Effective date: [17-July-2026]

Last updated: [17-July-2026]

 1. Who We Are

This Privacy Policy explains how NXTAVSAR, operated by INSTOC ([Legal/Proprietor Name]) ("we", "us", "our"), collects, uses, shares, and protects your personal data when you use our website, WhatsApp channels, or services. We act as a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act") in respect of the personal data we process.

 2. Personal Data We Collect

 * Identity & contact data: Name, mobile number, email address, WhatsApp number

 * Application data: Details you submit for a specific service — e.g., PAN, government ID/Aadhaar number (only where required for a specific application you ask us to assist with), academic records, college/institution name, address, category/caste certificates where relevant to a scheme

 * Documents you upload: PDFs and other files you upload for printing, application submission, or verification

 * Payment data: Transaction ID and payment status from Razorpay. We do not store your card, UPI PIN, or full payment credentials — these are handled directly by Razorpay

 * Usage data: Pages visited, device/browser type, and similar technical data collected automatically via our website

We only collect government identification numbers or cards where strictly necessary for the specific service you have asked us to help with, and only with your explicit consent at the time of submission.

 3. Why We Collect It

 * To provide the specific service you requested (e.g., submitting a scholarship or certificate application on your behalf, generating a print order, sharing your details with an insurance partner you asked to be connected with)

 * To process payments and issue receipts

 * To communicate with you about your application/order status

 * To respond to support requests and grievances

 * To comply with applicable law, including recordkeeping obligations

We do not sell your personal data to third parties, and we do not use your uploaded documents (such as PDFs sent for printing) for any purpose other than fulfilling that specific order.

 4. Legal Basis and Consent

Under the DPDP Act, we process your personal data on the basis of your consent, given for a specified, legitimate purpose at the time you submit information to us (for example, when you upload a document, fill an application form, or check out for a paid service). You may withdraw consent at any time by contacting us at [privacy/support email], though this may mean we can no longer continue an in-progress service that depends on that data.

Note on DPDP Act implementation: The DPDP Act, 2023 and the DPDP Rules, 2025 are being brought into force in phases by the Government of India, with core consent, notice, and data-principal-rights provisions becoming fully binding by 14 May 2027. We have adopted DPDP-aligned practices ahead of this deadline as part of our commitment to protecting your data.

 5. How We Share Your Data

We share your personal data only where necessary to deliver the service you requested, including with:

 * The relevant government department, board, or authority — where you have asked us to submit or assist with an official application

 * Razorpay — to process your payment

 * Odoo — our website and order-management platform, which stores your order and contact details on our behalf

 * Policybazaar or other licensed insurance partners — only if you specifically opt to be referred for an insurance quote

 * Law enforcement or regulators — only where required by applicable Indian law

We do not knowingly transfer your personal data outside India except where our service providers listed above process data on servers located outside India as part of their standard infrastructure; in such cases, we rely on their own compliance obligations and contractual safeguards.

 6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose it was collected for, plus any additional period required to comply with our legal, accounting, or dispute-resolution obligations. Uploaded documents used for one-time services (such as printing) are deleted from our active systems within [10 days] of order completion, unless you ask us to retain them for a repeat order.

 7. Your Rights as a Data Principal

Under the DPDP Act, you have the right to:

 * Access a summary of the personal data we hold about you and how it is being processed

 * Request correction or completion of inaccurate or incomplete personal data

 * Request erasure of your personal data, where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations

 * Withdraw consent at any time

 * Nominate another individual to exercise these rights on your behalf in the event of death or incapacity

 * Register a grievance with us, and thereafter with the Data Protection Board of India if unresolved

To exercise any of these rights, contact our Grievance Officer — see the Grievance Officer Details page.

 8. Children's Data

Many of our services (scholarships, admissions, internships) are relevant to students who may be minors. Where a user is a minor, we require that a parent or legal guardian creates the account, provides verifiable consent, and remains responsible for the submitted data and any payment made.

 9. Security Safeguards

We use reasonable technical and organisational measures — including access controls and secure payment processing through Razorpay — to protect your personal data against unauthorised access, alteration, disclosure, or destruction. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

 10. Data Breach Notification

In the event of a personal data breach affecting you, we will notify you and, where required, the Data Protection Board of India, in accordance with the timelines prescribed under the DPDP Act and Rules.

 11. Cookies

Our website may use cookies and similar technologies to remember your preferences and understand site usage. You can control cookies through your browser settings; disabling them may affect some site functionality.

 12. Grievance Redressal

If you have a concern about how your personal data has been handled, please contact our Grievance Officer first — details are on our Grievance Officer Details page. We aim to acknowledge your grievance within 24 hours and resolve it within a reasonable time as required under applicable Indian law.

 13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law, including further phases of DPDP Act implementation. The updated version will be posted here with a revised date.