PRIVACY POLICY

This applies to CXZump at cxzump.ai, its sign-up and the CXZump sites of developers.

Draft for legal review. This text has not yet been approved by our lawyers. Words in [square brackets] are placeholders to be filled in before it is published.

Last updated: [date]. Effective from: [date].

1. Who we are and what this policy covers

CXZump is a software service for real estate developers in India. Developers use it to run the customer experience after a sale: bookings, payment schedules and receipts, KYC documents, agreements and messages to their buyers. CXZump is provided by [legal entity name], a company registered in India with its registered office at [registered address] ("CXZump", "we", "us", "our"). CXZump is built on the Modlix platform, which we operate.

This policy explains what personal data we handle, why, and what choices and rights you have. It is written for the people who meet CXZump in different ways:

Visitors to cxzump.ai and people who book a call with us.
Developers and their staff: the companies that sign up for CXZump ("Developers") and the people they add to their account.
Buyers: home buyers, co-applicants and other customers of a Developer who use the Developer's CXZump site or whose details a Developer records in CXZump.

We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Information Technology Act, 2000 and the rules made under it, and other laws that apply to us.

2. Two roles: when we decide, and when the Developer decides

When we decide (we are the Data Fiduciary). For visitors, for people who book a call, and for the account details of Developers and their staff (name, work email, phone, company, sign-in records), we decide why and how the data is used. This policy is our notice to you for that data.

When the Developer decides (we are the Data Processor). Buyer data in a Developer's CXZump account belongs to that Developer. The Developer is the Data Fiduciary for it: the Developer decides what to collect, why, and for how long, and is responsible for giving buyers notice and getting their consent where the law needs it. We process buyer data only on the Developer's instructions, under our contract with the Developer, to provide the service. If you are a buyer, the Developer's own privacy notice applies to you, and you should contact the Developer first about your data. We will help the Developer answer your request.

3. What we collect

Visitors and call bookings. Your name, email, phone number, company, the date and time you choose for a call, and anything you write in the form. Basic technical data such as IP address, browser, device type, pages visited and time of visit.

Developers and their staff. Name, work email, phone number, company name and details (such as industry, size, website, address and GST number if given), the profile and permissions each person holds, sign-in and activity records, settings, and messages you send us.

Buyer data we process for Developers. This depends on what each Developer collects, and usually includes:

identity and contact details of buyers and co-applicants (name, email, phone, address, date of birth);
KYC documents and their details, such as PAN, a masked Aadhaar number or Aadhaar copy, passport, photographs and proof of address;
booking details: the project, unit, price, cost sheet, payment schedule, demand letters, receipts, agreements and other documents;
payment records: amounts, dates, status and references from the payment gateway or bank;
messages, requests, notes and the history of the buyer's case.

Payment card data. We do not collect or store card numbers, CVV, UPI PINs or net banking passwords. Payments are made on the pages of a payment gateway or bank chosen by the Developer, which handles that data under its own terms and the rules of the Reserve Bank of India. We receive only the result of the payment (for example amount, status and a reference number).

Children. CXZump is meant for adults. If a Developer records a buyer under 18 (for example a minor co-owner), the Developer must get verifiable consent from the parent or lawful guardian as the DPDP Act requires. We do not use children's data for tracking, behavioural monitoring or targeted advertising.

4. Why we use it

We use personal data for which we are the Data Fiduciary to:

set up and run your account, and let you sign in securely;
provide the service, including support, service messages and notices about changes;
reply to your call booking and arrange the call;
keep the service secure, prevent fraud and misuse, and fix problems;
improve the service using usage information, combined or anonymised where possible;
meet legal duties, such as tax, accounting, and requests from authorities that the law allows;
send you news about CXZump, only where you have agreed or the law allows, with a way to opt out every time.

We rely on your consent, or on the legitimate uses the DPDP Act allows (for example where you share data with us for a purpose and have not said no to its use for that purpose, or to meet a legal duty). Where we rely on consent, you may withdraw it at any time; this does not affect what was done before you withdrew it.

We use buyer data only to provide CXZump to the Developer, as the Developer instructs: for example to show a buyer their bookings, record payments, send receipts and notices, and store their documents. We do not sell personal data. We do not use buyer data for our own marketing.

We share personal data only as needed to run the service:

Service providers (sub-processors) that work for us under contract and keep the data confidential and secure, such as: cloud hosting and storage ([cloud provider], data centres in [location]); email delivery ([email provider]); text message and WhatsApp delivery where a Developer turns them on ([messaging provider]); content delivery and security ([CDN provider]); and AI services used by features a Developer chooses to use ([AI provider]). The current list is available at [link to sub-processor list] or on request.
Payment gateways and banks chosen by the Developer, to take and confirm payments.
The Developer, for buyer data and for the activity of its own staff.
Authorities, when the law requires it, or to protect the rights, safety or property of people, the Developer or us.
A buyer of our business, if we merge or sell part of our business, under the same protections.

Some providers may process data outside India. We transfer data outside India only as the DPDP Act and the rules allow, and never to a country the Government of India has restricted.

6. Cookies and similar technologies

We use cookies and browser storage that are needed for the service to work: to keep you signed in, remember your choices (such as light or dark theme) and protect your account. With your agreement, we may also use analytics cookies to understand how cxzump.ai is used. You can choose these in the cookie banner and change your choice at any time. Blocking necessary cookies may stop parts of the service from working.

7. How long we keep it

Account data: while the account is active, and for up to [number] days after it is closed, unless the law needs us to keep it longer.
Call bookings and enquiries: up to [number] months after the last contact.
Buyer data: as long as the Developer keeps it in its account. When a Developer's contract ends, we let the Developer export its data for [30] days and then delete it within [90] days, except where the law needs it kept.
Security and system logs: for the period the law requires (for example 180 days under CERT-In directions), then deleted.
Backups: deleted data may stay in backups for up to [number] days before it is overwritten.

Developers are responsible for setting and following retention periods for buyer data that suit their own legal duties (for example under RERA, tax and anti-money laundering rules).

8. How we protect it

We follow reasonable security practices as required by the Information Technology Act, 2000 and its rules. These include encryption of data in transit (HTTPS), access control by role, separation of each Developer's data, logging of access and changes, regular backups, and limited, need-to-know access by our own staff. Sensitive documents such as KYC files are stored as private files that only signed-in users with the right permission can open. No system is completely secure, but we work to protect your data and fix weaknesses quickly.

If a personal data breach happens, we will inform the Data Protection Board of India and the people affected as the DPDP Act requires, and CERT-In within the time it requires. For buyer data, we will inform the Developer without undue delay so that it can meet its own duties.

9. Your rights

Under the DPDP Act, you have the right to:

get a summary of the personal data we process about you and how we use it, and the names of those we shared it with;
have inaccurate or incomplete data corrected or completed, and data updated;
have your data erased when it is no longer needed for the purpose or you withdraw consent, unless the law needs us to keep it;
withdraw consent you have given;
nominate another person to use your rights if you die or cannot act;
have your grievance answered.

To use these rights for data where we are the Data Fiduciary, write to our Grievance Officer (section 10). Buyers should contact the Developer for data in the Developer's account; if you write to us, we will pass your request to the Developer. We will answer within the time the law sets. We may ask you to confirm who you are first.

10. Grievance Officer

If you have a question or complaint about your personal data, contact our Grievance Officer:

[Name of Grievance Officer]

[Designation]

[legal entity name], [registered address]

Email: [grievance email address]

Phone: [phone number]

Hours: [days and hours]

We will acknowledge your complaint within [24 hours / number of days] and try to resolve it within [number] days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

11. Changes to this policy

We may change this policy as the service or the law changes. We will post the new version on this page with a new date and, for important changes, tell Developers by email or in the service before they take effect.