Privacy Policy

1. Operator, scope and separate sellers

Lanexis Private Limited, India ("Lanexis", "we", "us" or the "Portal Operator"), issues this Privacy Policy for the customer portal at customer.lanexis.com and its associated mobile application (the "Service"). It explains how personal information is handled in connection with the Service, including information about business contacts and authorised users.

The Portal Operator is separate from the Seller identified in an applicable sales agreement or accepted order. For U.S. transactions with Lanexis USA Inc., that entity is the Seller and handles relevant customer-contact and transaction information for its own commercial, support and compliance activities. Hosting or displaying those records does not make it a joint portal operator.

Each entity remains responsible for its own processing under applicable law. Where we process records solely on a Seller's instructions, we act on its behalf for those activities. Where an entity independently determines how and why information is used, its responsibilities follow that role. Requests involving more than one entity are coordinated as described below.

2. Information collected and its sources

The information handled depends on your role, the features you use and the records provided by you, your organisation or the relevant Seller. It includes the following categories to the extent relevant to those activities.

Account and business-contact information: name, business email address, telephone number, company and role, user identifier, login and authentication information, and a profile image if supplied. These details are provided by you or by an authorised administrator or business contact creating or maintaining your account.

Transaction and support information: enquiries, quotations, purchase orders, invoices, payment status and references, delivery and shipment details, account correspondence, technical requests and remarks. These records may be supplied by you, your organisation, the Seller or personnel administering the relationship.

Content and attachments: documents, PDFs, drawings, images, videos, signatures and other files submitted or made available for the relevant business purpose. Personal information may appear within the content or its metadata.

Technical and usage information: IP address, device, operating-system and browser information, authentication events, access times, pages or features accessed, error and diagnostic records, and information needed to maintain session security. When optional device notifications are used, a notification-delivery identifier may also be processed.

Do not submit personal passwords in correspondence, full card-security details, health information, government identity documents or other unnecessary sensitive information. Authentication data and any necessary payment-related information are used only for the relevant stated purpose and subject to applicable safeguards. Corporate records containing identifiable contact details remain personal information to that extent.

3. Purposes and lawful processing

We use account information to create and administer accounts, authenticate users, verify business authority, assign permissions and provide access to authorised records. We use transaction and support information to display and administer the relevant business relationship, facilitate communications and resolve enquiries.

We use submitted content to provide the requested document, media or support functions and make it available to the appropriate authorised users. Technical and usage information is used to maintain sessions, protect the Service, investigate misuse, diagnose errors and improve reliability and usability.

Information may also be used to send password-reset, security and service messages; manage privacy requests; maintain necessary transaction and compliance records; and establish, exercise or defend legal rights where lawful. Optional promotional communications are subject to applicable consent and opt-out requirements.

Processing takes place on the basis permitted by the law applicable to the particular activity, which may include consent, steps requested by you, performance of an applicable contract, compliance with a legal duty or another lawful business purpose where recognised by that law. We obtain separate consent where required and do not treat acceptance of portal Terms as consent to every possible use.

You may decline optional information or withdraw consent for processing based on consent. This does not affect prior lawful processing. We may be unable to provide a function that genuinely requires the information, but will not condition unrelated functions on unnecessary consent.

4. Cookies, device access and third-party content

Login, session, preference and security functions use relevant browser or application storage and session technologies. You can manage browser storage and device permissions through your settings; disabling technologies essential to authentication may prevent sign-in or other necessary functions.

Where an optional feature requires access to selected files, photos, a camera or device notifications, the relevant permission is requested for that feature. Permissions may be declined or withdrawn in device settings. The app does not obtain permission for unrelated purposes merely because you accept this Policy.

Non-essential analytics or tracking technologies, where offered, are subject to the disclosures and choices required by applicable law and platform rules. New collection or use requiring additional notice or consent will not be treated as authorised by this Policy alone.

An external website or media service you choose to open may receive connection information under its own policy. This is distinct from a service provider we appoint to operate the Service on our behalf. We remain responsible for our applicable obligations concerning those appointed providers.

5. Recipients, intercompany access and international processing

Authorised users and the relevant Seller: information is made available to users of your organisation according to assigned access and to personnel of the relevant Seller who need it for the transaction, support or compliance purpose. It is not made available to another customer merely because that customer also uses the Service.

Service providers: hosting, storage, authentication, communication-delivery, maintenance, security and technical-support providers may process information as needed for their assigned functions. Where diagnostic or analytics providers are used, the permitted processing is limited to the disclosed service purpose and applicable choices.

Legal and professional recipients: we may disclose necessary information to regulators, courts, law-enforcement authorities, auditors, insurers or professional advisers where lawfully required or justified. Any disclosure connected with a genuine business reorganisation or transfer is limited to what is lawful and necessary and is subject to appropriate safeguards and required notices.

Access between the Portal Operator and the relevant Seller is based on assigned responsibilities, not unrestricted group access. Providers and related entities receiving information are required to provide protection consistent with this Policy and applicable law, including appropriate confidentiality, security, purpose limitation, retention and request-handling safeguards.

The Service is administered from India. Information relating to U.S. transactions may also be accessed or processed in the United States by the relevant Seller. Appointed infrastructure and support providers may process information in their operating locations. Where international-transfer restrictions apply, required safeguards and lawful transfer conditions are used; acceptance of this Policy alone is not a blanket waiver of them.

We do not sell personal information. You may contact us for information about the recipients and processing locations relevant to your account or request.

6. Security and incident handling

We apply reasonable technical and organisational safeguards appropriate to the information and risks involved, including controlled access, account-security measures, protected handling of business records and restrictions on personnel and providers. Users must also protect their devices and credentials and promptly report suspected misuse.

No system or transmission method is entirely secure, and we do not promise absolute security. We assess and respond to suspected incidents and make notifications to affected persons or authorities as required by applicable law. This statement does not exclude legal responsibilities for maintaining appropriate safeguards.

7. Retention and restricted records

Information is retained only for as long as justified by the relevant service purpose, an applicable legal requirement or another lawful retention exception. We consider the nature and sensitivity of the information, account activity, statutory periods, contractual and product-support requirements, security needs and relevant claims or investigations. We delete or irreversibly anonymise information when the justification expires.

Account data: ordinary profile information, authentication data, optional notifications and personal notes are held while needed for the account and are addressed through the deletion process in Section 8 when the account is closed. Unnecessary attachments and other user-linked content are included; there is no blanket exemption for uploaded content.

Accounting and transaction records: orders, invoices, payment and delivery evidence, and necessary supporting correspondence may be preserved for the applicable statutory period. Indian books of account and relevant vouchers falling within section 128 of the Companies Act, 2013 are preserved for at least eight financial years, subject to longer lawful requirements. This is not a universal retention period for all user data or every separate Seller's records.

Security records: relevant ICT logs are retained for the period required by applicable cybersecurity rules, including a rolling 180 days within India where the CERT-In directions apply. Necessary incident or fraud evidence may be retained longer for a specific lawful investigation, legal hold or claim. Unrelated information is not kept indefinitely under a general security label.

Legal, warranty and technical records: necessary evidence may be retained for the applicable compliance, traceability, warranty or legal-claims period, with access and use restricted to that purpose. A live dispute, investigation or legal hold may require continued retention until it is resolved and applicable periods expire.

Backups: information already present in restricted disaster-recovery backups may remain until scheduled expiry or overwriting. It is not used for routine business activity. Where restoration is necessary, applicable deletion instructions are reapplied. The relevant backup-retention cycle can be explained in response to a request; a deletion confirmation will distinguish any remaining backup copies or other exceptions.

Retained transaction records may still identify an individual where necessary. Replacing a profile label with "Deleted User" does not necessarily anonymise an invoice, signature or attachment. Necessary records are restricted rather than inaccurately described as anonymous. Keeping a company's records is not permission to retain unnecessary personal information forever.

8. Account deletion

You can initiate deletion in the app through Settings > Delete Account and complete the confirmation and identity-verification steps. You can also email sales@lanexis.com with the subject "Account deletion request" without reinstalling or signing into the app. The public Account Deletion page explains the process.

We normally complete deletion of ordinary account data within 30 days of receiving a request, subject to reasonable identity verification and any different mandatory deadline or legally permitted extension. We will explain any permitted extension and confirm completion, including the categories and basis of any necessary retained records. Identity checks are not used to create an unnecessary obstacle or improperly restart a statutory deadline.

On account closure, login access is disabled and active sessions are revoked. Ordinary account information and other user-linked information are deleted or irreversibly anonymised except to the extent a lawful retention exception applies. We pass relevant deletion instructions to providers processing on our behalf and coordinate with the relevant Seller where needed.

Being the only user for your company, having an open order or having an outstanding invoice does not prevent submission and processing of a deletion request. Necessary company transaction records can remain separately. Deletion does not cancel an accepted order or release either party from an existing commercial obligation.

9. Rights, choices and requests

Subject to the law that applies to you, you may request information about processing, access or a copy of your information, correction, deletion, restriction or objection, portability, withdrawal of consent, or other rights provided by that law. Where applicable, you may use an authorised agent, appeal a decision or nominate another person to exercise rights as permitted by law. We do not discriminate for exercising a protected privacy right.

Send a request to sales@lanexis.com, identifying your registered email address, company and the action requested. We may take proportionate steps to verify identity and an agent's authority. Do not send your password or unnecessary identity documentation. If you no longer control your work email, tell us so that we can arrange an alternative verification method.

We aim to respond to ordinary privacy requests within 30 days, subject to applicable legal deadlines and permitted extensions. Privacy grievances are addressed promptly and within one month of receipt, or a shorter mandatory period where required. Where a request is limited or refused, we explain the reason to the extent lawful and any applicable review or complaint route.

Where information is handled by both the Portal Operator and a separate Seller, we coordinate the request and identify any part requiring that Seller's action. You are not required to submit duplicate requests solely because both hold relevant information. Each entity remains responsible for its own applicable legal duties.

10. Children and inappropriate information

The Service is intended only for authorised business representatives aged 18 or above. It is not directed to children. If you believe a minor has an account or personal information has been supplied inappropriately, contact us. We will review the information, restrict access where appropriate, and delete information not lawfully required.

11. Changes and applicable rights

We may update this Policy to reflect changes in the Service, practices or law. The last-updated date identifies the version. Material changes will be brought to users' attention through an appropriate notice, and fresh consent will be obtained where required. A policy update does not itself authorise an incompatible new use of information.

Contractual disputes concerning the Service are governed by the Terms and Conditions, which provide for Indian law and exclusive jurisdiction of courts of competent jurisdiction at New Delhi, India, subject to mandatory applicable law. Nothing in this Policy restricts a privacy regulator's powers, a mandatory complaint or appeal route, or a non-waivable right under applicable law. This Policy is not a waiver of those protections.

12. Privacy and grievance contact

For privacy requests, account deletion, corrections, grievances or questions about recipients and retention, contact the Portal Operator using the details below. Mark your communication "Privacy request" or "Privacy grievance" so that it is routed to the personnel responsible for handling it.

Attention: Privacy and Grievance Contact