Privacy notice
Purpose: tells every person whose data Clexen handles exactly what is collected, why, who receives it, how long it is kept, and how to exercise their rights. It is written to stand on its own, as rule 3 of the DPDP Rules 2025 requires, and to meet the IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules 2011, which apply until the DPDP Act's substantive provisions commence on 13 May 2027. Parties: Clexen (Data Fiduciary) and individuals (Data Principals).
Acceptance trigger: this is a notice, not a contract. It is linked at every form that collects Personal Data, and in the footer. Consent, where relied on, is captured separately, with its own checkbox and record.
In short: we collect what we need to get you quotes or send you requests, and to bill partners. Your mobile number goes to a partner only when you choose that partner. We do not sell data. Analytics cookies load only if you accept them. To see, correct or delete your data, write to privacy@clexenrentals.com.
1. Who we are and how to reach us
Clexen Rentals Private Limited, H.No. 13/1, Kh. No. 52/11/2, Shiv Bux Park, Nangloi, New Delhi 110041.
Person to contact about your data: Rohit Chauhan, Director, privacy@clexenrentals.com, +91 99992 25725.
2. What we collect, why, and on what basis
| Who | Data | Purpose | Basis | Kept for |
|---|---|---|---|---|
| Customers sending a Request | Name, company, mobile, email, GSTIN (optional), Site city or area, equipment need, dates, duration, notes, source page and campaign tags | To find and show quotes; call you to clarify; share with the Partner you choose; follow up on the Order; handle complaints | Your consent given on the form, and use for the purpose you provided the data for (DPDP Act s.7(a)) | 3 years after your last Request, then deleted or anonymised; longer only if a dispute or legal hold requires |
| Customers after an Order | Ratings, comments, change, extension or cancellation requests | Service quality, Partner ranking, dispute help | Consent; legitimate use | As above |
| Partners and their staff | Name, business name, mobile, email, city, GSTIN, PAN, bank details for refunds, machine details and photos, documents, Operator details, quotes, orders, fee and payment records | To admit and list you, send Requests, bill fees, verify compliance, pay refunds, meet tax duties | Contract (your agreement); legal obligation (tax and accounts); consent for optional data | For the relationship, then 8 years for accounting and tax records (Companies Act, GST law); other data 3 years |
| People who call, message or email us | Name, number, email, message, call notes | To reply and keep a record of the conversation | Consent; legitimate use | 2 years |
| Job applicants | Name, contact details, CV, role | To assess the application | Consent | 12 months, or longer with your consent |
| Website visitors | IP address, device and browser data, security logs. Analytics data only if accepted (Document 11) | Security, fraud prevention, troubleshooting; analytics if accepted | Legal obligation (security logs at least 1 year: DPDP Rules, rule 6); consent for analytics | Logs 1 year; analytics 14 months |
| Everyone who accepts a document | Document, version, time, IP, browser, page | Proof of acceptance and consent | Legal obligation; legitimate use | For the life of the relationship plus 8 years |
| Partner and admin app users who allow alerts | Push subscription token | To send alerts about Requests and Orders | Consent (browser prompt) | Until you switch off alerts or sign out |
We do not knowingly collect data of anyone under 18. We do not ask for sensitive data such as health, financial account passwords or biometrics. Bank details are taken only from Partners, and only for refunds.
3. Who receives your data
- The Partner you choose (Customers). Your name, company, mobile, email and GSTIN (if given), so that the Partner can confirm and perform your Order. Before Choice, Partners see only your Request details, not your identity. The Partner then handles your data as an independent Data Fiduciary (Document 04, clause 8).
- The Customer who chooses you (Partners). Your business name, contact person and number.
- Our processors, who act on our instructions and are bound to protect your data:
- GoDaddy: website hosting, servers in Singapore;
- Google Workspace: email, including the inboxes listed in our terms;
- Razorpay: Partner payments; we never see card numbers;
- SMS and WhatsApp service providers, once appointed, for service messages and opted-in promotional messages;
- Google Analytics and Microsoft Clarity: only if you accept analytics;
- your browser's push service: for alerts.
- Authorities, where the law requires, or to protect the rights or safety of people or Clexen.
- A successor, if our business is reorganised or sold, under the same protections.
We do not sell or rent Personal Data.
4. Transfers outside India
Some processors store data outside India, including our host in Singapore. The DPDP Act allows such transfers except to countries the Central Government restricts, and we will follow any restriction. We choose providers with appropriate security commitments.
5. Your rights and how to use them
You may ask us to:
- give you a summary of your data and of who we shared it with;
- correct, complete or update it;
- erase it where we no longer need it and the law does not require us to keep it;
- withdraw consent at any time, as easily as you gave it. Withdrawal does not affect what was done before. If we need the data for a live Request or Order, we will explain the effect of withdrawal.
You may also nominate someone to exercise your rights if you die or become incapable.
How: email privacy@clexenrentals.com from your registered number or email, or use the link in any message from us.
- We will verify your identity.
- We will reply within 30 days, and in any case within the 90 days the DPDP Rules allow.
- Unsubscribing from marketing takes effect at once (Document 12).
Complaints: first to our Grievance Officer (Document 14). If you are not satisfied, you may complain to the Data Protection Board of India once its procedures apply.
6. Security
Our safeguards include:
- HTTPS encryption in transit;
- hashed passwords and one-time links;
- role-based access for staff;
- access logs kept for at least one year;
- private, unguessable Request Page links;
- backups;
- contracts with processors.
No system is perfectly secure. If a breach affects your data, we will tell you without delay, in plain language, with what happened, the likely impact and what we are doing. We will report to the Data Protection Board as the Rules require: a first notice without delay and a detailed report within 72 hours.
7. Cookies
See the Cookie Notice (Document 11). Analytics cookies load only with your consent.
8. Changes
The version and date are shown at the top. If we want to use your data for a new purpose that needs consent, we will ask you first.