Who is responsible for your data
Paxika Private Limited, a company incorporated in India (CIN U70200HR2024PTC122437) with its registered office at D-26, Jadunath Enclave, Sector 29, Faridabad, Haryana, India, is the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023 and the “controller” under the GDPR and UK GDPR, for the personal data described in this policy. We are referred to as “Paxika”, “we” and “us”.
You can reach us about anything in this policy at connect@paxika.com. Our Grievance Officer and contact for privacy matters is Mrinal Sethi, at the same address.
Who this applies to
This policy applies to visitors to paxika.com, people who join our early-access list, members who create an account or profile, and people who write to us or apply to work with us. Paxika is operated from India and is currently built for use in India. If you use it from elsewhere, your data is handled in India and the other places listed below.
What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact and account details | Name, email address, mobile number and the country it is from (we ask you to verify it), password (held by our sign-in provider, not by us), membership ID, reserved address | You |
| What brings you here | Your answers to what brings you to Paxika, for example that you are looking for a property or offering services, and how far you have got in joining | You |
| One-time codes | The six-digit code we email you to confirm your address. We keep only a scrambled form of it, for ten minutes and a short while after | Our systems |
| Profile information | What you do, your city and state, what you are open to, your About, services, photo and experience | You |
| Records of your choices | That you accepted the Terms and confirmed you are 18 or over, with the date; your visibility settings; your requests to us | You, and our systems |
| Messages and applications | What you send through the contact form, your email, or a careers application, including any file or link you include | You |
| Early-access list | Your email address and the date you joined, added once you have confirmed the address with a code | You |
| Visits to our public pages (only if you accept analytics) | Which public page, roughly where from (country or city), device and browser type, and a random cookie identifier. Not your name, email or anything you type | Your device, through Google Analytics |
| Technical and security data | IP address, browser and device type, pages requested, timestamps, error reports, abuse and bot-detection signals, and the result of our checks that a request comes from a person | Your device, and our systems |
| Email delivery data | Whether an email we sent was delivered, delayed or bounced, or marked as spam | Our email provider |
We do not ask for, and ask you not to send us, sensitive information such as health, religion, caste, sexual orientation, government identity numbers or financial account details. We do not currently take payments, and do not collect card or bank details. We do not use advertising cookies, tracking pixels or third-party advertising networks.
If you accept analytics on our cookie bar, we use Google Analytics to count visits to our public pages (which pages, roughly where from, on what kind of device) so we can see what is useful. It is off until you accept, it never runs on pages where you are signed in or joining, and we do not use it for advertising or to build a profile of you. You can change your mind at any time from Cookie settings in the footer.
Why we use your data, and our legal basis
| Purpose | Data used | Basis (India: DPDP Act; Europe and the UK: GDPR) |
|---|---|---|
| Create and run your account and profile, including your membership ID and reserved address | Contact, account and profile data | Your consent; and what is necessary to provide the service you asked for |
| Verify your email address and mobile number with one-time codes, and keep the Services secure and free of abuse | Contact data, one-time codes, technical and security data | Legitimate uses (preventing fraud and abuse, security); legitimate interests |
| Send you essential messages about your account, and launch and membership updates you asked for | Contact data, email delivery data | Your consent; legitimate interests in running the service |
| Ask what brings you to Paxika, so we can ask the right questions and say what you are open to on your profile | What brings you here, profile data | Your consent |
| Show a complete profile to others when Paxika opens, in line with your settings | Profile data | Your consent, which you can withdraw by hiding or deleting your profile |
| Answer your messages and consider applications | Messages and applications | Your request; legitimate interests; steps before a contract |
| Count and understand visits to our public pages, if you accept analytics | Visits to our public pages | Your consent, which you can withdraw in Cookie settings |
| Improve and protect the Services, and keep records we are required to keep | Technical and security data, records of your choices | Legitimate interests; compliance with legal obligations |
| Respond to legal process and protect our rights | Any of the above as needed | Compliance with law; legitimate interests |
Where we rely on your consent you may withdraw it at any time, which will not affect what we did before. Withdrawing consent to the use of data we need to run your account may mean we can no longer provide it.
Who handles your data on our behalf, and who we share it with
We use a small number of providers to run Paxika. They act on our instructions and under their own security and confidentiality terms. We do not sell your personal data, and we do not share it for advertising.
| Provider | What it does for us | Where |
|---|---|---|
| Google (Google Cloud and Firebase) | Sign-in and password security, text-message verification of mobile numbers (we send texts only to numbers in the countries we support), our database and file storage, and hosting | Database and files in Delhi, India; hosting in Singapore |
| Google Analytics | Counts visits to our public pages, only if you accept | Google's global network |
| Google reCAPTCHA Enterprise | Checks that a sign-up or form submission comes from a person, not a bot | Google's global network |
| Resend (using Amazon Web Services) | Delivers the emails we send you | Tokyo, Japan |
| Squarespace | Registers our domain name and runs its address records (it does not receive your personal data) | Global |
We may also disclose personal data where the law requires it or a court or government authority lawfully asks for it, to protect the rights, property or safety of Paxika, its members or others, or to a buyer or successor if the business is sold or reorganised, in which case this policy will continue to apply to your data until you are told of any change. If you choose to join our WhatsApp community or follow our social media accounts, those platforms handle what you share with them under their own terms and privacy notices, not ours.
Where your data is processed
Your data is stored in India and handled by the providers above in India, Singapore, Japan and, for some of Google's global services, other countries. Where personal data leaves your country we rely on the safeguards the law allows, including contractual protections with our providers, and we transfer it only to places the Government of India has not restricted. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside those regions, with appropriate safeguards such as standard contractual clauses where required.
How long we keep it
| Data | How long |
|---|---|
| Account, membership and profile | While you hold an account, and removed when you delete it |
| Early-access list entry | Until you ask us to remove it, or for as long as it is needed to write to you about Paxika opening and your membership |
| One-time email codes | Valid for ten minutes, and removed within a day after that |
| Analytics data (if you accept) | Fourteen months, then deleted by Google Analytics |
| Copies of emails we sent you | Ninety days |
| Messages sent through the contact form and careers applications | Up to twelve months after we last dealt with them, unless a longer period is needed to deal with a claim or the law requires it |
| Security, rate-limit and error records | Up to thirty days, unless needed to investigate abuse or an incident |
| Backups | Deleted data can remain in routine backups for up to thirty-five days, after which it is overwritten |
| Records we must keep by law, and our record that a deletion request was made and handled | For as long as the law requires |
Your rights
Subject to the law that applies to you, you have the right to:
- know what personal data we hold about you, and to obtain a copy of it;
- have inaccurate or incomplete data corrected, completed or updated;
- have your data erased, where we no longer need it for the purpose or you withdraw your consent;
- withdraw your consent at any time;
- object to or ask us to restrict certain uses, and (in Europe and the UK) to receive your data in a portable format;
- nominate another person to exercise your rights if you die or become incapacitated (India);
- make a complaint, as explained below.
You can ask for a copy of your data or for deletion from your account page, or by writing to connect@paxika.com. We may need to confirm that the request really comes from you. We respond within thirty days. If you own a business on Paxika, or have things on Paxika that other people can see, we may need to talk to you before we delete them, and we will say why.
We do not sell your personal data or share it for cross-context advertising, which means there is nothing to opt out of; residents of California and other places with similar laws have the rights above to know, delete and correct, and we will not treat you differently for exercising them.
Children
Paxika is for adults. You must be 18 or over to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
Security
We protect personal data with reasonable safeguards, including encryption in transit, access controls limited to people who need them, separation of sensitive data, monitoring and alerts, and tested backups. No system is perfectly secure. If a personal data breach occurs we will respond promptly and, where the law requires, tell the Data Protection Board of India or the relevant authority and the people affected.
Cookies and similar technologies
We use the cookies and browser storage that the Services need to work and to stay secure, and, only if you accept, Google Analytics. We do not use advertising cookies. The details are in our Cookie Policy.
Marketing and other messages
If you leave your email on our early-access list, we will write to you when Paxika opens and, if you continue to membership, about your membership. If you start joining and do not finish, we send you one reminder about three days later. We do not send promotional email unless you have asked for it, and every non-essential message tells you how to stop receiving it.
Automated decisions
We use automated checks to detect bots and abuse when you sign up or submit a form. A request that looks automated may be turned away, and you can try again or write to us. We do not make decisions about you that have legal or similarly significant effects by purely automated means.
Changes to this policy
We will update this policy when how we handle personal data changes or the law requires. We will post the new version here with its date, and for a material change we will tell you, usually by email, before it takes effect.
Questions and complaints
If you have a question or a complaint about your personal data, write to Mrinal Sethi, Grievance Officer, at connect@paxika.com, or D-26, Jadunath Enclave, Sector 29, Faridabad, Haryana, India. We will acknowledge it within twenty-four hours and aim to resolve it within fifteen days, as set out in our Grievance Redressal Policy.
If you are not satisfied, you may complain to the Data Protection Board of India once its complaint process is available to you, or, if you are in the European Economic Area or the United Kingdom, to the data protection authority of your country, such as the Information Commissioner's Office in the United Kingdom.