How Xpress ASSIST collects, uses and protects data, under India’s Digital Personal Data Protection Act, 2023.
Effective date: 26th Oct 2026
This policy explains what personal data Xpress Computers Ltd ("Xpress", "we", "us") handles when it provides Xpress ASSIST, and how we protect it.
Xpress Computers Ltd, 205, Woodrow, Veera Desai Road, Andheri West, Mumbai 400053, India. Phone +91 22 6612 2000. E-mail sales@xpress.co.in.
Xpress ASSIST is our managed IT support service for PCs, notebooks and servers. It is made up of:
This policy applies to the Silver, Gold, Gold+, Platinum and any later plan, and to the free health check.
We follow the Digital Personal Data Protection Act, 2023 (DPDP Act), the DPDP Rules, 2025 and the Information Technology Act, 2000 with its rules.
| Whose data | Who decides why it is used (Data Fiduciary) | Our role |
|---|---|---|
| Your staff and users of the computers we support | Your company, the customer | Data Processor: we act only on your company's instructions and our agreement with it |
| Your contacts who deal with us (portal users, account contacts, people who raise calls) | Xpress, for running the account; your company, for who it gives access to | Data Fiduciary for account and billing purposes |
| Visitors and enquirers on getxpressassist.com and health check sign-ups | Xpress | Data Fiduciary |
Because your company is the Data Fiduciary for its staff, your company is responsible for telling its staff that Xpress ASSIST is installed and for having a lawful reason to use it, such as its IT and security policy or employment terms. We give you a ready-made staff notice to help (see section 10).
We collect what we need to look after your computers, and no more. We do not read the contents of your files, documents, e-mails, chats or browsing.
| Part of the service | What we collect | When |
|---|---|---|
| Health agent (runs in the background) | Computer name, make, model, serial number, Windows version and updates, disk and memory, CPU, antivirus and firewall status, Defender alerts, printers, network and Wi-Fi details, local and public IP address, app crash counts, Windows event summaries, signed-in Windows user name, Microsoft 365 and Entra (Azure AD) join status, installed app version | Every few minutes while the computer is on |
| Remote support session | The screen, keyboard and mouse of the computer, only while the session runs; chat messages; session date, time, length, technician, and the technician's notes | Only after the user presses CONNECT TO XPRESS and allows the session |
| "System info" check | A one-time snapshot of the computer, network, Microsoft 365 and Entra details | Only during a session, by the technician |
| Customer portal | Name, work e-mail, role (Owner, Site manager, Viewer), password (stored scrambled, never in plain text), one-time sign-in codes, sign-in times, IP address, the calls and renewal requests you raise | When your users sign in and use the portal |
| Xpress Genie (AI helper) | The words the user types, Genie's replies, which fix was offered and whether the user said yes, the result | When a user opens Genie |
| Genie screenshots | A picture of one window that the user picks (at most 5 per request) | Only when the user presses the camera button and chooses the window |
| Self-healing | Which known problem was found, which fix ran and whether it worked | Automatically, if your company has switched self-healing on |
| Out-of-hours ticket | The problem description and contact details the user gives | When a user raises a ticket outside support hours |
| E-mail reports and alerts | The names and e-mail addresses your company asks us to send reports to | Daily, monthly and when an alert is raised |
| XPRESS ONE link | Customer name, contract and serial numbers, call numbers, call notes and time spent | When a session is logged as a call, or a portal call is raised |
| Free health check | Company name, contact name, e-mail, mobile, and the same health data as the agent for up to 7 days | During the trial |
| Website forms | Name, company, e-mail, mobile and message | When you send a form |
We do not collect sensitive data on purpose. If a user shows us something private on screen during a session, we do not copy or keep it. [Confirm: remote sessions are not video-recorded.]
We use the data only to provide and improve the support your company has bought:
We do not sell personal data, do not use it for advertising, and do not use your data to train AI models.
Genie suggests fixes using an AI model. Genie only runs a fix from a fixed, pre-approved list of 30 fixes, and only after the user presses "Yes, do it". Fixes that need administrator rights are run by the Xpress health agent. Genie never restarts a server and never deletes user files.
Self-healing runs a smaller list of safe fixes automatically, only if your company switches it on. It is never used on servers, and every fix is shown in the portal and reports.
The AI model runs on Microsoft Azure OpenAI Service under Xpress's own Azure subscription [confirm region]. Microsoft does not use this data to train its models. Our support technicians can also use AI to draft call notes and monthly report suggestions; a person at Xpress reviews them before they reach you.
Only with the service providers we need to run Xpress ASSIST, under contracts that require them to protect the data:
| Provider | What for | Where |
|---|---|---|
| Microsoft Azure | Servers that run Xpress ASSIST, the portal and XPRESS ONE | India (Central India region) |
| Microsoft Azure OpenAI Service | Xpress Genie and AI drafting | [Confirm region] |
| Microsoft 365 | Sending e-mails and reports | [Confirm region] |
We may also share data when the law requires it, for example with CERT-In or under a court order, or to protect people or our systems. If Xpress is merged or sold, this policy continues to apply.
Any data that leaves India goes only to countries the Government of India has not restricted under section 16 of the DPDP Act.
| Data | How long |
|---|---|
| Computer health data | While the computer is under a plan, then [90 days] |
| Remote session records and notes | Life of the contract plus [3 years] (also kept in XPRESS ONE as call history) |
| Genie chats and screenshots | [90 days] |
| Portal accounts | Until your company removes the user or the contract ends, then [30 days] |
| Security and sign-in logs | At least 180 days, as CERT-In requires |
| Free health check data | Collection stops after day 7; deleted [30 days] after the trial if you don't take a plan |
| Website enquiries | [2 years] from last contact |
| Invoices and contract records | As required by tax and company law (usually 8 years) |
When the contract ends we uninstall the agent or give you the steps, and delete or return your data within [30 days] if you ask, except what the law makes us keep.
If a personal data breach happens, we will tell your company without delay so it can inform the Data Protection Board and affected people, and we will report to CERT-In within 6 hours where required.
Under the DPDP Act you can ask to see a summary of your personal data, correct or update it, have it erased when it is no longer needed, nominate someone to act for you, and complain to us and then to the Data Protection Board of India.
We reply within [30 days] (or sooner if the DPDP Rules require).
[Name], Grievance Officer, Xpress Computers Ltd, 205, Woodrow, Veera Desai Road, Andheri West, Mumbai 400053. E-mail: sales@xpress.co.in. Phone: +91 22 6612 2000. Working days, 9:30 AM to 6 PM.
We recommend your company shares this short notice with its staff, for example on the intranet or in the IT policy:
Our company uses Xpress ASSIST from Xpress Computers Ltd to look after our computers. A small health program checks things like disk space, updates and antivirus, but does not read your files, e-mails or browsing. An Xpress technician can see or control your screen only after you press CONNECT TO XPRESS and allow it. Xpress Genie, an AI helper, may suggest and, with your OK, run simple fixes. Questions: [company IT contact].
Xpress ASSIST is a business service and is not meant for children. If a computer we support is used by a child (for example in a school), the customer must get verifiable parental consent where the DPDP Act requires it, and must tell us so we can switch off Genie and AI features on that computer.
The portal and getxpressassist.com use only the cookies needed to keep you signed in and secure. We do not use advertising cookies.
We will post any change here with a new effective date, and e-mail portal Owners about important changes at least 30 days before they apply.
sales@xpress.co.in · +91 22 6612 2000 · 205, Woodrow, Veera Desai Road, Andheri West, Mumbai 400053, India.
