Group Privacy Notice
Last updated: 6th July 2026
How to Use This Notice
This Group Privacy Notice applies to all entities operating under the Excelra brand. It is structured in two parts:
- Part A – Group-Wide Provisions: Applies to all users regardless of which Excelra entity you interact with. This covers the data we collect, how we use it, third-party sharing, cookies, retention, security, automated decision-making, and children’s provisions.
- Part B – Entity-Specific Provisions: Identifies the specific Excelra legal entity that acts as your data controller and sets out the jurisdiction-specific legal bases, your rights, applicable supervisory authority, and how to exercise those rights.
To identify which Part B section applies to you, refer to the Excelra entity you have contracted with, whose website you are visiting, or from whom you have received this Notice. If you are unsure, contact us at dpo@excelra.com.
Part A — Group-Wide Provisions
The provisions in Part A apply to all users of Excelra’s websites, products, and services, irrespective of which Excelra entity you interact with.
A1. Personal Data That We Process
Depending on your interaction with us, we may process the following categories of personal data:
- Identity and contact data: first name, last name, company name, mobile number, business email address, country, area of interest
- Identity document data: ID card number or passport number (where required)
- Location data: address and country of residence
- Usage and technical data: pages visited, prior website visited, time spent per page, operating system, web browser, network and IP information
- Any other information voluntarily provided by you that could directly or indirectly identify you
We do not intentionally collect special categories of personal data (sensitive personal data) unless specifically required and with your explicit consent.
Where the provision of certain personal data is necessary to enter into or perform a contract with you, or to respond to your enquiries, failure to provide such data may result in our inability to provide services or engage with you.
A2. Purposes of Processing and Legal Bases
We process personal data only for specified, explicit, and legitimate purposes. The specific legal basis applicable to each purpose varies by jurisdiction and is set out in full in the relevant Part B section. Across all entities, processing is carried out for the following purposes:
A2.1 Service Delivery and Improvement
- Deliver, update, and enhance the products and services we provide to you; improve and optimise functionality, fix issues, and upgrade performance.
A2.2 Security and Fraud Prevention
- Detect, prevent, and respond to fraud, abuse, errors, and security risks; diagnose problems and identify security vulnerabilities.
A2.3 Analytics and Operational Optimisation
- Understand how users interact with our services; generate usage statistics; collect aggregate data about use of products and services to optimise user experience and operations.
A2.4 Marketing and Communications
- Send product updates, promotional content, newsletters, and event invitations where you have given consent or where permitted on the basis of legitimate interests. You may opt out of marketing communications at any time by contacting dpo@excelra.com or using the unsubscribe link in any communication.
A2.5 Customer Support
- Respond to enquiries, provide technical assistance, and resolve issues.
A2.6 Legal and Compliance
- Comply with applicable legal and regulatory obligations; enforce our Terms of Use; protect rights, property, and safety.
A2.7 Business Operations
- Support internal audits, business reporting, planning, and record-keeping.
A2.8 Vital Interests
- Where necessary to protect your vital interests or those of another natural person (for example, in the case of a serious accident or medical emergency).
A2.9 Public Interest
- Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, to the extent applicable.
The specific GDPR Article 6 legal basis, DPDPA lawful ground, and CCPA/CPRA justification for each purpose are set out in the applicable Part B section.
A3. Automated Decision-Making and Profiling
Excelra uses personal data for automated decision-making, including profiling, for the following limited purposes:
- Improving and personalising your experience of our services
- Fraud detection and risk management
- Analytics and segmentation to better understand how our services are used
We comply with applicable data protection law — including GDPR Article 22, UK GDPR Article 22, and equivalent DPDPA provisions — in relation to all automated decision-making and profiling activities. Where any automated processing produces a decision that has a legal or similarly significant effect on you, we will:
- Inform you that such processing is taking place
- Explain the logic involved and the likely significance and consequences for you
- Provide you with the right to obtain human intervention, to express your point of view, and to contest the decision
- Seek your explicit consent or rely on another lawful basis as required by applicable law
You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. To exercise this right, contact dpo@excelra.com.
A4. How We Share Your Personal Data
We share personal data only as necessary and only with the following categories of recipients:
A4.1 Affiliated Group Entities
We may share personal data between Excelra group entities (Excelra India, Excelra Inc., Excelra BV, Excelra Belgium BV) for internal administrative, operational, and service delivery purposes. Where such intra-group transfers occur across jurisdictions, they are governed by intra-group data transfer agreements incorporating appropriate safeguards (including Standard Contractual Clauses where required).
A4.2 Third-Party Service Providers
We share data with trusted third-party service providers who process data on our behalf for the following purposes:
- Website analytics: Google Analytics, HubSpot, DealFront, and similar tools that collect usage and interaction data to help us improve our services
- Communications: email delivery, survey platforms, and customer relationship management tools
- Advertising: third-party ad networks using cookies, JavaScript, Google Ads, LinkedIn Ads, or web beacons to measure campaign effectiveness and personalise advertising. Note that Excelra does not have direct access to or control over third-party advertiser cookies
- IT infrastructure and security: hosting, cloud services, and security providers
All third-party processors are prohibited from using your personal data for any purpose other than those for which they are specifically engaged.
A4.3 Legal and Regulatory Disclosure
We may disclose personal data to government authorities, regulators, or law enforcement bodies where required or permitted by law, including in response to legal process (such as court orders or subpoenas), to protect our rights or property, to protect public safety, or to prevent illegal activity.
A5. International Data Transfers
Personal data processed by Excelra entities may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.
Where transfers of personal data from the EEA, the UK, or other jurisdictions with transfer restrictions are required, the relevant Excelra entity implements appropriate safeguards, which may include:
- Standard Contractual Clauses (SCCs) approved by the European Commission (for EU GDPR transfers)
- Adequacy decisions (EU) or Adequacy Regulations (UK) where the destination country has been recognised as providing equivalent protection
- Intra-group data transfer agreements incorporating the above safeguards for transfers between Excelra entities
- Specific derogations under Article 49 GDPR / UK GDPR where applicable (we do not routinely rely on derogations)
By using Our services and providing Your Personal Data, You consent to such transfers.
A6. Cookies and Tracking Technologies
We use the following categories of cookies and similar tracking technologies on our websites:
- Necessary: Required to enable basic website features such as secure log-in and consent preference management. These do not store personally identifiable data.
- Functional: Enable features such as sharing content on social media, collecting feedback, and other third-party functionality.
- Analytics: Collect information on how visitors interact with our website (e.g., number of visitors, bounce rate, traffic source) to help us improve our services.
- Advertisement: Provide personalised advertisements based on pages you have previously visited and measure ad campaign effectiveness.
We are responsible for obtaining consent for all cookies, including third-party cookies, where required by applicable law. You can manage or withdraw your cookie consent at any time by clicking the consent preferences icon at the bottom left of our website. For detailed information on our use of cookies, please see our Cookie Policy available on our website.
Where legally required, we will seek your consent before setting non-essential cookies. You may also manage cookie preferences through your browser settings or third-party tools.
A7. Retention of Personal Data
We retain personal data only for as long as is necessary for the purposes for which it was collected. To determine the appropriate retention period, we consider:
- The amount, nature, and sensitivity of the personal data
- The potential risk of harm from unauthorised use or disclosure
- The purposes for which we process the data and whether we can achieve those purposes by other means
- Applicable legal, regulatory, tax, accounting, or contractual requirements
Specific retention criteria include:
- Legal and contractual obligations: data is retained for the period required by law or contract
- Dispute resolution and legal claims: data is retained for as long as needed to preserve, resolve, defend, or enforce legal or contractual rights
- Business records: data is retained for the period required to maintain adequate financial and operational records
- Activity-based retention: certain records and logs are retained for a minimum of one (1) year from the date of processing, after which they are deleted unless otherwise required
Once personal data is no longer required, it will be securely deleted, anonymised, or de-identified in accordance with our internal data retention schedules.
A8. Security and Data Breaches
Each Excelra entity implements appropriate technical, physical, and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, the relevant Excelra entity will notify you and/or the relevant supervisory authority as required by applicable law. Such notification will include:
- The nature and extent of the breach
- The likely consequences of the breach
- Mitigation steps taken or proposed
- Contact details for further support
We will also report breaches to the Data Protection Board of India and CERT-In where required under the DPDPA, and to the relevant EU/UK supervisory authority where required under GDPR or UK GDPR.
A9. Special Provisions for Children and Minors
A9.1 General — All Jurisdictions
Our website and services are not directed at children under 18 years of age. We do not knowingly collect personal data from children without the verifiable consent of a parent or lawful guardian. If a data subject has a disability, consent must be provided by their lawful guardian. If we become aware that we have collected data from a child without required consent, we will delete it promptly.
A9.2 DPDPA — Children (India)
Under the DPDPA, processing of personal data of children requires verifiable parental consent. Excelra will implement appropriate mechanisms to verify that the consenting person is an adult before processing any personal data of a child.
A9.3 CCPA/CPRA — Minors Under 16 (California)
California-specific obligations for minors under 16 are addressed in full in Section B2.
Part B — Entity-Specific Provisions
Please read the section below that corresponds to the Excelra entity you interact with. Each section identifies the data controller, the applicable law, jurisdiction-specific legal bases, your rights, the relevant supervisory authority, and response timelines.
B1. Excelra Knowledge Solutions Private Limited — India — DPDPA 2023
B1.1 Controller Identity
- Legal Name: Excelra Knowledge Solutions Private Limited
- Registered Address: 7th Floor, Wing B, NSL SEZ Arena Town Centre, Plot No.6, Survey No.1, IDA Uppal, Hyderabad – 500039, India
- CIN: U72100TG2006PTC049287
- Phone: +91 40 6707-3333
- Applicable Law: Digital Personal Data Protection Act, 2023 (DPDPA) read with the DPDP Rules, 2025
- Data Protection Officer (DPO): dpo@excelra.com
This Privacy Notice applies to the processing of personal data of individuals (“Data Principals” / “you” / “your”) by Excelra Knowledge Solutions Private Limited (“we”, “us” or “our”) in connection with our website, products, services, and business operations.
This Privacy Notice is issued in compliance with Section 5 of the Digital Personal Data Protection Act, 2023 (the “Act”) read with Rule 3 of the DPDP Rules, 2025.
Personal Data that we process
Depending on the nature of your interaction with us, we may process the following personal data: your name, your company’s name, your mobile number, ID Card number / passport number, address, your business email address, your country and other data collected that could directly or indirectly identify you along with such other information provided by you on our website.
Purpose of Processing
Personal data is processed only for the following purposes:
- Deliver, update and enhance the product and services We provide to You
- Improve and optimize the operation and performance of Our product and services
- Diagnose problems with and identify any security risks, errors, or needed enhancements to the product and services
- Detect and prevent fraud and abuse of Our product, services, and systems
- Collecting aggregate statistics about use of the product and services and optimize our product and services
- Send relevant updates, promotional materials, and newsletters, ensuring that You are informed about Our latest offerings and developments
- Understand and analyze how You use Our product and services
Your Rights as a Data Principal
You have the following rights under the Act:
- Withdrawal of consent: you are entitled to withdraw your consent for the processing of your Personal Data
- Access to information: you are entitled to know more regarding our processing activities in respect of your Personal Data
- Correction and Erasure of Personal Data: you may request correction, completion, updating, or erasure of your Personal Data where it is inaccurate, incomplete, misleading, or no longer required
- Grievance Redressal: you are entitled to register a complaint with us regarding our use of your Personal Data or any unsatisfactory performance of our obligations towards you
- Right to Nominate: you are entitled to query or nominate someone to exercise your rights as a data principal
To exercise these rights, write to us at: dpo@excelra.com. We will respond within 90 (ninety) days.
Grievance Redressal and Complaints
- Contact our Data Protection Officer (DPO) at dpo@excelra.com
- If unresolved, complain to the Data Protection Board as and when the same is instituted
Security and Breaches
We implement reasonable security safeguards to protect your data. In case of a breach, we will notify you immediately with details (nature, extent, timing), potential consequences, mitigation steps, and contacts for support. Personal data is retained only for as long as necessary to fulfil the purposes stated above or as required under applicable law.
Special Notes for Children or Persons with Disabilities
If you are under 18 (a child), we require verifiable consent from your parent/guardian before processing. If you have a disability, consent must come from your lawful guardian.
Language Options
This Privacy Notice is available in English and all 22 languages specified in the Eighth Schedule to the Constitution of India. Access your preferred language by clicking the links below.
