Privacy Policy

Pynexia Tech (operating as Pynexia Technologies Private Limited, hereinafter referred to as "Pynexia Tech", "we", "us", or "our") functions as a Data Fiduciary as defined under Section 2(i) of the Digital Personal Data Protection (DPDP) Act, 2023 of India.

This Privacy Policy applies to all digital personal data collected, stored, processed, or transferred through our website (pynexia.com), learning management systems, training programs, student portals, and digital services. All individuals who access our services are recognized as "Data Principals" under Section 2(j) of the Act.

In strict adherence to the data minimization principle (Section 6(1) of the DPDP Act), Pynexia Tech collects only such personal data as is strictly necessary for specified educational and contractual purposes:

• Identity & Profile Data: Full legal name, verified email address, contact telephone number, date of birth, educational background, college/university name, and degree qualifications provided during registration or training application.
• Authentication & Security Data: Cryptographically hashed passwords (salted bcrypt/argon2), session authentication tokens (auth_token), security audit logs, and multi-factor authentication credentials.
• Academic, Curriculum & Progress Data: Enrolled training domains, assigned cohorts/batches, weekly code repository submissions, project artifact URLs, assessment grades, mentor evaluations, submission timestamps, attendance, and graduation certificate verification records.
• Financial & Transaction Metadata: Order identifiers, transaction references, fee ledger balances, installment milestone records, and tax invoice metadata. (Note: Payment card details, CVVs, net banking credentials, and UPI PINs are processed directly by RBI-authorized, PCI-DSS Level 1 compliant payment aggregators such as Razorpay. Pynexia Tech does not capture or store raw debit/credit card numbers or banking PINs).
• Technical & Telemetry Data: Internet Protocol (IP) addresses, device types, browser specifications, operating system versions, and anonymized access telemetry necessary for platform security, fraud prevention, and uptime monitoring.

Under Section 4 and Section 7 of the DPDP Act, personal data may only be processed for lawful purposes for which the Data Principal has given consent or for specified legitimate uses mandated by law. We process your data exclusively for:

• Processing admissions, verifying enrollment prerequisites, and provisioning your personalized student dashboard.
• Delivering structured curriculum modules, weekly programming projects, mentor feedback, and milestone certifications.
• Managing fee collection schedules, installment milestones, receipts, and statutory accounting audits.
• Facilitating learner communication, automated weekly task release alerts, assignment deadline reminders, and cohort WhatsApp community invites.
• Safeguarding platform infrastructure against unauthorized access, credential stuffing, cyber threats, and academic fraud.
• Complying with statutory directives, tax reporting mandates, and judicial orders issued by competent Indian courts and regulatory bodies.

In accordance with Section 5 and Section 6 of the DPDP Act, 2023:

Every request for consent is accompanied by an itemized notice specifying the categories of personal data to be processed, the specified purpose, and the mechanism for exercising Data Principal rights.

Consent must be freely given, specific, informed, unconditional, and unambiguous with clear affirmative action.

Right to Withdraw Consent: As a Data Principal, you have the statutory right to withdraw your consent at any time through your Profile Settings or by written notice to privacy@pynexia.com. Withdrawing consent shall be as effortless as giving consent. Withdrawal operates prospectively and does not impact the lawfulness of processing carried out prior to withdrawal. Please note that withdrawal of essential consent may necessitate termination of access to enrolled training programs.

The DPDP Act, 2023 grants you enforceable statutory rights regarding your digital personal data. Pynexia Tech provides dedicated channels to exercise these rights:

• Right to Access Information (Section 11): You may request a summary of personal data being processed, a description of the processing activities conducted, and the identities of all third-party Data Processors with whom your data has been shared.
• Right to Correction & Updating (Section 12(1)): You have the right to request the correction of inaccurate data, the completion of incomplete records, and the updating of personal details at any time via your learner profile or support desk.
• Right to Erasure / Deletion (Section 12(2)): You may request the irreversible erasure of your personal data when the purpose for which it was collected is fulfilled and retention is no longer mandated under Indian tax or statutory laws.
• Right of Grievance Redressal (Section 13): You have the right to register concerns or grievances with our designated Grievance Redressal Officer and receive time-bound resolution.
• Right to Nominate (Section 14): You have the right to nominate another individual who, in the event of your death or incapacity, shall be empowered to exercise your Data Principal rights on your behalf.
• Right to Approach the Data Protection Board of India (DPBI): If you are unsatisfied with the grievance redressal outcome provided by Pynexia Tech, you have the right to register a formal appeal before the Data Protection Board of India under Section 13(3).

Pynexia Tech strictly complies with Section 9 of the DPDP Act, 2023 concerning children (individuals who have not attained 18 years of age):

We require verifiable consent from a parent or lawful guardian prior to processing any personal data of a minor.

We strictly prohibit behavioral monitoring, targeted advertising, tracking, or profiling directed at children.

We do not engage in any processing of personal data that is likely to cause any detrimental effect on the physical, mental, or moral well-being of a child.

In compliance with Section 8(5) of the DPDP Act, Pynexia Tech implements robust technical and organizational security safeguards, including Transport Layer Security (TLS 1.3) encryption in transit, AES-256 database encryption at rest, secure HttpOnly cookie flags, strict role-based access controls, and automated vulnerability scanning.

Data Breach Notification (Section 8(6)): In the event of a personal data breach, Pynexia Tech will immediately notify the Data Protection Board of India (DPBI) and every affected Data Principal without undue delay, outlining the nature of the breach, affected records, and remediation measures implemented.

Pynexia Tech processes and stores personal data primarily within secure data centers located in India.

Where third-party cloud infrastructure or computing services involve processing outside India, such transfers strictly comply with Section 16 of the DPDP Act and are restricted from any country or territory prohibited or blacklisted by the Central Government of India.

Pynexia Tech retains personal data only for the duration necessary to satisfy the educational, contractual, and operational purposes for which it was gathered.

Upon fulfillment of the purpose or receipt of a valid erasure request, personal data is irreversibly expunged or anonymized within 30 days, save for records required to be retained under statutory financial, taxation, and anti-fraud mandates of Indian law.