privacy policy.

NuBase Technologies ("NuBase", "we", "us"; GSTIN 24ELMPP6280E1ZT) is a technology company based in Anand, Gujarat, India. We build eIPO, digital KYC, ReKYC, WhatsApp Business API, AI chatbot and automation software for brokers, banks, NBFCs and other enterprises.

For personal data we collect through nubasetechnologies.com and our direct communications with you, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (and the "controller" under the GDPR, where it applies).

This policy covers:

• visitors to our website;
• people who contact us, request a demo or proposal, or correspond with us by email, phone or WhatsApp;
• business contacts at our clients, prospects, partners and vendors.

Information you give us

• Contact form and demo requests — your name, work email, company (optional), the product you're interested in (optional) and the project details you choose to share.
• Correspondence — the content of emails, calls, WhatsApp messages and meetings with our team, and any files you send us.
• Business relationship details — your job title, business contact details and information needed for proposals, contracts, onboarding, invoicing and support.

Please don't send us sensitive personal data (such as Aadhaar or PAN numbers, bank account or card details, health or biometric data) through the contact form or general email. We don't need it to respond to an enquiry.

Information collected automatically

• Technical and log data — IP address, browser and device type, operating system, referring page, pages viewed and the date and time of each request. Our hosting and security infrastructure records this to keep the site running and protected.
• Preferences stored on your device — your light/dark theme choice and whether you've already seen our intro animation. See Cookies and similar technologies.
• Analytics — if we enable Google Analytics, aggregated information about how pages are used (described in the cookies section).

Information from others

We may receive business contact details from a colleague who refers you, from partners we work with, or from publicly available professional sources, so that we can follow up on a business opportunity. We use this only for that purpose.

• To respond to you — answer your enquiry, send an instant confirmation, arrange calls and demos, and prepare proposals.
• To provide our services — onboard clients, deliver and support our products, and manage our contracts and accounts.
• To run and improve the website — keep it secure and available, fix problems, and understand which content is useful.
• To keep things safe — detect and prevent spam, fraud, abuse and security incidents (for example, limiting how often the contact form can be used).
• To meet legal obligations — comply with applicable laws, regulatory requests, tax and accounting requirements, and enforce our agreements.
• To share relevant updates — occasionally send product or company updates to business contacts, only where you've agreed or where the law permits, always with an easy way to opt out.

Submitting an enquiry does not add you to a marketing list. We don't use your personal data for automated decisions that have legal or similarly significant effects on you.

Under the DPDP Act we process your personal data on one of these grounds:

• Consent — for example, when you submit our contact form or ask us to contact you. You can withdraw consent at any time, as easily as you gave it, by emailing us. Withdrawal doesn't affect processing that already took place.
• Legitimate uses permitted by Section 7 of the Act — for example, where you've voluntarily provided your data for a specific purpose and haven't objected, or where processing is needed to comply with law or a court order.

If you're in the EU or UK, our legal bases are: performing a contract or taking steps at your request before entering one; our legitimate interests in running and growing our business (balanced against your rights); compliance with legal obligations; and consent where it's required (such as for non-essential cookies).

When a regulated entity — such as a broker, bank or NBFC — uses our platform for eIPO, KYC, ReKYC, WhatsApp messaging or AI support, it decides why and how its customers' personal data is processed. In that role, the client is the Data Fiduciary and we act as its Data Processor.

• We process that data only on the client's documented instructions and under a written agreement.
• We apply the security measures described on our Trust Centre, including encryption and masking of sensitive fields such as PAN and Aadhaar in logs and dashboards.
• We handle it in line with our client agreements and applicable regulations, including requirements of the RBI, SEBI and UIDAI where they apply.
• We help our clients respond to requests from their customers and notify them of personal data breaches as our agreements and the law require.

We keep this deliberately light. Our website doesn't use advertising or cross-site tracking cookies. Here is everything it may store on your device:

Functional storage is needed for features you ask for and contains no personal data. You can clear or block cookies and site storage in your browser settings at any time; the site will still work. To opt out of Google Analytics on every website, you can install Google's opt-out browser add-on.

We never sell personal data. We share it only as needed, with:

• Service providers who help us run our business and act on our instructions — for example, website hosting and content delivery, email delivery (we use Resend to send contact-form emails), productivity and communication tools, and analytics (Google, if enabled). They may use the data only to provide their service to us.
• Messaging platforms — if you contact us on WhatsApp, your messages are also processed by WhatsApp/Meta under its own terms and privacy policy.
• Professional advisers — lawyers, auditors and accountants, under duties of confidentiality.
• Authorities — regulators, law-enforcement agencies, courts or government bodies, where required by law or to protect our rights, our users or the public.
• A successor business — if we're involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.

Some of our service providers store or process data outside India. Where that happens, we transfer data only as permitted by the DPDP Act — including any restrictions the Government of India notifies on transfers to particular countries — and we choose providers that apply strong contractual and security safeguards. For EU/UK personal data, we rely on appropriate safeguards such as standard contractual clauses.

We keep personal data only for as long as we need it for the purposes above, then delete or anonymise it. As a guide:

• Enquiries that don't become a business relationship — up to 24 months after our last interaction, so we have context if you get back in touch.
• Client and contract records — for the duration of the relationship and afterwards for as long as tax, accounting and corporate laws require.
• Technical logs — typically no longer than 12 months, unless needed to investigate a security incident.

You can ask us to delete your data sooner — see Your rights.

We maintain reasonable security practices and procedures, as required by the IT Act, 2000 and the SPDI Rules, 2011, and appropriate technical and organisational measures under the DPDP Act. These include encryption in transit (TLS) and at rest, least-privilege access controls, audit logging, masking of sensitive fields, secure development practices and regular reviews. Read more on our Trust Centre.

No system is perfectly secure. If a personal data breach occurs, we'll respond promptly and notify the Data Protection Board of India and affected individuals as the law requires.

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we process about you and the processing activities, and the identities of those we've shared it with.
• Correction and erasure — have inaccurate or incomplete data corrected, completed or updated, and have data erased when it's no longer needed (unless we must keep it by law).
• Withdraw consent — at any time, for processing based on consent.
• Grievance redressal — a prompt response from us to any complaint about how we handle your data.
• Nominate — another person to exercise your rights in the event of your death or incapacity.

If you're in the EU or UK, you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority.

To exercise any right, email hello@nubasetechnologies.com with the subject "Privacy request". We may need to verify your identity first. We'll acknowledge your request promptly and respond within the time required by applicable law. Under the DPDP Act, you're also expected to provide accurate information and not to file false or frivolous requests.

Our website and services are intended for businesses and are not directed at anyone under 18. We don't knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we'll delete it.

Our website links to services run by others — such as WhatsApp, Google and partner websites. Their own privacy policies apply when you use them, and we're not responsible for their practices. We recommend reading them.

In accordance with the Information Technology Act, 2000, the rules made under it and the DPDP Act, our Grievance Officer handles questions and complaints about personal data:

Grievance Officer

NuBase Technologies

Email

hello@nubasetechnologies.com

Phone

+91 96014 33585

Address

Anand, Gujarat, India

We'll acknowledge your grievance promptly and aim to resolve it as quickly as possible, within the time limits set by applicable law. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy as our services or the law change. The "Last updated" date at the top shows when it last changed. If we make significant changes, we'll highlight them on this page and, where appropriate, notify you directly.

Questions about this policy or your data? Email hello@nubasetechnologies.com, call +91 96014 33585, or write to us at NuBase Technologies, Anand, Gujarat, India.

GSTIN: 24ELMPP6280E1ZT