Privacy Policy & Data Protection

1. Overview & Data Fiduciary Identity

NSE – New Sahyadri Elevator ("NSE", "we", "us", or "our") is committed to protecting the privacy, security, and digital dignity of our clients, building management committees, and website visitors.

This Privacy Policy explains the categories of personal and technical data we collect, why we process it, how we safeguard it, and how you may exercise your statutory rights under the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023, India) and applicable telecommunications and cybersecurity regulations.

2. Two-Tier Location Information Architecture

To deliver elevator maintenance, technical diagnostics, and rapid emergency entrapment response across key metropolitan zones, our platform employs a disciplined, two-tier location architecture:

3. Categories of Information Collected

• Inquiry & Contact Details: Full name, phone number, society/commercial building name, email address, physical property address, and service requirement details submitted via our quote calculator, AMC request forms, emergency callback forms, or audit request tools.
• Elevator Technical Specifications: Number of lifts/elevators, equipment age, building typology (residential CHS, commercial IT park, hospital, industrial), current OEM brand (Otis, Schindler, Kone, ThyssenKrupp/TK, Johnson, etc.), and operational complaints.
• Attribution & Marketing Parameters: First-touch and last-touch UTM parameters (source, medium, campaign, term, content), Google Click Identifiers (gclid), Meta Click Identifiers (fbclid), and referral sources.
• Technical Telemetry & Session Metrics: Anonymous visitor UUIDs (stored in local cookies), page views, scroll depth milestones (25%, 50%, 75%, 100%), time spent on mission-critical pages, quote calculator funnel progression/drop-off, and contact method preference (phone call vs. WhatsApp).
• Session Recording Data: We may utilize privacy-preserving diagnostic tools (such as Microsoft Clarity) with keystroke masking enabled to analyze navigation usability. Sensitive form inputs (passwords, phone numbers, addresses) are strictly masked and never recorded.

4. Purposes of Processing & Legal Basis under DPDP Act 2023

In accordance with Section 4 and Section 6 of the Digital Personal Data Protection Act, 2023, NSE processes personal data exclusively for lawful purposes for which you have provided clear, affirmative consent or for specified legitimate commercial uses:

5. Third-Party Sharing & Absolute No-Sale Commitment

We only share limited operational data with vetted service partners bound by non-disclosure agreements:

• Certified Field Service Technicians: Contact and address information dispatched to our field technicians in Navi Mumbai and Pune to execute maintenance or breakdown service.
• Cloud & Telemetry Infrastructure: Secure database hosting (MongoDB, AWS, Vercel) adhering to strict enterprise encryption at rest (AES-256) and in transit (TLS 1.3).
• Reverse Geocoding Infrastructure: Ephemeral latitude/longitude queries sent to OpenStreetMap Nominatim for human-readable address resolution. No persistent personal identifiers are transmitted during reverse geocoding queries.
• Competent Legal Authorities: When strictly mandated by applicable judicial summons, court order, or formal legal process under Indian jurisdiction.

6. Data Retention & Security Measures

We retain personal data only for as long as necessary to fulfill the operational, legal, and safety verification purposes described in this policy:

• General Web Inquiries & Quotes: Retained for 24 months after last contact or until consent is explicitly withdrawn.
• Executed AMC & Modernization Contracts: Retained for 7 years following contract completion in accordance with Indian commercial record-retention laws.
• Elevator Safety Inspection & Service Records: Retained for the operational lifecycle of the elevator system to ensure comprehensive maintenance history and equipment safety verification.
• Pseudonymous Telemetry & Location Analytics: Raw telemetry logs are automatically aggregated and depersonalized after 12 months.

We enforce administrative, technical, and physical safeguards including strict role-based access control (RBAC), bcrypt credential hashing, salted token generation, automated rate limiting, and routine vulnerability patch cycles.

7. Your Rights under the DPDP Act, 2023

As a Data Principal under Indian law, you possess the following enforceable rights:

To exercise any of these statutory rights, please send a written request to our Grievance Officer using the contact details below. We will verify your identity and respond within thirty (30) business days.

8. Grievance Redressal Officer Contact

In compliance with Section 10 of the Digital Personal Data Protection Act, 2023, the details of our designated Data Grievance Redressal Officer are as follows:

If an issue cannot be resolved through our internal grievance mechanism, you have the statutory right under the DPDP Act 2023 to submit a complaint to the Data Protection Board of India.