Effective date: August 1, 2026
Nexus Orb (“Nexus Orb”, “we”, “us”, “our”) operates the website nexusorb.com and provides web design, development, branding, UI/UX design, graphic design, and digital marketing services (the “Services”). This Privacy Policy explains what personal data we collect when you visit this website, request a quote, engage us for a project, place an order through our online store, or otherwise interact with us, why we collect it, and the rights you have over it.
Nexus Orb is a sole proprietorship run by Niladri Das, based in Kolkata, India, and is the “Data Fiduciary” of your personal data under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) for the purposes described in this policy.
1. Information We Collect
1.1 Information you give us directly
- Enquiry and contact details — name, email address, phone number, budget range, timeframe, and project details, when you submit our contact form, request a quote, or book a consultation.
- Project and engagement information — business details, brand assets, content, and any files you share with us in the course of a design, development, or marketing engagement.
- Order and payment information — if you purchase through our online store, we (and our payment processor) collect your billing details, shipping address, and payment reference information. We do not store your full card or UPI credentials ourselves — payments are processed by Razorpay, our payment gateway provider.
- Newsletter and marketing sign-up — your email address, if you choose to subscribe.
1.2 Information collected automatically
- Device and usage information — IP address, browser type, device type, operating system, referring/exit pages, and the pages you view on our site.
- Cookies and similar technologies — see our Cookie Policy for full details on what we use and how to control them.
1.3 Information from third parties
If someone refers you to us, or if you interact with us via a linked social media profile, we may receive your name and contact details from that source.
2. How We Use Your Information
- To respond to your enquiries and provide quotations;
- To deliver the Services you’ve engaged us for, including project communication, invoicing, and support;
- To process orders and payments made through our online store;
- To send you service-related communications (project updates, invoices, replies to your messages);
- To send marketing communications, but only where you’ve opted in — you can unsubscribe at any time via the link in any marketing email or by contacting us directly;
- To maintain, secure, and improve our website (for example, understanding which pages are useful and diagnosing technical issues);
- To detect and prevent fraud, abuse, or security incidents;
- To comply with our legal and tax obligations.
3. Legal Basis for Processing
Under the DPDP Act, we process your personal data on the basis of your consent (for example, when you submit our contact form or subscribe to updates) or where processing is a “legitimate use” recognised under the Act — such as when you’ve voluntarily provided your data to us for a specified purpose (like requesting a quote) and haven’t indicated you don’t consent to its use for that purpose, or where processing is necessary to fulfil a contract we have with you (such as delivering a paid project or an order).
If you are located in the United Kingdom or European Economic Area, we process your data under equivalent legal bases recognised by the UK GDPR / EU GDPR — principally contractual necessity, consent, and our legitimate interest in operating and marketing our business, balanced against your rights.
4. How We Share Your Information
We do not sell your personal data. We share it only with:
- Service providers who help us operate — our web hosting provider, our payment gateway (Razorpay) for processing orders, our email service provider, and website analytics tools. These providers only receive the data they need to perform their function and are not permitted to use it for their own purposes.
- Professional advisors — accountants or legal counsel, where necessary, and bound by confidentiality.
- Legal and regulatory authorities — where required to comply with a legal obligation, court order, or lawful request, or to protect our rights, property, or safety, or that of our clients or the public.
- A successor business — if Nexus Orb were ever to merge with, or be acquired by, another business, your data may transfer as part of that transaction, subject to the same protections described here.
5. Cookies
We use cookies and similar tracking technologies to operate our website and understand how it’s used. Full details — including how to disable cookies in your browser — are in our Cookie Policy.
6. Data Retention
We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. In general:
- Contact form and quote enquiries that don’t turn into a paid engagement are retained for up to 24 months, so we can follow up or you can reopen the conversation, after which they’re deleted.
- Client project, invoicing, and financial records are retained for longer periods driven by our legal and tax obligations — full detail is in our Data Retention Policy.
- Newsletter subscriptions are kept until you unsubscribe.
7. Data Security
We take reasonable technical and organisational measures to protect your personal data, including encrypted connections (HTTPS) across our website, access controls limiting who can view client data, and file validation on anything uploaded to us. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to minimise risk and will notify affected individuals and, where required, the relevant authorities in the event of a data breach likely to cause harm.
8. International Data Transfers
We serve clients across India, the United Kingdom, the United States, and elsewhere. As a result, your data may be processed on servers located outside your country of residence, including in India, where our infrastructure is based. Where we transfer data internationally, we take steps to ensure it continues to be protected in line with this policy.
9. Your Rights
If you are in India, under the DPDP Act you have the right to:
- Obtain a summary of the personal data we hold about you and the processing activities we carry out on it;
- Request correction, completion, or updating of your personal data;
- Request erasure of your personal data, once it’s no longer needed for the purpose it was collected for (subject to any legal retention obligation we’re under — for example, we cannot erase financial records still within their mandatory retention period);
- Withdraw consent at any time, as easily as you gave it — though this won’t affect processing carried out before withdrawal, or processing we’re permitted to continue under a “legitimate use” basis;
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
- Have a readily available means to raise a grievance with us (see Section 10 below), and, if unresolved, to approach the Data Protection Board of India.
If you are in the UK or EEA, you have equivalent rights under GDPR, including the right to access, rectify, erase, restrict, or object to processing of your data, and the right to data portability.
To exercise any of these rights, contact us using the details in Section 10.
10. Grievance Officer / Contact for Data Protection Requests
In accordance with the DPDP Act, the following person is available to address your questions, requests, or grievances regarding your personal data:
Niladri Das
Nexus Orb
Shivakripa Building, Mahisbathan, Sector 5, Salt Lake, Kolkata 700102, West Bengal, India
Email: [email protected]
We aim to acknowledge data protection requests within 7 business days and resolve them within 30 days, or inform you if more time is needed.
11. Children’s Privacy
Our website and Services are not directed at, and not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.
12. Do Not Track
Some browsers offer a “Do Not Track” signal. Because there isn’t yet an industry-standard way to respond to these signals, our website does not currently alter its data collection practices when it detects one.
13. Third-Party Links
Our website may link to third-party sites (for example, client websites in our portfolio, or our social media profiles). We aren’t responsible for the privacy practices of those sites — we encourage you to review their own privacy policies.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or legal requirements. The effective date at the top of this page reflects the most recent revision. Material changes will be highlighted on this page or communicated directly to active clients where appropriate.
15. Governing Law
This Privacy Policy is governed by the laws of India. It is provided for general informational purposes and does not constitute legal advice.
16. Contact Us
Questions about this Privacy Policy, or a data request, can be sent to [email protected] or by post to the address in Section 10.
Nexus Orb, Kolkata, India · [email protected]