Privacy Policy

1 Scope and applicability

1.1This Privacy Policy ("Policy") governs the collection, storage, processing, use, disclosure, retention and erasure of personal data by Tirth Enterprise, a proprietary concern having its place of business at Amin Marg, Rajkot – 360001, Gujarat, India ("Tirth Enterprise", "we", "us" or "our"), in connection with the website testationery.in and every service, account, communication and transaction offered through it (collectively, the "Platform").

1.2This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), each as amended from time to time, and constitutes an electronic record generated by a computer system that does not require any physical or digital signature.

1.3The Platform is a business-to-business facility made available exclusively to registered commercial establishments purchasing goods for resale. It is not directed at, nor intended for the use of, consumers or individuals below eighteen (18) years of age.

1.4By accessing the Platform, registering an account, or transacting with us, you acknowledge that you have read and understood this Policy. Where processing is founded on consent, that consent is obtained separately, is specific and informed, and may be withdrawn in the manner set out in Clause 11.

2 Definitions

In this Policy, unless the context requires otherwise:

• "Data Fiduciary" means the person who alone or in conjunction with others determines the purpose and means of processing personal data, being Tirth Enterprise for the purposes of this Policy.
• "Data Principal" means the individual to whom the personal data relates, including the proprietor, partner, director or authorised representative of a registered buyer.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
• "Sensitive Personal Data or Information" bears the meaning given to it in Rule 3 of the SPDI Rules.

3 Identity of the Data Fiduciary and contact particulars

3.1Tirth Enterprise is the Data Fiduciary in respect of all personal data described in this Policy. Our GSTIN is 24BILPM3469B1ZB.

3.2Correspondence in relation to this Policy may be addressed to contact@testationery.in or to +91 63531 35986, or sent in writing to the address stated in Clause 1.1.

3.3The particulars of the Grievance Officer appointed under Clause 13 are set out in that clause.

4 Categories of personal data collected

4.1Data furnished at registration. Business or shop name; the name of the contact person; mobile number; electronic mail address (optional); Goods and Services Tax Identification Number (optional); postal code, and the city and State derived from it; the nature of the business; and a photograph or scanned image of the visiting card of the establishment, which is required in order to verify that the applicant is a genuine trade buyer.

4.2Data generated in the course of transacting. Products and quantities selected; order, invoice and dispatch records; the delivery postal code and the city and State derived from it; instructions or notes furnished by you; payment status and any payment reference voluntarily supplied by you; and correspondence exchanged with us.

4.3Data collected automatically. Web-server records generated in the ordinary course, comprising the Internet Protocol address, the user-agent string, the resource requested, the response status and the time of the request, retained for security, diagnostic and audit purposes; and the aggregate measurement described in Clause 7.

4.4Data we do not collect. We do not collect financial account details, card numbers, banking credentials, passwords to any third-party service, government identification numbers other than the GSTIN referred to in Clause 4.1, biometric data, health data, or any other category of sensitive personal data or information save as expressly stated in this Policy. Payments, where made electronically, are effected outside the Platform and no payment instrument details reach our systems.

5 Purposes of processing and the lawful basis relied upon

5.1Personal data is processed only for the following purposes, and for no other purpose incompatible with them:

• verifying that an applicant is a bona fide trade buyer, and deciding whether to open, continue or suspend a wholesale account;
• displaying prices applicable to an approved buyer and operating the ordering facility;
• confirming, packing, invoicing and dispatching orders, including furnishing the particulars a transport operator requires in order to accept a consignment;
• issuing tax invoices and maintaining the books, records and returns required under the Central Goods and Services Tax Act, 2017, the Income-tax Act, 1961 and other applicable fiscal legislation;
• communicating with you regarding your account, your orders and any related service matter;
• maintaining the security and integrity of the Platform, preventing fraud and abuse, and establishing, exercising or defending legal claims; and
• compiling anonymous, aggregate statistics regarding use of the Platform.

5.2The processing described in Clause 5.1 is undertaken on the basis of the consent obtained at the point of collection, and, where applicable, on the basis of the legitimate uses recognised under Section 7 of the DPDP Act, including the performance of obligations you have voluntarily entered into with us and compliance with law.

5.3We do not undertake any automated decision-making producing legal effects concerning you, nor any profiling for advertising, credit assessment or similar purposes.

6 Cookies and similar technologies

6.1The Platform sets a session cookie, which is strictly necessary in order to maintain a signed-in session and to protect forms against cross-site request forgery. This cookie is not used for measurement or advertising.

6.2Where you elect the "keep me signed in" facility, a second cookie is set, containing a random token which is stored on our systems only in irreversibly hashed form. That cookie is used solely to re-establish your session, expires automatically, and is destroyed when you sign out, when your password is changed, or when you request that the device be de-registered.

6.3No advertising, retargeting, social-media or third-party analytics cookie is set by the Platform, and no third-party script is loaded for any such purpose.

7 Measurement of website traffic

7.1We measure the number of visits, the pages requested, the referring source and terms entered into our search facility. This measurement is performed by software operated by us, on the server on which the Platform is hosted. No data is transmitted to any analytics, advertising or social-media provider.

7.2No persistent identifier is stored. In order to avoid counting the same visitor repeatedly within a day, the Internet Protocol address and user-agent string are combined with a secret value and reduced, by a one-way cryptographic function, to a short code. The secret value is discarded and regenerated every night, with the consequence that the code cannot be reversed and the same device produces an unrelated code on the following day. No cookie is employed for this purpose and nothing is written to your device.

7.3Records at the level of an individual request are erased after 90 days. Only aggregate daily counts, from which no individual can be identified, are retained thereafter.

8 Disclosure of personal data

8.1We disclose personal data only to the following categories of recipient, and only to the extent necessary for the purpose stated:

• Transport operators and carriers — the consignee name, business name, contact number and destination particulars required for a consignment to be booked and collected;
• Our hosting provider — as the operator of the server infrastructure on which the Platform and its database reside;
• Our email service provider — as the operator of the mail infrastructure through which notifications regarding your account and your orders are transmitted to the address you have given us, comprising the addressee particulars and the contents of the notification itself;
• Professional advisers — our chartered accountant and legal advisers, under obligations of confidentiality; and
• Governmental and statutory authorities — where disclosure is required by law, by an order of a court or tribunal of competent jurisdiction, or by any authority lawfully empowered to require it.

8.2We do not sell, rent, licence, trade or otherwise make available personal data to any person for consideration, and we do not disclose personal data for the marketing purposes of any third party.

8.3Any processor engaged by us is engaged under a written arrangement restricting the processing to our documented instructions and requiring security measures no less protective than those described in Clause 10.

9 Storage location and cross-border transfer

9.1Personal data collected through the Platform is stored on servers located in India.

9.2We do not transfer personal data outside India for processing. Should that position change, any such transfer will be made only to a territory not restricted by the Central Government under Section 16 of the DPDP Act, and this Policy will be amended before any such transfer takes place.

10 Security safeguards

10.1We implement reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, commensurate with the nature of the information held.

10.2Without limiting the generality of Clause 10.1:

• the Platform is served exclusively over an encrypted (HTTPS) connection;
• visiting-card images and uploaded invoices and transport receipts are encrypted at rest using the AES-256-GCM authenticated-encryption algorithm and are stored outside the publicly served directory, being released only through a route which verifies that the requester is the person entitled to the document;
• passwords are never stored in a recoverable form and are held only as salted one-way hashes;
• administrative functions are restricted to authenticated administrators, and purchase-cost information is never exposed to a buyer; and
• every state-changing action performed on an order is written to an immutable audit journal.

10.3No method of transmission or storage is completely secure. While we take the measures described above, we cannot and do not guarantee absolute security, and you acknowledge that you provide information at your own risk to that extent.

10.4In the event of a personal data breach, we shall give intimation to the Data Protection Board of India and to each affected Data Principal in the form and manner, and within the time, prescribed under the DPDP Act.

11 Consent and its withdrawal

11.1Where processing is founded on consent, that consent is obtained by a clear affirmative act at the point of collection, and is specific to the purposes stated in Clause 5.

11.2You may withdraw your consent at any time by writing to contact@testationery.in. The withdrawal of consent operates prospectively and does not affect the lawfulness of processing carried out before the withdrawal.

11.2AIn respect of notifications sent to you by email, withdrawal requires no correspondence and no request to us. You may discontinue them at any time, with immediate effect, either from the settings within your account or by following the link provided in the footer of every such message, which requires no sign-in. Discontinuance affects those messages alone: the same information remains available to you within your account, and we may continue to contact you where it is necessary in order to perform an obligation you have entered into with us.

11.3Where consent is withdrawn, we shall cease processing within a reasonable period, save to the extent that continued retention is required in order to comply with a legal obligation, as described in Clause 12.

11.4You acknowledge that the withdrawal of consent to processing which is necessary for the operation of a trade account will result in that account being closed.

12 Retention and erasure

12.1Personal data is retained only for so long as is necessary for the purpose for which it was collected, or for such longer period as is required by law.

• Accounts and correspondence — for the duration of the trading relationship, and thereafter until erasure is requested;
• Visiting-card images — until the account is closed, or earlier upon request once verification is complete;
• Order, invoice and dispatch records — for the period prescribed under the Central Goods and Services Tax Act, 2017 and the Income-tax Act, 1961, which we treat as eight (8) years from the end of the relevant financial year;
• Records of notifications sent to you by email — the addressee particulars and the contents of each such message are retained for ninety (90) days from the date of sending, and are then erased automatically; the underlying order and invoice records are unaffected and are retained as stated above;
• Web-server records — for such period as is necessary for security and diagnostic purposes; and
• Traffic measurement — as stated in Clause 7.3.

12.2Where erasure is requested and statutory records must nonetheless be preserved, we anonymise the account: contact particulars are erased irreversibly and only the business name and the statutory invoice records are retained.

12.3An unused registration which never resulted in an approved account, and any image uploaded but not submitted with a completed registration, is erased automatically.

13 Rights of the Data Principal and grievance redressal

13.1Subject to and in accordance with the DPDP Act, you have the right to obtain a summary of the personal data processed and of the processing activities undertaken; the identities of other Data Fiduciaries and processors with whom the data has been shared; the correction, completion or updating of inaccurate or incomplete personal data; the erasure of personal data; the nomination of another individual to exercise these rights in the event of death or incapacity; and the redressal of grievances.

13.2A request may be made by writing to contact@testationery.in, or through the procedure set out at Data and account deletion. So that we do not disclose data to the wrong person, a request must be made from the electronic mail address or mobile number registered on the account, or verified by other means acceptable to us.

13.3Grievance Officer. In accordance with Rule 5(9) of the SPDI Rules and Section 13 of the DPDP Act, grievances concerning the processing of personal data may be addressed to the Grievance Officer, Tirth Enterprise, at the address stated in Clause 1.1, by electronic mail to contact@testationery.in, or by telephone to +91 63531 35986.

13.4We shall acknowledge a grievance within forty-eight (48) hours of receipt and shall dispose of it within thirty (30) days.

13.5If a grievance is not resolved to your satisfaction, you may prefer a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act.

13.6A Data Principal is under a duty, under Section 15 of the DPDP Act, not to furnish false particulars, not to impersonate another person, and not to make a frivolous or vexatious complaint.

14 Data of children and of persons with a disability

14.1The Platform is intended solely for registered commercial establishments acting through persons of eighteen (18) years of age or above. We do not knowingly process the personal data of a child.

14.2If we become aware that personal data of a child has been collected without verifiable consent of a parent or lawful guardian, that data shall be erased forthwith. Any such instance may be reported to contact@testationery.in.

15 Third-party links and services

15.1The Platform contains links to services operated by third parties, including a messaging service and a mapping service. Following such a link takes you to a service governed by that provider's own terms and privacy policy, over which we exercise no control and for which we accept no responsibility.

15.2Save for the links referred to in Clause 15.1, which operate only when you choose to follow them, no resource is loaded from any third-party origin when you use the Platform. Typefaces, stylesheets, scripts and images are all served from this domain, with the consequence that your browser discloses nothing to any other party in the ordinary course of viewing a page.

16 Amendments

16.1We may amend this Policy from time to time in order to reflect a change in our practices or in applicable law. The amended Policy takes effect upon publication on this page, and the date stated at the head of this page will be revised accordingly.

16.2Where an amendment materially affects the purposes for which personal data is processed, we shall give notice by such means as are reasonable in the circumstances, and, where the law so requires, obtain fresh consent.

17 Governing law and jurisdiction

17.1This Policy is governed by, and shall be construed in accordance with, the laws of India.

17.2Subject to any statutory forum prescribed under the DPDP Act, the courts and tribunals at Rajkot, Gujarat shall have exclusive jurisdiction in respect of any dispute arising out of or in connection with this Policy.

18 Severability

18.1If any provision of this Policy is held to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.