Privacy policy for Zenxos.

Zenxos operates a B2B commerce platform for distributors, their retailers, and field staff. For the personal data described here, the Data Fiduciary is Zenxos (operated by [REGISTERED LEGAL ENTITY NAME]), [Registered office address, City, State, India].

We have appointed a Grievance Officer who is responsible for answering your questions about this policy and handling your data-protection requests and complaints. You can reach the Grievance Officer at privacy@zenxos.com. Details of how to exercise your rights are on our Grievance & Data Rights page.

We collect only the data we need to run the platform for your business. Depending on whether you are a retailer, a distributor admin, or field staff, this can include:

• Identity & contact: phone number, name, shop/owner name, email (for distributor accounts), and GSTIN.
• Business profile: locality, city, state, distributor relationships, roles, and permissions.
• Authentication: OTP verification data and, for distributor accounts, a securely hashed password.
• Commerce activity: catalogue browsing, orders and reorder history, payments, collections, and outstanding-balance records.
• Support & communication: support or feedback text you send us, and in-app notification history including read status.
• Technical & diagnostic: device push tokens (for notifications) and crash/error diagnostics used to keep the app stable.
• Camera: accessed only when you choose to scan a QR invite code to join a distributor network.

Under the DPDP Act we process personal data either with your consent or for a legitimate use permitted by the Act (such as providing a service you have signed up for). We use your data to:

We do not use your personal data for advertising, and we do not sell it.

• Authenticate your account and keep it secure.
• Maintain your profile and show the correct distributor context.
• Power ordering, reorder, payment, collection, and outstanding-balance workflows.
• Send you in-app and push notifications relevant to your business activity.
• Provide support, investigate account, order, or payment problems, and prevent fraud and abuse.
• Meet accounting, tax, and other legal obligations.

Where we rely on your consent, we ask for it in clear terms before or at the time we collect your data, and we record that consent. Your consent is specific to the purposes described in this policy.

You can withdraw your consent at any time, and doing so is as easy as giving it. Use the Grievance & Data Rights page or email our Grievance Officer. Withdrawing consent does not affect processing already carried out, and we may still retain limited records where the law requires it (see retention below).

We share your data only where it is needed to run the platform, and we require our processors to protect it and use it only on our instructions. We share data with:

• The distributors you actively work with, so orders, payments, and account servicing happen correctly.
• Google Firebase (Firebase Authentication and Firebase Cloud Messaging) to verify your phone number by OTP and deliver push notifications.
• Razorpay, our payment processor, where you make or receive payments through the platform.
• Sentry, which processes crash and error diagnostics so we can keep the app stable and secure.
• Our cloud hosting and infrastructure providers that run the Zenxos servers and databases.
• Authorities or advisors where we are legally required to, or to establish, exercise, or defend legal claims.

Some of the processors above (for example Firebase, Razorpay, Sentry, and our hosting providers) may store or process data on servers located outside India. Where this happens, we transfer data only to jurisdictions permitted under the DPDP Act and applicable rules, and we require appropriate safeguards to protect it.

We take reasonable security safeguards to protect your personal data against unauthorised access, disclosure, alteration, and loss. These include encryption of traffic in transit, hashed credentials, access controls, and audit logging.

If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.

We keep personal data only for as long as it is needed for the purposes above, or for as long as your business relationship with the platform continues.

When the purpose is served or you withdraw consent, we delete or anonymise your data, except where we must retain limited records for lawful purposes such as accounting, tax, fraud prevention, dispute handling, and order-history obligations. Where an exception applies, we retain only what is necessary.

Under the DPDP Act you have the right to:

To exercise any of these rights, use the Grievance & Data Rights page or email our Grievance Officer. We will verify your identity before acting on a request.

• Access a summary of the personal data we process about you and how we process it.
• Ask us to correct, complete, update, or erase your personal data.
• Withdraw your consent at any time.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance with us about how we handle your data.

Zenxos is a business-to-business platform intended for use by businesses and their authorised staff. It is not directed at children, and we do not knowingly collect personal data of anyone below 18 years of age. We do not use personal data to track, profile, or serve targeted advertising to children.

If you are not satisfied with how we have handled your data or your request, you may complain to the Data Protection Board of India, the authority established under the DPDP Act. We ask that you raise the matter with our Grievance Officer first so we can try to resolve it quickly.

We may update this policy as our platform, processors, or legal obligations change. When we make material changes we will update the effective date at the top of this page and, where appropriate, notify you in the app.