EXICON GROUP

Privacy Policy

Last updated: August 05, 2026

Effective date: August 05, 2026

About This Policy

This Privacy Policy describes how Exicon Holding Private Limited (referred to as "Exicon Group", "we", "us", or "our") collects, uses, stores, and discloses your personal data when you use our website at https://www.exicongroup.com (the "Website"), and explains your rights as a Data Principal under applicable Indian law.

By using the Website, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.

This policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), and should be read alongside our Cookie Policy.

Identity of the Data Fiduciary

As defined under the DPDPA, the Data Fiduciary responsible for your personal data is:

Definitions

The following terms have the meanings assigned to them below, whether used in singular or plural:

Data Fiduciary

Any person who, alone or in conjunction with others, determines the purpose and means of processing of personal data. Exicon Group is the Data Fiduciary in this context.

Data Principal

The individual to whom personal data relates — i.e., you, the user of this Website.

Data Processor

Any person who processes personal data on behalf of a Data Fiduciary.

Personal Data

Any data about an individual who is identifiable by or in relation to such data, as defined under the DPDPA 2023.

Processing

Any operation or set of operations performed on personal data, including collection, recording, storage, use, sharing, transfer, or deletion.

Consent

A free, informed, specific, and unambiguous indication of the Data Principal's wishes by a clear affirmative action.

Data Protection Board

The Data Protection Board of India established under Section 18 of the DPDPA 2023.

Cookies

Small files placed on your device by a website, used to store browsing and preference information.

Usage Data

Data collected automatically from your use of the Website, including IP address, browser type, pages visited, and time spent.

Personal Data We Collect

We collect only the personal data necessary to provide our services and respond to your enquiries. The categories of personal data we collect are as follows:

4.1 Data You Provide Directly

When you submit an enquiry through our contact form, we collect:

  • Full name
  • Email address
  • Phone number (if provided)
  • Company name (if provided)
  • The content of your message or enquiry

4.2 Data Collected Automatically (Usage Data)

When you visit our Website, we automatically collect the following data for operational and analytics purposes:

  • Internet Protocol (IP) address
  • Browser type and version
  • Pages visited and time spent on each page
  • Date and time of your visit
  • Device type and operating system
  • Referring website or source
  • Unique device identifiers

4.3 Data Collected via Cookies and Tracking Technologies

We use cookies and similar tracking technologies including web beacons, pixel tags, and scripts. Please refer to Section 7 (Cookies) for full details.

We do not collect sensitive personal data (such as financial data, health data, biometric data, or government identification numbers) through this Website.

Purpose of Processing

Under the DPDPA 2023, we are required to specify the distinct purpose for which each category of personal data is processed. We process your personal data only for the purposes listed below:

Responding to enquiries

Data processed: Contact form data (name, email, phone, message)

Purpose: To respond to questions, service requests, or business enquiries submitted through our Website.

Service delivery and account management

Data processed: Name, email, contact details

Purpose: To manage any service agreements, correspondence, and ongoing business relationships.

Website operation and security

Data processed: Usage Data, IP address, device data

Purpose: To maintain the security, functionality, and integrity of the Website; to detect and prevent fraud or unauthorised access.

Analytics and improvement

Data processed: Usage Data (anonymised or aggregated where possible)

Purpose: To understand how the Website is used and to improve its content, design, and performance.

Marketing communications

Data processed: Email address (with consent only)

Purpose: To send you information about our services, events, or updates where you have opted in. You may withdraw consent at any time.

Legal compliance

Data processed: Any relevant personal data

Purpose: To comply with applicable laws, regulations, court orders, or requests from public authorities.

Business transfers

Data processed: Personal data held at time of transaction

Purpose: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. You will be notified in advance.

Cookies and Tracking Technologies

We use Cookies and similar tracking technologies on our Website. You may instruct your browser to refuse all Cookies; however, certain features of the Website may not function correctly as a result.

Sharing of Personal Data

We do not sell your personal data. We may share your personal data only in the following circumstances:

8.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf — for example, for web hosting, analytics, email delivery, and form submission services. All such providers are bound by contractual obligations to handle your data securely and only for the purposes we specify.

8.2 Affiliates

We may share your data with affiliated entities within the Exicon Group of companies. Such affiliates are required to honour this Privacy Policy and the DPDPA 2023.

8.3 Business Partners

Where we engage business partners to offer joint services or promotions, we may share relevant data only with your prior knowledge and, where required, your consent.

8.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred. We will provide advance notice before your data becomes subject to a different privacy policy.

8.5 Law Enforcement and Legal Obligations

We may disclose your personal data to public authorities or law enforcement agencies where required by law, court order, or government directive, including for the purposes of:

  • Complying with a legal obligation
  • Protecting the rights or property of Exicon Group
  • Preventing or investigating wrongdoing in connection with the Website
  • Protecting the personal safety of users or the public
  • Protecting against legal liability

International Transfer of Personal Data

Your personal data is primarily processed at our offices in Mumbai, India. Where data is transferred to or processed in any other country, we ensure that adequate safeguards are in place in compliance with the DPDPA 2023.

We will not transfer your personal data to any country that the Government of India has restricted by notification. Where transfers are permitted, we ensure contractual protections are in place with all recipients.

Retention of Personal Data

We retain your personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by law. Specifically:

  • Contact enquiry data: retained for up to 3 years from the date of last contact, or as required by any ongoing business relationship.
  • Usage Data: generally retained for 12 months, unless a longer period is required for security or legal compliance purposes.
  • Marketing data: retained until you withdraw your consent or request deletion.

Once personal data is no longer required, it is securely deleted or anonymised in accordance with applicable law.

Your Rights as a Data Principal

Under the DPDPA 2023 and DPDP Rules 2025, you have the following rights with respect to your personal data:

  • Right to information: You may request a summary of the personal data we hold about you, and information about how it is being processed.
  • Right to correction and erasure: You may request that we correct inaccurate or incomplete personal data, or erase data that is no longer necessary for the purpose for which it was collected.
  • Right to grievance redressal: You have the right to have your grievances addressed within a reasonable time. You may raise a complaint with our grievance officer (see Section 14) and, if unresolved, with the Data Protection Board of India.
  • Right to nominate: You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
  • Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us at hello@exicongroup.com. We will respond within a reasonable timeframe and in any event within the period prescribed by applicable law.

Data Breach Notification

In the event of a personal data breach that is likely to cause harm to you as a Data Principal, we will:

  • Notify the Data Protection Board of India within 72 hours of becoming aware of the breach.
  • Notify affected Data Principals as soon as reasonably practicable, including the nature of the breach, the data affected, and the steps we are taking to mitigate any harm.

The breach notification will include the nature and extent of the breach, the timing and location, likely consequences, and the mitigating measures taken or proposed.

Children's Privacy

Our Website is not directed at children under the age of 18. We do not knowingly collect personal data from minors. Under the DPDPA 2023, processing of personal data of children requires verifiable parental consent.

If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us immediately at hello@exicongroup.com and we will take steps to delete such data promptly.

Grievance Redressal

In accordance with the DPDPA 2023 and DPDP Rules 2025, we have designated a point of contact for data-related grievances:

  • Grievance Contact: Digital Marketing Services Team
  • Email: hello@exicongroup.com
  • Address: B2-703/704, Kanakia Boomerang Building, Chandivali Farm Road, Andheri East, Mumbai – 400072, Maharashtra, India

We will acknowledge your grievance within 48 hours and endeavour to resolve it within a reasonable period. If your grievance is not resolved to your satisfaction, you may escalate the matter to the Data Protection Board of India at https://www.dataprotectionboard.gov.in.

Links to Third-Party Websites

Our Website may contain links to third-party websites not operated by us. We have no control over and accept no responsibility for the content, privacy policies, or practices of any third-party sites. We strongly advise you to review the privacy policy of every website you visit.

Security of Your Personal Data

We implement commercially reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include access controls, encrypted data transmission, and regular security reviews.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee its absolute security. In the event of a breach, we will act in accordance with Section 12 above.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, or the DPDP Rules. When we make material changes, we will:

  • Post the updated policy on this page with a revised "Last updated" date.
  • Notify you via email or a prominent notice on our Website prior to the change taking effect.
  • Where required by law, seek fresh consent from affected Data Principals.

You are advised to review this policy periodically. Continued use of the Website after changes are posted constitutes your acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact us at: