Privacy Policy

1. About This Privacy Policy

This Privacy Policy applies to personal information collected through:

• Our website;
• Contact and enquiry forms;
• Email communications;
• Telephone and other business communications;
• Client onboarding;
• Service delivery;
• Software and technology services;
• Customer-support interactions;
• Business-development activities;
• Marketing activities;
• Applications and platforms operated by NerveByte Infotech; and
• Other interactions between you and NerveByte Infotech.

This Policy may not apply to third-party websites, applications or services that are linked to or integrated with our Services. Those services are governed by their own privacy policies.

2. Information We Collect

Depending on how you interact with us, we may collect different categories of information.

A. Contact Information

This may include:

• Name;
• Email address;
• Telephone/mobile number;
• Company name;
• Job title;
• Business address;
• Country or region; and
• Other contact details you voluntarily provide.

B. Business Information

If you contact us regarding our Services, we may collect:

• Company information;
• Business requirements;
• Project specifications;
• Service preferences;
• Technical requirements;
• Commercial information;
• Communication history;
• Information required for proposals and contracts; and
• Other information necessary to provide our Services.

C. Technical Information

When you access our Website, certain technical information may be automatically collected, depending on the Website’s configuration and technologies in use.

This may include:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Approximate location derived from technical information;
• Referring website;
• Pages visited;
• Date and time of access;
• Website interactions;
• Error logs; and
• Security-related information.

Government websites similarly describe collection of technical information such as IP address, browser type, operating system and visit information for website operation and security purposes.

D. Information You Provide to Us

We may collect information you voluntarily provide when you:

• Submit a contact form;
• Request a quotation;
• Request a demonstration;
• Request technical assistance;
• Subscribe to communications;
• Contact our sales team;
• Enter into a contract;
• Become a client;
• Communicate with our employees; or
• Participate in other business activities with NerveByte Infotech.

3. Purposes for Which We Use Personal Information

We may use personal information for legitimate business purposes, including:

Providing Services

To:

• Deliver requested Services;
• Develop websites and software;
• Configure technology solutions;
• Perform API integrations;
• Provide CRM solutions;
• Provide BPO and customer-support services;
• Provide technical support;
• Maintain systems; and
• Fulfil contractual obligations.

Business Communications

To:

• Respond to enquiries;
• Provide quotations;
• Communicate regarding projects;
• Schedule meetings;
• Provide service updates;
• Respond to support requests; and
• Manage client relationships.

Security and Fraud Prevention

To:

• Protect our systems;
• Detect unauthorized access;
• Investigate suspicious activity;
• Prevent fraud or abuse;
• Maintain security logs; and
• Protect our clients, users and business operations.

Business Administration

To:

• Maintain records;
• Process invoices and payments;
• Manage contracts;
• Maintain accounting records;
• Comply with applicable legal requirements; and
• Operate our business.

Marketing

Where permitted by applicable law, we may use business contact information to communicate information about our Services, products, updates, events or offers.

You may opt out of promotional communications at any time using the unsubscribe mechanism provided in the communication or by contacting us.

4. Legal Basis for Processing

Depending on the circumstances and applicable law, NerveByte Infotech may process personal information based on:

• Your consent;
• Your request to receive goods or services;
• Performance of a contract;
• Compliance with legal obligations;
• Legitimate and lawful business purposes permitted under applicable law;
• Protection of security and prevention of fraud; or
• Other grounds permitted by applicable law.

Under India’s Digital Personal Data Protection Act, consent is required to be free, specific, informed, unconditional and unambiguous where consent is the applicable basis for processing. The Act also provides for withdrawal of consent.

5. Data Minimization

We seek to collect information that is reasonably necessary for the relevant purpose.

We do not intend to collect personal information merely because it is available.

The type and amount of information collected may differ depending on the Service or interaction involved.

6. Cookies and Similar Technologies

Our Website may use cookies and similar technologies.

Cookies may be used for purposes such as:

• Website functionality;
• Security;
• Session management;
• Analytics;
• Performance monitoring;
• Remembering preferences; and
• Marketing, where applicable and permitted.

You may be able to control cookies through your browser settings.

Disabling certain cookies may affect some Website functionality.

Where required by applicable law, we will obtain the necessary consent before using non-essential cookies or similar technologies.

7. Analytics and Marketing Technologies

We may use third-party analytics and marketing services to understand Website traffic, improve our Services and measure marketing performance.

Depending on the services implemented on the Website, these providers may process information such as:

• IP address;
• Device information;
• Browser information;
• Website interactions;
• Referral information;
• Advertising identifiers; and
• Usage information.

Third-party providers process information according to their own terms and privacy policies.

8. Sharing of Personal Information

We do not sell personal information as a general business practice.

We may share information where reasonably necessary with:

Service Providers

Third-party providers supporting:

• Hosting;
• Cloud infrastructure;
• Email;
• CRM;
• Analytics;
• Security;
• Payment processing;
• Customer support;
• Software development;
• Communications;
• Marketing; and
• Other business functions.

Technology and API Partners

Where necessary to provide a requested service, information may be shared with third-party technology providers, API providers or platforms.

For example, a client project may involve integration with travel, airline, hotel, payment, CRM, cloud or other technology systems.

Professional Advisors

Information may be disclosed to:

• Lawyers;
• Accountants;
• Auditors;
• Consultants;
• Insurers; or
• Other professional advisors,

where reasonably necessary for legitimate business purposes.

Legal and Regulatory Authorities

We may disclose information where required or permitted by law, regulation, court order, governmental request or other lawful process.

Business Transfers

If NerveByte Infotech undergoes a merger, acquisition, restructuring, financing, sale of assets or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

9. Third-Party Service Providers

Some Services may rely on third-party infrastructure and technology.

Examples may include:

• Cloud providers;
• Hosting providers;
• Payment processors;
• Travel API providers;
• Airline or hotel technology providers;
• CRM platforms;
• Analytics providers;
• Communication providers;
• Marketing platforms; and
• Cybersecurity providers.

These providers may process information on our behalf or independently depending on the relationship and applicable service.

We seek to use appropriate contractual and technical measures for third parties that process personal information on our behalf.

10. Travel Technology Data

NerveByte Infotech may provide technology solutions to travel companies and other businesses.

Depending on the client’s implementation, our systems may process information relating to:

• Travelers;
• Booking requests;
• Passenger details;
• Contact information;
• Travel itineraries;
• Booking references;
• Airline information;
• Hotel information;
• Payment-related information;
• Customer-support interactions; and
• Other information necessary to operate the relevant travel technology.

Where NerveByte Infotech processes information on behalf of a business client, the client may remain responsible for determining the purpose and lawful basis of the processing.

The relevant client agreement and applicable data-processing arrangements may govern such processing.

11. Payment Information

Where payments are processed through third-party payment providers, payment information may be collected and processed directly by the relevant payment provider.

NerveByte Infotech may receive limited transaction information necessary to:

• Confirm payment;
• Reconcile transactions;
• Provide Services;
• Handle refunds;
• Prevent fraud; and
• Maintain financial records.

Unless expressly stated otherwise, NerveByte Infotech does not intend to store complete payment-card information such as full card numbers or CVV codes on its own systems.

Users should review the privacy policy of the relevant payment provider for information regarding its processing practices.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• Providing Services;
• Maintaining business records;
• Meeting contractual obligations;
• Resolving disputes;
• Preventing fraud;
• Maintaining security;
• Complying with legal obligations; and
• Exercising or defending legal rights.

Retention periods may differ depending on the type of information and the purpose for which it is processed.

When information is no longer required, we may delete, anonymize or securely dispose of it, subject to applicable legal or contractual requirements.

The DPDP framework contemplates retention only for as long as necessary for the specified purpose or as otherwise required by law.

13. Data Security

We use reasonable technical and organizational measures designed to protect personal information against:

• Unauthorized access;
• Unauthorized disclosure;
• Accidental loss;
• Destruction;
• Alteration;
• Misuse; and
• Other unauthorized processing.

Depending on the nature of the Services, security measures may include:

• Access controls;
• Authentication mechanisms;
• Encryption where appropriate;
• Security monitoring;
• Backups;
• Logging;
• Restricted access;
• Vendor controls; and
• Incident-management procedures.

The DPDP Rules, 2025 specifically contemplate reasonable security safeguards including measures such as encryption, access controls, monitoring, backups and appropriate contractual controls with Data Processors.

No internet transmission or storage system can be guaranteed to be completely secure.

14. Data Breaches

If we become aware of a personal-data breach affecting information under our responsibility, we will take reasonable steps to:

1. Investigate the incident;
2. Contain and mitigate the impact;
3. Assess the affected information;
4. Take appropriate remedial measures;
5. Make legally required notifications; and
6. Cooperate with relevant authorities where required.

The DPDP Rules establish requirements concerning notification of personal-data breaches to affected individuals and the Data Protection Board in applicable circumstances.

15. International Data Transfers

Because NerveByte Infotech may work with international clients and technology providers, personal information may be processed or stored outside the country in which it was originally collected.

Where personal information is transferred internationally, we will take steps required under applicable law and contractual arrangements.

Third-party providers may operate infrastructure in multiple countries.

By using our Services, you acknowledge that such international processing may occur where necessary for the provision of the Services, subject to applicable legal requirements.

16. Your Rights

Subject to applicable law, you may have rights concerning your personal information, including rights to:

• Request information regarding processing;
• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion where legally applicable;
• Withdraw consent where processing is based on consent;
• Request cessation of processing where applicable;
• Raise a grievance;
• Nominate another individual to exercise rights in accordance with applicable law; and
• Exercise other rights provided by applicable law.

The exact availability and scope of these rights may depend on the applicable law, the nature of the processing and the relationship between you and NerveByte Infotech.

The DPDP Act provides Data Principals with rights including access to information about personal data, correction/erasure in applicable circumstances, grievance redressal and nomination.

17. Withdrawal of Consent

Where we process your personal information based on consent, you may withdraw that consent by contacting us or using the applicable mechanism provided by us.

Withdrawal of consent will not affect the lawfulness of processing that occurred before withdrawal.

Withdrawal may also affect our ability to provide certain Services where the information is necessary for those Services.

The DPDP Act expressly provides for withdrawal of consent and requires the ease of withdrawal to be comparable to the ease with which consent was given.

18. Children’s Data

Our Website and Services are primarily intended for businesses and adults.

We do not knowingly seek to collect children’s personal information unless such collection is necessary for a legitimate service and is conducted in accordance with applicable law.

If you believe that a child has provided personal information to us without appropriate authorization, please contact us.

19. Business Client Data

If you are an employee, customer, passenger, contractor or other individual whose information is submitted to NerveByte Infotech by one of our business clients, that client may be responsible for determining why your information is collected and how it should be used.

In such circumstances, NerveByte Infotech may act as a service provider or Data Processor for the client.

Requests concerning information processed solely on behalf of a client may need to be directed to that client, depending on the applicable legal and contractual arrangements.

20. Third-Party Links

Our Website may contain links to third-party websites, applications or services.

We are not responsible for the privacy practices, security or content of third-party websites.

We encourage users to review the applicable privacy policies before submitting information to third parties.

21. Marketing Communications

We may send business communications where permitted by law.

You may opt out of marketing communications by:

• Clicking the unsubscribe link included in an applicable email;
• Contacting us directly; or
• Using another opt-out mechanism provided by us.

Even if you opt out of marketing communications, we may continue sending essential service, contractual, security or transactional communications.

22. Do-Not-Track Signals

Some browsers provide “Do Not Track” or similar mechanisms.

Because there is currently no universally consistent technical standard for interpreting such signals across all services, our Website may not respond to every browser-based Do Not Track signal.

Where applicable law requires a particular response to such signals, we will comply with the applicable requirements.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our Services;
• Changes in technology;
• Changes in our business practices;
• Changes in applicable law;
• Regulatory developments; or
• Other operational requirements.

The updated Policy will be published on this page with a revised “Last Updated” date.

Where required by law, we will provide additional notice or obtain consent for material changes.

24. Contact Us

If you have questions, concerns, requests or complaints regarding this Privacy Policy or the handling of your personal information, please contact us.

25. Grievance Redressal

If you have a privacy-related concern, please contact us using the information above.

We will review and address privacy requests and grievances in accordance with applicable law and our internal procedures.

Where applicable law provides additional escalation or complaint mechanisms, those mechanisms will remain available to you.

26. Governing Law

This Privacy Policy shall be governed by applicable laws of India, subject to any mandatory rights or protections available under applicable law.

Where a separate written agreement with a client contains specific data-protection provisions, those provisions may apply to the relevant processing activities.

27. Acknowledgement

By using our Website or providing personal information to NerveByte Infotech, you acknowledge that you have had an opportunity to review this Privacy Policy.

Where consent is legally required, we will seek the applicable consent separately and in the manner required by law.