Digital Personal Data Protection Statement
Last updated: June 2026
This statement describes how Norexis complies with the Digital Personal Data Protection Act 2023 (DPDP Act), including the rights of data principals (our users), the obligations we have as a data fiduciary, our consent framework, and how you can raise a grievance.
1. Rights of data principals
As a data principal (a person whose personal data is processed by Norexis), you have the following rights under the DPDP Act 2023:
Right to access information
You have the right to obtain a summary of your personal data that Norexis holds, and information about the processing activities undertaken with that data.
Right to correction and erasure
You have the right to request correction of inaccurate or incomplete personal data and to request erasure of personal data that is no longer necessary for the purpose for which it was collected.
Right to grievance redressal
You have the right to have your grievances addressed by Norexis. If you are not satisfied with our response, you have the right to approach the Data Protection Board of India.
Right to nominate
You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.
2. Our obligations as data fiduciary
Norexis, as a data fiduciary under the DPDP Act 2023, has the following obligations:
- Process personal data only for the specific, lawful purpose for which consent was given
- Collect only the minimum personal data necessary for the stated purpose
- Ensure the completeness, accuracy and consistency of personal data
- Implement appropriate technical and organisational measures to secure personal data
- Notify users in the event of a personal data breach that may affect them
- Erase personal data when the purpose is fulfilled or consent is withdrawn
- Respond to data principal requests within the timelines prescribed by the Act
- Appoint a Grievance Officer to handle complaints
3. Consent framework
Norexis processes personal data based on your free, specific, informed and unambiguous consent, as required by the DPDP Act 2023.
How we obtain consent
When you create a Norexis account, you are presented with a clear description of what personal data will be collected and for what purpose. You provide consent by completing the account creation process.
What you consent to
You consent to us collecting and processing your name, contact details and energy asset information for the purpose of providing the Norexis energy management service.
Withdrawing consent
You may withdraw consent at any time by contacting us at privacy@norexis.ai or by deleting your account. Withdrawal of consent will result in cessation of the service.
Children's data
Norexis does not knowingly collect personal data from persons under 18 years of age. If we become aware that a child has provided personal data without verifiable parental consent, we will delete that data promptly.
4. Grievance mechanism
If you believe Norexis has not complied with the DPDP Act 2023 or this statement, you may lodge a formal grievance.
Grievance Officer
Norexis
grievance@norexis.aiAcknowledgement: Within 3 working days of receiving your grievance.
Resolution: Within 30 days of receiving your grievance.
If you are not satisfied with our response, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.
5. Contact details
Privacy queries
privacy@norexis.aiFormal grievances
grievance@norexis.ai