Privacy policy

Effective date: 2 September 2026

Table of contents

Introduction

This notice explains what personal data Nexix Security Labs collects through this website, why we collect it, who we share it with, and the rights you hold over it. It is written to be read, so it describes what the site actually does rather than every activity we might conceivably undertake.

We have not added any advertising pixel or third-party marketing tracker of our own to this site. Our hosting platform does load its own analytics on every page, which is described honestly and in full in Cookies and tracking technologies rather than glossed over.

Who we are

Nexix Security Labs provides cybersecurity assessment, managed security operations, operational technology security, data engineering and IT consulting services. We also operate Nexix Academy, a separate cyber training and assessment platform.

For the purposes of India's Digital Personal Data Protection Act 2023, Nexix Security Labs is the Data Fiduciary for personal data collected through this website. Our registered details are:

  • Registered entity name: Nexix Security Lab
  • Registered address: Indraprastha Nagar, Nagpur, Maharashtra, India 440022
  • Email: contact@nexixsecuritylabs.com

Applicability

This notice covers nexixsecuritylabs.com and its subdomains. It applies to prospective clients, clients, website visitors, and anyone who contacts us through this site.

It does not cover the Nexix Academy platform at nexixsecurity.training, which handles learner accounts and assessment records and publishes its own notice. It also does not cover data we process while carrying out a security engagement, which is governed by the contract for that engagement. See Data handled during a security engagement.

Personal data we collect

We collect only what the site needs to work and to answer enquiries. There is no account system, no login, and no comment facility on this website, so there is no profile to build.

Data you give us

When you submit the contact form, we collect exactly the fields that form asks for:

  • Full name
  • Work email address
  • Phone number
  • Company name
  • Job title
  • The service you are interested in
  • The enquiry text you write, and anything you choose to put in it

If you email or call us directly, we hold that correspondence and whatever it contains.

Data collected automatically

Serving a web page necessarily involves your device telling our host who and where it is. Our hosting provider records standard request information for delivery, security and abuse prevention: IP address, browser and device type, the page requested, the referring page, and the time of the request.

The contact form also records the time the page was loaded and includes a hidden field that humans never fill in. Both are used solely to reject automated spam submissions before they are stored. Submissions caught this way are discarded, not retained.

Data collected by analytics

We also record how the site is used — pages viewed, links clicked, how far you read, and a masked reconstruction of the visit. This is set out in full, including what is excluded from it, in Cookies and tracking technologies.

What we do not collect

We do not collect special category or sensitive personal data through this website, and we ask you not to send it to us in an enquiry. We do not buy personal data from data brokers, and we do not build advertising profiles or sell access to you as an audience.

How we use personal data

Each purpose below maps to data listed in the previous section.

  • Answering your enquiry. Contact form and email data is used to reply to you, understand what you need, and where relevant prepare a scope and proposal.
  • Managing the client relationship. Contact details are used to deliver services you have engaged us for and to administer the contract.
  • Operating and securing the website. Request logs are used to serve pages, diagnose faults, and detect and block abuse.
  • Meeting legal and regulatory obligations. Where a law, court or regulator requires us to retain or produce records.

We do not use your data to make automated decisions that produce legal or similarly significant effects, and we do not sell personal data.

Cookies and tracking technologies

Cookies are small files a website stores on your device. This site uses very few of them, and none for advertising. Two things measure how the site is used: a product analytics tool we chose, and analytics our hosting platform loads on every page whether we want it or not. Both are described below.

Our product analytics

We use two tools to understand how this site is used, so that we can fix what does not work: PostHog for product analytics and Google Analytics 4 for audience measurement.

PostHog is configured to record:

  • Pages viewed, and how you arrived at them.
  • Interactions with the page — which links and buttons are clicked, and how far down a page people read.
  • Session recordings. A reconstruction of how a visit moved through the site, so we can see where a page confuses people. Every form field is masked before the recording leaves your browser, including everything you type into an enquiry — the recording shows that a field was filled, never its contents.
  • Three named events: submitting the contact form, clicking a phone or email link, and clicking through to the contact page.

Every record PostHog holds is anonymous. Requests to it are routed through d.nexixsecurity.training, a subdomain we operate, so that privacy tooling which blocks analytics by domain name does not silently break the page.

Google Analytics records pages viewed, how you arrived, roughly where you are, what device you use, and the same three named events. It runs in consent mode with storage denied by default: until analytics consent is given it sets no cookie and Google receives only aggregate, cookieless measurement. We have not enabled Google Signals, advertising features, or any audience export for ad targeting.

Neither tool is asked to build a profile of you, and nothing on this site tells either who you are.

Nothing is stored on your device by either tool until analytics consent is given. Until then the identifiers exist in memory for the length of your visit and are discarded when you close the tab.

Platform analytics

This site is built and hosted on Wix. Wix loads its own analytics on every page of this site, and it does so as part of the platform rather than as something we added. Specifically, each page loads Wix's site analytics, its business intelligence collector, its tag manager, and its consent policy components, and it records a page view.

These serve audience measurement: which pages are read, how visitors arrive, roughly where they are, and what device they use. We use it to decide what to write about and what to fix. We do not use it to build advertising profiles or to target individuals.

Cookies and storage these set

Two groups, with different owners:

  • Our product analytics. PostHog stores a single random identifier under a key beginning ph_, so that repeat visits within a session are counted once rather than as separate people. Nothing in it identifies you by name. It is not written at all until analytics consent is given: until then the identifier lives in memory for the length of the visit and is discarded when you close the tab.
  • Google Analytics. Once analytics consent is given, Google Analytics stores identifiers under keys beginning _ga to distinguish one visit from another. Before consent it stores nothing. Google's own handling of the data is described in its privacy policy.
  • Our hosting platform. Wix loads its own analytics, business-intelligence, tag-management and consent-policy scripts on every page, and those set their own cookies from the browser. They are set by the platform rather than by us, and we cannot remove them from this site. The current list of names, purposes and lifespans is published by Wix in its own cookie documentation, which we point to rather than copy so that this notice cannot fall out of date with it.

What we have not added

We have not added any advertising or conversion pixel, any social media tracking pixel, or any tool that sells or shares your data with a third party for their own purposes. Note that Wix's tag manager makes it possible to add such tags from the dashboard without changing any code, so this section must be revisited whenever a marketing tag is enabled.

Third-party content that loads

Scripts, images and fonts are served from our hosting provider's content delivery network, and product analytics is served from d.nexixsecurity.training. Requesting a file from any of these exposes your IP address to the server holding it, which is inherent to how the web delivers files rather than a tracking decision on our part.

Links to Nexix Academy and to our social media profiles are ordinary links. Nothing from those social services loads or runs on this site, so they cannot observe your visit here unless you click through.

Controlling cookies

Every major browser lets you view, block and delete cookies through its settings, and blocking analytics cookies will not stop you reading anything here. Where a consent banner is presented, your choice is recorded and can be changed at any time.

Who we share personal data with

We do not sell, rent or trade personal data. We share it only in these circumstances:

  • Our hosting, analytics and CRM provider. This website, the analytics it generates and the contact records it produces are hosted and stored on Wix, which acts as a processor on our instructions. Wix's own handling is described in its privacy policy.
  • Our analytics providers. PostHog and Google Analytics receive the usage data described in Cookies and tracking technologies. Neither receives your name, email address, phone number or the text of an enquiry. Their own handling is described in the PostHog privacy policy and the Google privacy policy.
  • Our internal messaging provider. When you submit an enquiry, its details — your name, work email, phone number, company, job title and the text of your message — are also posted into a private Google Chat space used by our team, so that someone sees it promptly. The space is restricted to our own staff. Google acts as a processor on our instructions and its handling is described in the Google privacy policy.
  • Professional advisers. Lawyers, accountants and auditors, where they need the data to advise us and are bound by confidentiality.
  • Legal requirement. Where we are obliged to disclose by law, or to establish, exercise or defend legal claims.
  • Business transfer. If the business or part of it is acquired or reorganised, personal data may transfer as part of that, subject to this notice continuing to apply.

Storage and international transfer

Nexix Security Labs operates from India. Our hosting, CRM and analytics providers operate globally, so both the enquiry data you submit and the usage data our analytics collect may be stored or processed on infrastructure outside India — including in the European Union and the United States. Where that happens we rely on the provider's contractual data protection commitments, and on transfers being permitted under the Digital Personal Data Protection Act 2023.

How long we keep personal data

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires, then delete it.

  • Enquiries that do not become engagements — kept for 24 months from your last contact with us, then deleted. This covers both the contact record and the copy posted into our internal Google Chat space.
  • Client contact records — kept for the life of the relationship and for 8 years after it ends, which is the period Indian company and tax record-keeping rules require.
  • Analytics records — retained under the retention period configured on our PostHog account, and by Wix under its own platform policy for the data it collects.
  • Server and platform logs — kept for our hosting provider's standard window and not extended by us.

You can ask us to delete your data sooner. See Your rights over your data.

Your rights over your data

As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights over personal data we hold about you:

  • Access. A summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
  • Correction and completion. To have inaccurate or misleading data corrected, incomplete data completed, and data updated.
  • Erasure. To have your personal data deleted, unless we are required to keep it to comply with a law.
  • Withdrawal of consent. To withdraw consent at any time, as easily as it was given.
  • Nomination. To nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
  • Grievance redressal. To raise a complaint with us and receive a response, before escalating.

Exercising these rights costs nothing and we will not treat you differently for doing so.

If you are not satisfied with how we handle your request, you may complain to the Data Protection Board of India. If you are in the EU or UK, you may also have the right to complain to your local supervisory authority.

How to exercise your rights

Write to us at the address below and we will handle it. Requests are answered by a person, not a ticket queue.

Exercise your data rights

Your data, your call.

Send your request to the address below. To let us act on it without going back and forth, please include:

  1. Which right you are exercising: access, correction, erasure, withdrawal of consent, or nomination.
  2. The name, email address or phone number you gave us, so we can locate the right record.
  3. Any detail that helps: roughly when you contacted us, or which service you enquired about.

We will confirm receipt, verify that the request comes from you or someone authorised to act for you, and respond within 30 days.

Email your request

Verification exists to protect you: it stops someone else obtaining or deleting your data by pretending to be you. We ask for the minimum needed and use it for nothing else.

Data handled during a security engagement

This is a security company, so it is worth being explicit about something a generic privacy notice would leave out.

When we carry out a penetration test, vulnerability assessment or similar engagement, we may encounter personal data held in the systems we are testing. That data is not collected through this website and is not governed by this notice. It is handled under the engagement contract, the rules of engagement and the non-disclosure agreement signed before any testing begins, which set out what may be accessed, how findings are stored and transmitted, and when evidence is destroyed.

In that context our client is the Data Fiduciary and we act on their instructions. If your personal data was held in a system we tested, the organisation that owns that system is the right place to direct a request, and we will support them in answering it.

How we protect personal data

Enquiries are submitted over an encrypted connection and stored in our hosting provider's contact system with access limited to the people who need it. The website holds no credentials in the browser: the contact form is processed on the server, so no key or token is ever sent to your device.

No control set makes a breach impossible, and we will not claim otherwise. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the Act requires.

Children's personal data

This website sells professional services to organisations and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Links to other websites

This site links to Nexix Academy, to our profiles on LinkedIn, X, Instagram and YouTube, and from research articles to third-party sources. Once you follow a link you are on someone else's site under their privacy notice, not ours. A link is not an endorsement of their data practices, and we have no control over them.

Changes to this notice

We update this notice when our practices or the law change. The effective date at the top tells you which version you are reading. Where a change materially affects your rights we will take reasonable steps to tell you rather than relying on you to notice.

How to contact us

For any question about this notice, or to exercise a right, contact us:

Grievance redressal

Under the Digital Personal Data Protection Act 2023 you may raise a grievance about how we handle your personal data. Send it to the address above with “Grievance” in the subject line and it will be routed to the person responsible for answering questions about our processing. We will acknowledge it and respond within 30 days.

If we do not resolve your grievance to your satisfaction, you may complain to the Data Protection Board of India.