Legal & Support
Privacy Policy
Effective date: 30 September 2026. Last updated: 30 September 2026.
1.1 Introduction and scope
This Privacy Policy explains how Biz Matrix (“BizMatrix”, “we”, “us”, “our”), operating the web application Biz Matrix – Business Structure Intelligence at www.bizmatrix.in (the “Platform”), collects, uses, stores, shares and protects your personal data.
This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”); and the Consumer Protection (E-Commerce) Rules, 2020.
By using the Platform and giving consent where requested, you agree to this Policy. If you do not agree, please do not use the Platform.
1.2 Definitions
- Personal Data: any data about an individual who is identifiable by or in relation to such data.
- Data Principal: you, the individual to whom the Personal Data relates.
- Data Fiduciary: Biz Matrix, which determines the purpose and means of processing your Personal Data.
- Assessment Data: the answers you enter in the 19-question assessment.
- Report: the unlocked analysis, checklists, compliance calendar and downloadable PDF generated for you.
1.3 Data we collect
| Category | Examples | Why we collect it |
|---|---|---|
| Assessment Data | Business objective, expected turnover, capital, sector/activity, number of founders/partners, funding plans, liability and ownership preferences | To compute the entity recommendation, checklists, tax scenarios and compliance calendar |
| Contact Information | Optional checkout email and information you provide when contacting support | To associate contact information with your order and provide support |
| Transactional Data | Order ID, payment/transaction reference token, amount, status, timestamp | To verify payment, unlock access, handle refunds and maintain accounting records |
| Technical & Analytics Data | IP address, browser type/version, device and OS, pages viewed, referrer, timestamps, cookie identifiers | To secure the Platform, prevent fraud, diagnose errors and improve the service |
We do not knowingly collect your Aadhaar number, PAN, bank account details, card details, UPI PIN, CVV, passwords or other sensitive financial credentials. Please do not enter these in any free-text field.
1.4 Payment data
Payments are processed through PhonePe. Payment details are entered on the gateway’s checkout page and handled directly by the gateway. Biz Matrix does not receive, see or store card numbers, UPI PINs, CVVs or bank credentials. We receive order references, payment status, amount and timestamps. The gateway’s own privacy policy governs its processing.
1.5 Lawful basis and consent
We process Personal Data on the basis of:
- Your consent, given by a clear affirmative action (for example, ticking a consent box or submitting the unlock form). Consent is specific to the purposes listed in this Policy.
- Legitimate uses permitted by the DPDP Act, such as fulfilling a service you voluntarily requested, complying with law, and preventing fraud.
You may withdraw consent at any time (see 1.9). Withdrawal does not affect processing already carried out, and may prevent us from delivering or supporting the Report.
1.6 How we use your data
- To generate and display your entity recommendation and Report;
- To verify payment, unlock on-screen access, display a purchase receipt and enable PDF download;
- To provide support and resolve grievances;
- To detect, prevent and investigate fraud, abuse, scraping and security incidents;
- To analyse aggregated, non-identifying usage patterns to improve the Platform;
- To comply with legal, tax, accounting and regulatory obligations.
We do not sell your Personal Data. We do not use it for targeted third-party advertising. We will not send marketing messages unless you separately opt in.
1.7 Sharing and disclosure
We share Personal Data only as follows:
- PhonePe to process your payment;
- Service providers acting on our behalf, such as email/WhatsApp delivery, hosting, analytics and error-monitoring providers, bound by confidentiality and data-protection obligations;
- Authorities, where required by law, court order or lawful government request;
- Successors, in a merger, acquisition or restructuring, with notice to you where required.
Assessment Data used for analytics is aggregated and not linked to your identity.
1.8 Storage, location and cross-border transfer
We intend to store and process Personal Data on servers located within India. Where a service provider processes data outside India, this will be done only to the extent permitted by the DPDP Act and any restrictions notified by the Central Government, with appropriate contractual safeguards.
1.9 Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access a summary of the Personal Data we process and the identities of those with whom it is shared;
- Correction and updating of inaccurate or incomplete data;
- Erasure of data that is no longer necessary for the purpose or where you withdraw consent, unless retention is required by law;
- Grievance redressal (see the Grievance Redressal page);
- Nominate another person to exercise your rights in the event of your death or incapacity.
To exercise these rights, email nexifydigital03@gmail.com from the address you used on the Platform. We may verify your identity before acting. We aim to respond within 30 days.
1.10 Data retention
| Data | Retention |
|---|---|
| Assessment Data (not linked to payment) | Held in your browser session; server-side copies, if any, retained up to 90 days |
| Contact Information | Duration of service and up to 12 months after the last interaction, unless you request earlier erasure |
| Transaction Records | As required by tax and accounting laws (generally up to 8 years) |
| Technical Logs | Up to 12 months |
After the retention period we erase or irreversibly anonymise the data.
1.11 Security safeguards
We implement reasonable security practices consistent with the SPDI Rules and DPDP Act, including HTTPS/TLS encryption in transit, access controls on a need-to-know basis, secure handling of gateway webhook signatures, logging and monitoring. No system is completely secure. In the event of a personal data breach we will notify the Data Protection Board of India and affected users as required by law.
1.12 Children
The Platform is intended for persons who are 18 years or older. We do not knowingly process the Personal Data of children. If you believe a child has provided data, contact us and we will delete it.
1.13 Third-party links
The Platform may link to government portals (for example MCA, GST, Udyam) and other sites. We are not responsible for their content or privacy practices.
1.14 Changes to this Policy
We may update this Policy. Material changes will be notified on the Platform with a revised “Last Updated” date. Continued use after the effective date constitutes acceptance where permitted by law.
1.15 Contact
Data Fiduciary: Biz Matrix. Email: nexifydigital03@gmail.com.