Last updated: October 21, 2026
Nexatrix Solutions is a trade name of AP Consultancy Services, 310 Shail Complex, Behind Girish Cold Drinks, Navrangpura, Ahmedabad 380006, Gujarat, India (“Nexatrix”, “we”, “us”). We decide how and why the personal data described here is used, so we are the “controller” under the EU and UK GDPR and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
This policy applies to personal data we handle through nexatrixsolutions.com, our emails and calls, our recruitment and staff augmentation services, and our dealings with partner agencies and suppliers. It does not cover:
We provide services to businesses only. By using this website or sharing personal data with us, you confirm that you have read this policy. Where the law requires your consent, we ask for it separately and you can withdraw it at any time (section 10).
We collect only what we need to run a business-to-business service.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Website visitor | IP address, device and browser type, pages viewed, approximate location, referring site | Your browser; Google Analytics, only with your consent where required (section 7) |
| Enquirer or client contact | Name, work email, phone, company, role, your message, files you attach, emails and call notes | You, through our form, email, WhatsApp, calls or LinkedIn |
| Prospective client contact | Name, job title, work email, company, public job postings and company information | Public sources: company websites, public job boards, professional networks and business directories |
| Candidate or professional | CV and its contents, work history, skills, education, availability, notice period, rate expectations, contact details | You, or a partner agency that represents you |
| Partner agency or supplier contact | Name, work email, phone, company, the CVs and rates you send | You |
We do not ask for, and you must not send, sensitive data: government ID numbers, bank or card details, health, religion, caste, political opinions, sexual orientation, biometric data or criminal records. Remove such details from a CV before sending it. If they reach us anyway, we may delete them without notice and are not responsible for having received them.
| Purpose | GDPR / UK GDPR basis | DPDP Act basis |
|---|---|---|
| Answer enquiries and prepare proposals | Steps before a contract; legitimate interests | Consent you give by contacting us; purpose you volunteered |
| Deliver services, manage contracts, invoice and collect payment | Contract | Consent; legitimate uses under section 7 |
| Introduce candidates to clients and screen them against a role | Legitimate interests; consent where we ask for it | Consent (given by you or through your partner agency) |
| Contact businesses about our services (business-to-business email) | Legitimate interests, with an opt-out in every message | Consent you can withdraw at any time; publicly available business data |
| Run, secure and improve the website; measure visits | Consent for analytics cookies; legitimate interests for security | Consent |
| Keep records, meet tax, accounting and legal duties, and handle disputes | Legal obligation; legitimate interests | Legal obligation; legitimate uses |
Where we rely on legitimate interests, our interest is running and growing a business-to-business service, and we have weighed it against your rights. You can object at any time (section 10). We never use personal data for purposes unrelated to those above without telling you first and, where required, asking for consent.
We do not sell personal data and do not share it for third-party advertising.
We source professionals directly and through a network of independent partner agencies. CVs we receive are kept in our talent database and matched against client roles.
We share personal data only as needed for the purposes in section 3, and only with:
| Recipient | Why |
|---|---|
| Clients | To consider candidates for a role (anonymised first, as in section 4) and to run an engagement |
| Partner agencies | To source and place professionals; they receive role details and, where needed, client feedback on their candidates |
| Service providers working for us | Website and application hosting (Hostinger), email and documents (Google Workspace), website analytics (Google Analytics), AI processing of CVs and emails (Anthropic), and email sending services. They act on our instructions under their own security and confidentiality terms. |
| Professional advisers | Accountants, lawyers and auditors, under a duty of confidentiality |
| Authorities | When the law, a court order or a government request requires it, or to protect our rights, safety or property |
| A buyer or successor | If our business or its assets are sold, merged or restructured, under the same protections |
Clients and partner agencies who receive personal data from us are responsible for their own use of it under their own legal obligations. We are not responsible for how an independent client, agency or service provider handles data under its own control once it has been shared lawfully under this policy.
We are based in India, and our service providers may store data in India, the United States, the European Economic Area or other countries. Personal data from the UK or EEA is therefore transferred outside those regions.
Where UK or EU law requires a safeguard for such transfers, we rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, which our main service providers include in their terms, or on another lawful mechanism. For transfers out of India, we follow any restrictions notified under the DPDP Act. You can ask us for a summary of the safeguard that applies to your data (section 12).
| Type | Used for | Consent |
|---|---|---|
| Strictly necessary | Security, page delivery and caching, the contact form’s anti-spam check | Not required; the site cannot work without them |
| Analytics (Google Analytics 4) | Counting visits, pages viewed and enquiries, so we can improve the site | Asked for first where the law requires it, including for UK and EEA visitors; off until you accept |
We do not use advertising, retargeting or social media tracking cookies. You can change your choice at any time through the cookie settings link at the bottom of every page, or block cookies in your browser. Google’s use of analytics data is described in Google’s privacy policy.
We keep personal data only for as long as we need it for the purposes in section 3, and we review what we hold at least once a year. When we no longer need it, we delete it or make it anonymous. In particular:
We may keep data longer where the law requires it, or to establish, exercise or defend legal claims, only for as long as that need lasts.
We use reasonable security safeguards suited to a business of our size: encrypted connections (HTTPS) for the website and our applications, access limited to people who need it, password-protected accounts with strong passwords, restricted server access, regular software updates and backups, and confidentiality terms with partner agencies and service providers.
No method of storing or sending data over the internet is completely secure, and we cannot guarantee absolute security. You send information to us at your own risk, so please do not email passwords, financial details or the sensitive data listed in section 2.
If a personal data breach is likely to put your rights at risk, we will notify the relevant authority and the people affected within the time limits the law sets, including the Data Protection Board of India and, where they apply, the UK Information Commissioner’s Office or the relevant EU authority.
Depending on where you are, you can ask us to:
How to ask. Email compliance@nexatrixsolutions.com with your request and enough detail to find your data. We may ask you to confirm your identity, and we will not act on requests we cannot verify. We reply within one month under the UK and EU GDPR (extendable by two months for complex requests, with notice) and within the time set under the DPDP Act and its rules. Requests are free unless they are clearly unfounded, excessive or repeated, in which case we may charge a reasonable fee or decline.
Complaints. Please contact our Grievance Officer first (section 12), so we can try to resolve it. You also have the right to complain to the Data Protection Board of India, to the UK Information Commissioner’s Office, or to the data protection authority in the EU country where you live or work.
Limitation of liability. To the fullest extent permitted by law:
Nothing in this policy limits or excludes liability that cannot be limited or excluded by law, or any right you have under the GDPR, the UK GDPR, the DPDP Act or other data protection law. A written contract between you and us takes priority over this section.
Governing law. This policy is governed by the laws of India. The courts of Ahmedabad, Gujarat have exclusive jurisdiction, without affecting your right to complain to a data protection authority or any mandatory rights you have where you live.
Changes. We may update this policy from time to time. The new version applies from the date it is published here. If a change significantly affects how we use data you have already given us, we will tell you by email where we have your address, and ask for fresh consent where the law requires it.
Contact and Grievance Officer.