How PG nex protects your personal data

PGNEX TECHNOLOGIES PRIVATE LIMITED (“PG nex”, “we”) runs a software platform that connects accommodation owners (“Hosts”) with students and working professionals (“Residents”). For the personal data you give us, we decide the purpose and means of processing, so we are the Data Fiduciary and you are the Data Principal.

We process personal data only on one of two grounds under Section 4 of the DPDP Act: your consent (Section 6), or a certain legitimate use (Section 7) — for example, complying with a law, a court order or a lawful police verification notice, or a medical emergency.

Laws that apply

• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.
• Information Technology Act, 2000 (electronic contracts and intermediary rules) and CERT-In Directions, 2022.
• Bharatiya Sakshya Adhiniyam, 2023 (electronic records as evidence).
• Applicable State tenancy law (in Maharashtra, the Maharashtra Rent Control Act, 1999), with the Model Tenancy Act, 2021 as a guiding framework.

Commencement of the DPDP Rules

Every data item below is tied to a specific purpose. We do not collect data we do not need, and we do not use it for a new purpose without asking you again.

Before we ask for your data, we show an itemised notice saying what we collect, why, how to withdraw consent, how to exercise your rights and how to complain. Your consent must be free, specific, informed, unconditional and unambiguous, given by a clear action such as ticking a box, and limited to what is necessary for the stated purpose.

• Optional choices stay optional. Marketing messages and showing your full name on public verification are separate checkboxes. Declining never blocks your booking.
• Withdraw any time, as easily as you gave it — use “Withdraw consent” above or email us. We then stop the related processing and tell our processors to stop too, unless a law requires us to keep the data.
• Withdrawal does not undo processing that was lawful before you withdrew. If a service cannot work without that data, we will tell you the consequence before you confirm.
• Consent may also be managed through a registered Consent Manager once that framework starts (Rule 4, from 13 Nov 2026).

• No raw number storage. We never store a 12-digit unmasked Aadhaar number in our database or caches.
• Masked display. Wherever Aadhaar appears (deeds, invoices, dashboards), only the last four digits are shown, for example XXXX-XXXX-9012.
• Protected upload. ID images are compressed in your browser and sent over an encrypted connection.
• Limited use. ID documents are used only for tenancy due diligence and verification the law requires — never for marketing or profiling.

Rent and deposit payments run through a licensed RBI-authorised payment aggregator (Cashfree Payments). Your card, net-banking or UPI credentials are entered on the aggregator’s secure page, not on our servers.

• We keep only references such as order ID, bank UTR and transaction status, to reconcile rent and deposits.
• We do not store card numbers, CVV, expiry dates or UPI PINs.
• Payment sessions use short-lived tokens that expire after use.

Printed agreements and receipts carry a QR code that holds only an opaque certificate ID and a signature — no name, phone number, address or payment detail:

How to verify a document

1. Scan the QR with your phone camera.
2. Check the address begins exactly with https://pgnex.online/ — if the domain is spelled differently, stop.
3. Match the certificate ID on the page with the one printed on the document.
4. Confirm the status says Valid. Full ledger details need a one-time code sent only to the registered resident or Host.

The verify page never asks for payment, passwords or ID numbers. By default your name is shown masked unless you opted in (see Section 03).

The Act treats anyone under 18 as a child. We do not process a child’s personal data until a parent or lawful guardian has given verifiable consent.

• Verification. We confirm the person giving consent is an identifiable adult who is the parent or lawful guardian, using a government-issued ID or a verified token, and we keep a record of how it was done.
• No harmful processing. We do not process a child’s data in any way likely to harm their well-being.
• No tracking or targeting. We do not track or behaviourally monitor children, and we do not show them targeted advertising.
• Guardians of persons with disabilities. Where a lawful guardian acts for an adult with a disability, we verify the guardian’s authority first (Rule 11).

A parent or guardian can use the same request form on the child’s behalf — choose “Parent / guardian” in the form.

We share personal data only when needed for the purposes above. Processors act on our written instructions and must protect the data; we stay responsible for it.

Transfers outside India are allowed by Section 16 except to countries the Central Government restricts. We do not send your data to restricted countries. You can ask for the specific list of recipients in your Access request.

We apply reasonable security safeguards: encryption in transit, access controls, activity logging and monitoring, backups, and written contracts requiring the same from our processors.

If a personal data breach happens

1. Contain. Stop the incident, secure systems and preserve evidence.
2. Tell you without delay. In plain language: what happened, when, what data, the likely effect on you, what we did, what you can do, and who to contact.
3. Tell the Board without delay. Initial intimation to the Data Protection Board of India.
4. Detailed report within 72 hours (unless the Board allows longer): cause, measures taken and remediation.

To report something suspicious, email grievance@pgnex.online.

When the purpose for which we collected your data ends, or you withdraw consent, we erase it and ask our processors to do the same — unless a law requires us to keep it. Where we schedule automatic erasure, we warn you beforehand.

How it works: we first confirm it is really you with a one-time code to the mobile number or email on your booking, then reply in writing. Requests are free. If you ask for something we cannot do (for example erase tax records), we explain why.

Please do not email Aadhaar numbers, card numbers or passwords. Putting a false or frivolous complaint on the record is a breach of a Data Principal’s duty under Section 15 and may attract a penalty.

The Act also gives Data Principals duties. Please:

• follow all laws while using PG nex;
• never impersonate another person or hide material facts, and give truthful, verifiable information;
• never file a false or frivolous grievance; and
• give authentic information when asking for correction or erasure.

Version history

If we make a material change, we will notify you before it applies and ask for fresh consent where the law requires.