Privacy Policy

Definitions

In this policy, "Model Exorex 100", "we", and "us" mean Exorex Analytics Technologies Pvt. Ltd., operating the platform under the trading name Model Exorex 100. "Personal data" means information relating to an identified or identifiable individual, referred to as a "data principal" under Indian law. "You" means a visitor, registrant, or client.

Personal data

We collect at minimum your first name, last name, telephone number, and email address when you register or contact us. Identity verification adds the document data described in the AML/KYC policy. Content you provide in messages, complaints, or support conversations is also personal data.

Usage data

When you use the site, we collect technical usage data: pages visited, approximate location derived from your IP address, browser and device type, referrer, and timestamps. This data keeps the service secure, stable, and understandable in the aggregate. It is not used to build advertising profiles.

Cookies

The platform uses strictly necessary cookies for session integrity and security, and functional cookies that remember interface choices. Analytics cookies may be used in aggregate to understand which pages help users and which confuse them. You can refuse non-essential cookies in your browser; the site remains fully usable.

Data fiduciary and processors

Model Exorex 100 is the data fiduciary responsible for the personal data it collects. Service providers process data on our behalf under written agreements: hosting and infrastructure operators, KYC verification providers, email delivery services, and analytics tools. They may act only on our documented instructions.

Collection and use

We use personal data to answer your requests, to set up and operate your account, to verify identity and prevent fraud, to execute and document transactions, to meet legal obligations, to secure the platform, and to improve the service. Marketing messages are sent only where you consented, and every message carries a working unsubscribe link.

Legal bases and notice

Processing rests on contract for running the account you asked for, on legal obligation for verification and record-keeping, and on consent for marketing and optional cookies, consistent with the Digital Personal Data Protection Act's notice-and-consent framework. Security processing proceeds on legitimate grounds recognized for preventing fraud and misuse.

Data retention

Registration and contact data are kept while the relationship lasts and for a reasonable period after. KYC and transaction records are kept for the retention periods Indian law requires, measured in years after the end of the relationship. Aggregate usage data may be kept longer because it no longer identifies you. When retention ends, data is deleted or irreversibly anonymized.

Data transfer

Some providers operate outside India. Where personal data is transferred internationally, we use providers offering comparable protection, rely on appropriate transfer mechanisms, and limit what is transferred to what the purpose needs.

Disclosure

We do not sell personal data. We share it with execution and custody intermediaries to the extent needed to operate your account, with service providers under the agreements above, with affiliates involved in providing the service, and with regulators, courts, or law enforcement where the law requires or a valid order compels disclosure.

Security

Data is protected with encryption in transit and at rest, access controls, and logging, as described on the Security page. No system is perfectly secure, so we also maintain an incident process that includes notifying affected individuals and the relevant authorities where required.

Your rights as a data principal

You can request access to the personal data we hold about you, correction of inaccurate or incomplete data, erasure of data that is no longer needed for a permitted purpose, and withdrawal of consent for processing that rests on it, including marketing. Grievances about data handling go first to our grievance officer at [email protected] and, if unresolved, can be escalated under the Act's provisions. Requests are answered within the timelines the law prescribes.

Service providers

Current categories of providers include hosting, KYC verification, email delivery, analytics, and payment processing. Each receives only the data needed for its function, and the list of categories is updated as the service evolves.

Analytics

We use analytics to count visits, understand navigation, and find broken journeys. Where Google Analytics is enabled, its GA4 identifier is set in the site configuration by the operator, and you can block it with standard browser tools. Analytics never gates access to content or features.

Advertising and retargeting

The platform does not run advertising trackers of its own. If marketing partners are used later, their cookies will be disclosed here and will honor your consent choices before loading.

Third-party links

Pages may link to third-party sites, such as regulators' public pages or payment providers. Once you follow a link, this policy no longer applies; read the destination's own policy before sharing data there.

Children

The platform is intended for adults. Accounts are not offered to anyone under 18, and verification exists partly to enforce this. If we learn that data was collected from a child, it is deleted promptly.

Changes and contact

This policy can change as the service or the law changes. The current version is always this page, and material changes are announced in the account. Questions and requests go to Client Support and Compliance at [email protected], or by post to 14 Barakhamba Road, Connaught Place, New Delhi 110001, India.