1. Who we are and what this policy covers
Version Next Technologies Pvt. Ltd. ("Version Next", "we", "us") runs vtapanel.com and makes the VTA Panel hosting control panel software. We are the Data Fiduciary for the personal data described here.
- Registered office: 607/608, Pranik Chamber, Saki Vihar Road, Sakinaka Metro, Andheri East, Mumbai 400072, Maharashtra, India
- CIN: U72200MH2008PTC182529 · PAN: AACCV7580M · GSTIN: 27AACCV7580M1ZN
- Privacy contact: privacy@vtapanel.com
This policy covers personal data we process when you visit vtapanel.com, create an account, buy or activate a VTA Panel licence, use the client area, contact support, or receive our emails. It does not cover websites or services that you or your customers run using VTA Panel on your own servers.
We process personal data under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP law"), the Information Technology Act, 2000 and its rules, and the Consumer Protection (E-Commerce) Rules, 2020.
This notice is separate from our End-User License Agreement. By submitting your details and ticking the consent box at sign-up or checkout, you consent to the processing described below. You can withdraw consent at any time (Section 9).
2. Personal data we collect
We collect only what we need to sell, license and support VTA Panel.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, mobile number, password (stored only as a one-way hash), company name | You, at sign-up |
| Billing | Billing name and address, state (for GST place of supply), GSTIN if you give one, order and invoice history, coupon codes used | You, at checkout |
| Payment | Payment status, transaction ID, payment method type, last four digits of a card or UPI handle, as returned by our payment gateway | Our payment gateway |
| Licence and activation | Licence key, server IP address, hostname, operating system and version, VTA Panel version, activation and last check-in time | The VTA Panel software on your server, when it activates or checks its licence |
| Support | Messages, attachments, call notes, and any server access details you choose to share with us for troubleshooting | You |
| Website use | IP address, browser and device type, pages visited, referring page, cookie identifiers, approximate location derived from IP | Your browser, through cookies and server logs |
| Communications | Your email preferences and whether you opened our emails | You and our email service |
We do not collect sensitive information such as health, biometric, religious or caste data, and we ask you not to send it to us.
3. Data we do not collect
Your servers' content stays with you. VTA Panel runs on servers that you own or rent. Websites, databases, mailboxes, files, DNS records and backups that you or your customers create in VTA Panel stay on those servers and on storage you choose. The software does not send that content to us.
For that content, you (or your customer) are the Data Fiduciary, not us. If you host websites for others, you are responsible for their personal data under the DPDP law and the IT Act.
We see such content only if you send it to us yourself, for example in a support ticket or by giving us access to your server. Then we use it only to resolve that request (Section 4).
We never see your full card details. Card numbers, CVV, UPI PINs and net-banking passwords are entered on our payment gateway's secure page and are handled by the gateway under Reserve Bank of India rules. We do not receive or store them.
4. Why we use your data
We use personal data only for the purposes below. Under the DPDP law we rely on your consent, or on a legitimate use the law allows without consent (for example, when you give us data voluntarily for a purpose, or when a law requires us to keep it).
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account, and let you sign in | Account | Consent |
| Take orders, collect payment, apply coupons and issue GST invoices | Account, billing, payment | Consent; legal obligation (GST, accounting) |
| Issue, activate and verify licences, and stop licence misuse | Licence and activation | Consent; performance of the licence you bought |
| Deliver updates and security notices about VTA Panel | Account, licence | Consent |
| Answer support requests | Account, support, licence | Voluntarily provided for that purpose |
| Keep vtapanel.com secure, detect fraud, and keep logs | Website use, licence | Legal obligation; reasonable security safeguards |
| Send offers and newsletters | Account, communications | Consent, which you can withdraw at any time |
| Respond to courts, regulators and law enforcement | Any, as required | Legal obligation |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it.
5. Payments
- Gateway: payments on vtapanel.com are processed by [Payment gateway name, e.g. Razorpay / Cashfree / PayU], a payment aggregator authorised by the Reserve Bank of India. You pay on the gateway's secure page, under the gateway's own privacy policy.
- What we receive: payment status, transaction ID, amount, method type and masked card or UPI details. We never receive full card numbers, CVV or PINs.
- Saved cards and auto-renewal: if you choose to save a card or set up auto-renewal, the card is stored by the gateway as a token under RBI tokenisation rules, never by us. You can cancel auto-renewal at any time in your client area.
- Invoices and tax: we keep invoices and transaction records for the period that GST and income-tax law require (Section 7).
- Refunds: refunds go back to the original payment method through the gateway, as set out in our Refund Policy.
6. Who we share it with
We share personal data only with the people below, and only what each needs.
- Data Processors working for us, under written contracts that require them to protect the data and use it only on our instructions:
- Payment gateway: [name]
- Hosting of vtapanel.com and the licence server: [provider, e.g. AWS Mumbai region]
- Email delivery: [provider]
- Support desk or chat: [provider]
- Analytics: [provider, or "none"]
- Professional advisers such as chartered accountants, auditors and lawyers, under confidentiality duties.
- Government and law enforcement when Indian law requires it, including the GST and income-tax departments, CERT-In, courts and the Data Protection Board of India.
- A buyer or successor if Version Next is merged, acquired or sells its business, who must keep this policy's protections.
We do not sell, rent or trade your personal data, and we do not let third parties use it for their own advertising.
7. Where we store it and for how long
Location. We store personal data in India where we can. Some processors (for example email delivery) may process it outside India. We transfer data outside India only to countries the Government of India has not restricted under the DPDP law, and with safeguards in our contracts.
Retention. We keep data only as long as the purpose needs it or a law requires it, then delete or anonymise it.
| Data | How long we keep it |
|---|---|
| Account and licence records | While your account or any licence is active, then 1 year |
| Invoices, payment and GST records | 8 years from the end of the financial year, as company and tax law require |
| Support tickets | 3 years after the ticket closes |
| Security, access and licence-check logs | At least 1 year, as the DPDP Rules require; longer only where another law requires |
| Marketing preferences | Until you unsubscribe or withdraw consent |
| Website analytics | [14 months] |
If you close your account, we delete what we no longer need within [30] days, except records we must keep by law.
8. How we protect it, and what we do after a breach
We use reasonable security safeguards, including:
- encryption of data in transit (HTTPS/TLS) and of sensitive data at rest;
- passwords stored only as salted one-way hashes, and two-factor sign-in for accounts;
- access limited to staff who need it, with access logs;
- monitoring and logging to detect unauthorised access, with logs kept for at least one year;
- backups and recovery plans so data stays available and intact;
- contracts that bind our processors to the same standards.
No system is completely secure. Keep your password and licence keys private, and tell us at once at security@vtapanel.com if you suspect misuse.
If a personal data breach happens, we will tell affected users without delay, by email or in the client area, explaining what happened, the likely impact, what we have done and what you can do. We will also report it to the Data Protection Board of India and to CERT-In within the times Indian law sets.
9. Your rights
Under the DPDP law you have the right to:
- Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction and update: have inaccurate or incomplete data corrected or completed.
- Erasure: have data deleted when it is no longer needed, unless a law requires us to keep it.
- Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing already done. If you withdraw consent needed to run your licence or account, we may not be able to keep providing it.
- Nominate: name a person to exercise your rights if you die or become unable to act.
- Grievance redressal: complain to us, and then, if unresolved, to the Data Protection Board of India.
How to use them: email privacy@vtapanel.com from your registered email, or use Account → Privacy in the client area. We may ask you to verify your identity. We will respond within 90 days at the latest, and usually much sooner.
To unsubscribe from marketing emails, use the link in any email; service and billing emails will continue while you have an account.
10. Cookies, children, changes and contact
Cookies. We use essential cookies to keep you signed in and secure checkout. With your consent through our cookie banner, we also use analytics cookies to understand how the site is used. You can change your choice at any time from the cookie settings link in the footer, or block cookies in your browser; some features may then not work.
Children. VTA Panel is a business product for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.
Changes. We may update this policy. We will post the new version here with its effective date and, for significant changes, email you or ask for fresh consent where the law requires.
Grievance Officer. Under the DPDP law, the IT Act and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:
- Name: Sumeet Rathod
- Address: Version Next Technologies Pvt. Ltd., 607/608, Pranik Chamber, Saki Vihar Road, Sakinaka Metro, Andheri East, Mumbai 400072, India
- How to reach: raise a ticket in the client area at vtapanel.com, or write to privacy@vtapanel.com
We acknowledge complaints within 48 hours and give you a ticket number. We aim to resolve them within one month, and in any case within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Effective date: [04 November 2026]