1. Purpose
This Data Retention, Deletion & Your Data Rights Policy ("Policy") explains how NRI Investment Expo by NRI Nivesh ("NRI Investment Expo", "we", "us", "our" or "Platform") retains, uses, archives, anonymises and deletes personal data collected through our website, livestreams, event registration facilities, appointment-booking facilities, enquiry forms and related digital services.
This Policy should be read together with our:
- Privacy Policy;
- Terms & Conditions;
- Cookie Policy;
- Financial Services Disclaimer & Risk Disclosure;
- Livestream Terms;
- Cookie Preferences; and
- other applicable notices and policies.
Our objective is to retain personal data only for as long as reasonably necessary for the purposes for which it was collected, for legitimate operational purposes, or where retention is required or permitted by applicable law.
2. Our Approach to Data Retention
We do not intend to retain personal data indefinitely.
The period for which information is retained depends on factors including:
- the purpose for which it was collected;
- whether the information remains necessary for that purpose;
- whether the individual has requested deletion;
- whether the information is required for an ongoing relationship or enquiry;
- applicable legal, regulatory, tax or accounting requirements;
- contractual obligations;
- fraud prevention and security requirements;
- dispute resolution;
- legal proceedings or potential legal claims;
- regulatory investigations; and
- other legitimate and lawful purposes.
Where personal data is no longer reasonably required and there is no legal or other lawful reason to retain it, we may delete or irreversibly anonymise it.
3. Information We May Retain
Depending on how you interact with NRI Investment Expo, we may retain information such as:
Registration Information
- Name;
- email address;
- mobile number;
- country or location information voluntarily provided;
- event selected;
- registration date and time.
Enquiry and Appointment Information
- enquiry submitted;
- appointment request;
- selected exhibitor or service provider;
- appointment date and time;
- communications relating to the enquiry;
- status of the enquiry or appointment.
Communication Preferences
- email communication preferences;
- SMS preferences;
- WhatsApp communication preferences;
- telephone communication preferences;
- push-notification preferences;
- consent and withdrawal records.
Event Participation
Depending on the event and functionality used:
- event registration;
- attendance information;
- questions submitted;
- comments or chat interactions;
- polls and surveys;
- participation in audio/video sessions;
- recording-related information.
Technical and Security Information
Depending on the technologies deployed:
- IP address;
- browser information;
- device information;
- cookie identifiers;
- session information;
- security logs;
- fraud-prevention information;
- website activity and analytics information.
Compliance and Business Records
We may also retain:
- consent records;
- privacy requests;
- deletion requests;
- correction requests;
- grievance or complaint records;
- customer communications;
- security incidents;
- audit records; and
- records necessary to establish, exercise or defend legal rights.
4. Retention Periods
We determine retention periods based on the nature and purpose of the information rather than applying one universal period to all personal data.
The following are indicative retention practices, not guaranteed fixed deletion dates:
| Information | Indicative retention approach |
|---|---|
| Event registration information | While reasonably necessary for event administration, follow-up and legitimate business records |
| Appointment/enquiry information | While reasonably necessary to administer and document the enquiry or relationship |
| Marketing consent/preferences | Until withdrawn, subject to retention of a limited record demonstrating consent/withdrawal where reasonably necessary |
| Consent records | For as long as reasonably necessary to demonstrate and administer the relevant consent and comply with applicable law |
| Customer communications | For as long as reasonably necessary for the relevant purpose, dispute resolution or legal obligations |
| Security and fraud-prevention logs | For a period reasonably necessary for security, investigation, prevention and legal purposes |
| Analytics information | According to the applicable analytics configuration, purpose and provider settings |
| Cookie preferences | In accordance with our Cookie Policy and the relevant technology configuration |
| Complaints/grievances | For as long as reasonably necessary to investigate, resolve and document the matter and comply with applicable obligations |
| Deletion/privacy requests | For as long as reasonably necessary to demonstrate and administer the request and comply with applicable obligations |
| Financial/accounting records, if any | For the period required or permitted under applicable law |
Actual retention periods may vary depending on the circumstances.
5. Legal and Other Reasons for Retention
Even where you request deletion, we may retain certain information where necessary or legally required for purposes including:
- compliance with applicable law;
- regulatory requirements;
- tax and accounting obligations;
- responding to lawful governmental or regulatory requests;
- preventing fraud;
- investigating security incidents;
- establishing, exercising or defending legal claims;
- complying with court orders;
- resolving disputes;
- enforcing contractual rights;
- maintaining necessary business records;
- demonstrating compliance with legal requirements; or
- protecting the security and integrity of the Platform.
We will seek to limit retained information to what is reasonably necessary for the applicable purpose.
6. Your Right to Request Deletion
You may request deletion of personal data relating to you by submitting a request through the Delete My Data section below or by contacting our designated privacy contact.
Where applicable law provides a right to erasure or deletion, we will process the request in accordance with the applicable legal requirements.
A deletion request does not automatically mean that every record associated with an individual can or must be immediately deleted.
7. Withdrawal of Consent
Where our processing is based on your consent, you may withdraw that consent.
We will provide a method for withdrawing consent that is reasonably accessible and, where required by applicable law, comparable in ease to the method through which consent was provided.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Where processing is required or otherwise permitted under applicable law, withdrawal of consent may not require us to stop that particular processing.
8. Marketing Communications
You may opt out of marketing communications without requesting deletion of all personal data.
You may unsubscribe or withdraw marketing consent through available mechanisms, including where applicable:
- email unsubscribe links;
- WhatsApp opt-out mechanisms;
- SMS opt-out mechanisms;
- communication preference controls; or
- contacting us directly.
Withdrawal of marketing consent does not necessarily stop operational communications that are reasonably necessary, such as:
- appointment confirmations;
- event confirmations;
- service-related communications;
- security notifications;
- legal notices;
- privacy-related communications; or
- other non-marketing communications.
9. Lead Information Shared with Exhibitors
Where you voluntarily submit an enquiry, request an appointment or otherwise indicate interest in a particular exhibitor, sponsor or service provider, your information may be shared with the relevant recipient in accordance with our Privacy Policy and the applicable notice or consent.
Once information has been lawfully shared with a third party, that third party may independently process and retain the information in accordance with its own privacy policy and legal obligations.
A deletion request submitted to NRI Investment Expo does not automatically delete information that a third party independently and lawfully holds.
Where appropriate and legally required, we may take reasonable steps in relation to recipients of personal data.
10. Information That May Need to Be Retained
We may decline, delay or limit deletion of particular information where retention is reasonably necessary or legally required for:
- legal proceedings;
- pending or anticipated disputes;
- regulatory investigations;
- fraud investigations;
- cybersecurity investigations;
- tax or accounting requirements;
- enforcement of legal rights;
- compliance with lawful governmental directions;
- contractual obligations; or
- other purposes permitted or required by applicable law.
Where continued retention is required, we will seek to retain the information only for the period reasonably necessary for that purpose.
11. Anonymisation
Where appropriate, we may irreversibly anonymise information instead of deleting it.
Once information has been irreversibly anonymised so that it can no longer reasonably be associated with an identifiable individual, it may be used for purposes such as:
- statistical analysis;
- event analytics;
- reporting;
- business intelligence;
- service improvement;
- operational planning; and
- research.
Anonymised information is not treated as personal data where applicable law no longer considers it identifiable personal data.
12. Backups
When information is deleted from active systems, copies may temporarily remain in secure backup or disaster-recovery systems.
Backup systems may operate according to defined backup and overwrite cycles.
Where deleted information remains in a backup, it will not ordinarily be restored or actively processed except where reasonably necessary for:
- disaster recovery;
- business continuity;
- security;
- legal obligations; or
- other legitimate purposes.
When the relevant backup is overwritten in accordance with our backup procedures, the information will cease to exist in that backup.
13. Deletion from Our Systems
Where a verified deletion request is approved, we will take reasonable steps to identify and delete or anonymise eligible personal data from relevant active systems.
Depending on our technical architecture, deletion may involve:
- removing records from databases;
- deleting contact records;
- removing marketing identifiers;
- removing appointment information;
- deleting eligible CRM records;
- disabling future marketing communications;
- removing information from relevant internal systems; and
- anonymising information where deletion is impracticable or where anonymisation is appropriate.
Deletion may not necessarily occur simultaneously across every technical system.
14. Third-Party Service Providers
NRI Investment Expo may use third-party service providers for purposes such as:
- CRM;
- email;
- SMS;
- WhatsApp communications;
- analytics;
- website hosting;
- cloud storage;
- security;
- livestreaming;
- customer communications; and
- other Platform operations.
Where applicable, we may instruct relevant processors or service providers to cease processing or delete information in accordance with applicable law and our contractual arrangements.
15. Identity Verification
To protect against fraudulent deletion requests, we may take reasonable steps to verify the identity or authority of the person making a request.
We will seek to avoid collecting unnecessary information solely for verification.
If we cannot reasonably verify that a request relates to the relevant individual, we may request additional information or decline to process the request until sufficient verification is available.
16. Request Process
Once a deletion request is received, we may:
- acknowledge receipt;
- verify the requester's identity where reasonably necessary;
- identify relevant records;
- determine whether any information must or may lawfully be retained;
- delete or anonymise eligible information;
- restrict or cease relevant processing where required;
- document the outcome; and
- communicate the outcome to the requester where appropriate.
17. Deletion Requests and Legal Holds
Where information is subject to a legal hold, dispute, investigation, regulatory requirement or other legitimate retention requirement, deletion may be postponed until the relevant requirement has ended.
Where practical, information subject to such a requirement may be segregated or restricted from ordinary processing.
18. Security During the Data Lifecycle
We maintain reasonable technical and organisational measures intended to protect personal data against:
- unauthorised access;
- accidental loss;
- destruction;
- misuse;
- alteration;
- disclosure; and
- other unauthorised processing.
Security measures may include access controls, authentication, encryption where appropriate, logging, monitoring, backup controls and other safeguards appropriate to the nature of the information.
No method of electronic storage or transmission can be guaranteed to be completely secure.
19. Deletion Does Not Necessarily Remove Public Information
If you voluntarily publish information through a publicly visible feature, including a livestream chat, comment or other public interaction, deletion from NRI Investment Expo's systems may not remove:
- screenshots;
- recordings;
- copies made by other participants;
- third-party archives;
- information independently retained by third parties; or
- other copies outside our reasonable control.
We will address information within our control in accordance with applicable law and our policies.
20. Your Data Rights
Depending on applicable law and the circumstances of processing, you may have rights relating to your personal data, including rights concerning:
- access to information about processing;
- correction of inaccurate or incomplete information;
- withdrawal of consent where consent is the basis of processing;
- deletion/erasure where applicable;
- grievance redressal; and
- other rights provided under applicable law.
The precise scope, conditions and manner of exercising these rights may depend on applicable law.
21. Grievance Redressal
If you have a concern regarding our processing of your personal data, you may contact our designated privacy/grievance contact.
We will review and respond to grievances in accordance with applicable law and our internal procedures.
22. Data Retention After Deletion Request
Submitting a deletion request does not automatically erase all records immediately.
For example, we may retain a limited record of:
- the fact that a request was received;
- the date of the request;
- the outcome;
- the reason information was retained, where applicable; and
- information reasonably necessary to demonstrate compliance.
Such records will themselves be retained only for as long as reasonably necessary.
23. Changes to This Policy
We may update this Policy from time to time to reflect:
- changes in law;
- regulatory requirements;
- Platform functionality;
- technology;
- service providers;
- data-processing practices; or
- operational requirements.
The updated version will be published on the Platform with a revised "Last Updated" date.
24. Contact Details
- Business Name: NRI Nivesh Expo
- Trade Name: NRI Investment Expo
- Registered Office: Corporate Membership 118-3, 10th Floor, C Wing, Nesco Tower 4, Western Express Highway, Nesco IT Park, Goregaon East, Mumbai, Mumbai Suburb, Maharashtra – 400063, India
- Privacy / Data Rights Email: privacy@nriinvestmentexpo.com
- Grievance Contact: privacy@nriinvestmentexpo.com
Delete My Data
Request Deletion of Your Personal Data
If you would like to request deletion of personal data held by NRI Investment Expo, you may submit a request using the form below.
We will review your request and determine what information can be deleted, anonymised or retained in accordance with applicable law and our legitimate operational, legal and regulatory requirements.
Important: Submitting this request does not guarantee immediate or complete deletion of all information. Certain information may need to be retained where required or permitted by law, including for legal, regulatory, security, fraud-prevention, accounting, dispute-resolution or other legitimate purposes.