevent us from continuing a service you have paid for, we will tell you before acting on it.

Consent to marketing is separate from everything else. Declining it has no effect on any order, and every marketing email includes a one-click unsubscribe link that takes effect immediately.

Our role depends on where the data is held.

• Data we hold about you. For account, billing, order and brief data stored in our systems, we are the Data Fiduciary and this policy applies.
• Data about your users, held in your systems. When an engagement requires us to work in your repositories, databases or cloud accounts, you remain the Data Fiduciary and we act only on your documented instructions. Before that work begins, we sign a data processing agreement covering purpose limitation, security, sub-processing, breach notification and deletion at the end of the engagement.

By default we ask for anonymised, masked or synthetic data instead of production personal data. Where live access cannot be avoided, it is given to named individuals with the minimum privileges needed, logged, limited in time and revoked at handover.

We share personal data with processors that help us operate, only for the stated purpose and under contracts that require them to protect it. They are listed by category, because an individual supplier may change while the category and the safeguards stay the same.

Outside these categories, personal data is made available only to:

• the engineers assigned to your engagement, limited to the brief and the access the work requires;
• our accountants and auditors, for statutory filings;
• a government authority, court or law enforcement agency, where valid legal process requires it. We ask for the demand in writing, check that it is lawful, disclose only what is required and inform you unless we are legally prevented from doing so.

No processor is permitted to use your data for its own purposes.

The website, its database and its backups are hosted in India. Some processors, particularly for email delivery and analytics, operate infrastructure outside India, so a limited amount of personal data may be processed abroad.

Such transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act, are limited to what the purpose requires, and are covered by contracts requiring protection equivalent to this policy. If a transfer restriction changes, we will move the processing to comply with it.

We keep personal data only for as long as the purpose requires or the law demands. After that it is deleted or irreversibly anonymised.

If you ask for erasure, we delete all data that is not covered by a statutory retention period above, and we tell you what had to be kept and under which obligation.

Our safeguards include:

• HTTPS with modern TLS across the whole site, so data is encrypted in transit;
• passwords stored as salted one-way hashes that cannot be recovered, including by us;
• database backups encrypted at rest, with restores tested;
• individual named administrator accounts protected by multi-factor authentication, with no shared logins;
• least-privilege access to customer data, reviewed whenever someone changes role or leaves;
• no payment credentials processed or stored on our servers;
• client credentials kept in a secrets manager, never in email, chat, spreadsheets or source code;
• dependencies patched on a schedule, with platform security updates applied outside business hours;
• confidentiality obligations for all staff that continue after they leave.

No system is completely secure. If you find a vulnerability in this site, please report it to us. We will investigate and fix it promptly and, if you wish, credit you for the report.

We use a small number of cookies and similar browser storage, in two groups.

• Strictly necessary: session and security cookies that keep you signed in, keep your basket between pages and protect forms against cross-site request forgery. The site does not work without them, so they are set without consent.
• Analytics: used only when analytics is enabled, to count page views and identify broken journeys. They are pseudonymous and, where consent is required, are set only after you give it.

Services you add to your basket are stored in your own browser, not on our servers. Clearing site data removes them, and no one else can read them. We respect browser do-not-track signals where the analytics provider supports them, and you can block or delete cookies in your browser settings at any time.

As a Data Principal under the DPDP Act, you have the following rights.

• Access: a summary of the personal data we hold about you, how we use it and the categories of processor that have received it.
• Correction: inaccurate data corrected, incomplete data completed and outdated data updated.
• Erasure: data deleted once it is no longer needed for the purpose it was collected for, subject to the statutory retention periods in section 9.
• Withdrawal of consent: for any processing based on consent, as easily as it was given.
• Nomination: appointing another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal: a readily available way to complain to us, answered within a published timeline, before you approach any other body.

The Act also places duties on Data Principals: provide authentic information, do not impersonate another person, and do not file false or frivolous complaints.

Making a request. From the email address linked to your account, write to our Grievance Officer, Sreenivasulu Balayellugari and SAGILI SAI LELA SAGAR, at grievance@fluxeentra.com, stating which right you want to exercise. We may ask a few questions to confirm your identity before acting. We respond within 30 days. If a complex request needs longer, we will tell you within those 30 days, with the reason and an expected date.

There is no charge for exercising these rights.

Our services are sold to businesses and this site is not directed at children. We do not knowingly collect personal data from anyone under 18, and we never track, profile or target advertising at children.

If you believe a child has given us personal data, tell us and we will delete it promptly. Where an account has to be operated on behalf of a child, or of a person with a disability who has a lawful guardian, verifiable consent from the parent or guardian must be obtained first, as the DPDP Act requires.

If a personal data breach occurs, we will investigate and contain it immediately, and notify the Data Protection Board of India and each affected Data Principal in the form and within the time required by the DPDP Act.

Our notice to you will explain what happened, which data was affected, the likely consequences, the steps we have already taken and any steps we recommend you take. We will not delay a notification for reputational reasons.

We update this policy when our processing or the law changes. The date at the top of the page shows the current version, and material changes are highlighted on this page. If a change requires fresh consent, we will ask for it. Previous versions are available on request.

For privacy questions, data requests or complaints, contact:

• Grievance Officer (Sreenivasulu Balayellugari and SAGILI SAI LELA SAGAR): grievance@fluxeentra.com, 9502021636
• Support: care@fluxeentra.com
• Post: 4th Floor, No. 92, VB Arcade, ITI Employees Layout,Nagarabhavi, Mallathahalli, Bengaluru, Bengaluru Urban, Karnataka, 560056.

We acknowledge complaints within 48 hours and give a substantive response within 15 days. The full escalation process, including the external bodies you can approach, is set out on our grievance redressal page.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after first raising the matter with our Grievance Officer. This policy is governed by the laws of India.