Scope & Data Fiduciary Identity
This Privacy Policy delineates how Ginorias (“Company”, “we”, “us”, or “our”), having its registered corporate office at GINORIAS, Mithapukhari Road, Jorhat, Assam - 785001 and GSTIN 18AECPG897L1ZV, processes, safeguards, and respects the personal data of patrons and consumers engaging with our multi-brand home appliances storefront, installation concierge, and warranty service network across India.
We operate as the designated Data Fiduciary pursuant to Section 2(i) of the Digital Personal Data Protection Act, 2023 (“DPDPA 2023”), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Consumer Protection (E-Commerce) Rules, 2020.
Information We Collect
We uphold a strict principle of data minimization. We only collect digital personal data necessary to deliver, install, invoice, and service your home appliance orders:
- Commerce & Invoicing Identifiers: Full legal name, billing address, doorstep installation delivery destination with 6-digit Indian PIN Code, primary contact telephone (+91), email address, and optional GSTIN for business tax invoices.
- Transactional Records: Unique alphanumeric order tracking tokens (e.g.
GIN-XXXXXX), ordered appliance SKUs, model specifications, timestamped delivery handover OTP confirmations, and technician installation sign-off records. - Technical & Telemetry Data: IP address, browser user-agent header, language preference, and device viewport specifications. Telemetry is gathered exclusively via first-party event beacons without tracking pixels or third-party behavioral profiling.
- Product Preferences: Selected energy star ratings, capacity requirements, submitted support queries, and verified product reviews tied strictly to completed customer orders.
Grounds for Processing (DPDPA 2023 Sections 4 & 7)
| Processing Purpose | Statutory Ground (DPDPA 2023) | Retention Standard |
|---|---|---|
| Order Fulfillment & Doorstep Delivery | Section 7(b) Performance of Contract | Duration of fulfillment + statutory warranty period |
| Fiscal, GST Invoicing & Statutory Accounting | Section 7(a) Legal Compliance (CGST Act, 2017) | 8 years (statutory Indian tax & accounting laws) |
| Cyber Security & Fraud Prevention | Section 7(c) Security Incidents (CERT-In) | Rolling 36 months from transaction |
| Client Keynotes & Retention Updates | Section 6 Freely Given, Informed Consent | Until formal consent withdrawal / 1-click unsubscribe |
Payment Tokenization & Financial Security (RBI CoFT)
Zero Raw Card Storage Guarantee: We strictly adhere to Reserve Bank of India (RBI) Card-on-File Tokenization (CoFT) guidelines and National Payments Corporation of India (NPCI) unified payment interface standards. We never receive, record, or store raw credit or debit card numbers, CVV security codes, or banking PINs on our servers.
When you complete a purchase, your payment is processed via authorized gateway partners: Razorpay Software Private Limited (for UPI, RuPay, Indian Netbanking, and domestic credit/debit cards) and Stripe Payments India Private Limited (for international cards and enterprise settlement). Transactions are initialized with a strict payment_status = 'Pending' and are only updated to 'Paid' upon cryptographically verified HMAC-SHA256 server-to-server webhook callbacks.
Sub-Processors & Pan-India Logistics Network
To deliver high-precision audio equipment across 19,000+ serviceable PIN codes in India, we share required shipping details exclusively with trusted enterprise logistics partners:
- Express Couriers: Blue Dart Express, Delhivery Limited, DTDC Express, and India Post Speed Post. Only destination address, recipient name, delivery PIN code, and contact telephone are transmitted for dispatch and OTP delivery verification.
- Transactional Communications: Hardened Indian SMS and transactional email relays for order confirmation, dispatch waybills, and delivery milestone alerts.
- Dual-Driver Database Infrastructure: Secure, self-contained database architecture (SQLite for local instances, isolated enterprise MySQL 8+ with TLS 1.3 encryption-at-rest).
Cross-Border Data Transfers
In accordance with Section 16 of the Digital Personal Data Protection Act, 2023, personal data of Indian Data Principals is processed primarily within sovereign Indian server infrastructure. Any transfer of personal data outside India is conducted strictly in accordance with Central Government notifications and statutory adequacy safeguards, reinforced with end-to-end cryptographic payload protection.
Data Retention & Authentic Zero-Fake-Data Policy
We enforce an unwavering Zero-Fake-Data Integrity Standard across our analytics and operational platforms. We do not synthesize user interactions, artificially inflate reviews, or fabricate visitor telemetry. Review submissions are authenticated against verifiable completed orders (orders.status = 'Completed').
Records are retained strictly according to regulatory schedules. Non-transactional transient logs are pruned after 90 days. Back-in-stock alerts are permanently erased once the relevant SKU restock notification is successfully dispatched.
Statutory Data Principal Rights (DPDPA 2023)
Under the Digital Personal Data Protection Act, 2023, you hold inviolable statutory rights as a Data Principal:
- Right to Access Information (Section 11): Obtain confirmation of whether your data is processed, a summary of personal data being processed, and identities of Data Fiduciaries/Processors with whom data has been shared.
- Right to Correction & Erasure (Section 12): Request correction of inaccurate or misleading data, completion of incomplete records, and erasure of personal data that is no longer necessary for transaction fulfillment or legal compliance.
- Right of Grievance Redressal (Section 13): Access readily available grievance redressal mechanisms provided by our Data Fiduciary, with statutory right of escalation to the Data Protection Board of India (DPBI).
- Right to Nominate (Section 14): Nominate any individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal under the Act.
Statutory Grievance Redressal (IT Act 2000 & Consumer Protection)
Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Rule 4(4) of the Consumer Protection (E-Commerce) Rules, 2020, we publish our statutory grievance redressal mechanism:
Statutory Redressal SLA: All privacy grievances, inquiries, or rights exercise requests submitted to our Grievance Officer will be formally acknowledged within 48 hours with a tracking ticket number, and resolved within 30 days from the date of receipt.
If your grievance is not resolved satisfactorily within 30 days, you have the statutory right to escalate your complaint to the Grievance Appellate Committee (GAC) or file an appeal before the Data Protection Board of India (DPBI).
Security Safeguards & Cryptographic Architecture
Our digital architecture enforces defense-in-depth principles:
- Cryptographic In-Transit Protection: Mandatory Transport Layer Security (TLS 1.3) with HTTP Strict Transport Security (HSTS) headers across all web and API transactions.
- Administrative Credential Protection: Secure password hashing utilizing contemporary Argon2id or Bcrypt algorithms. Administrative access requires authenticated session management with strict CSRF protection and brute-force rate-limiting.
- Spreadsheet Formula Neutralization: Server-side CSV sanitization adhering to OWASP CWE-1236 to neutralize spreadsheet formula injection vulnerabilities during administrative reporting.
Cookies & Local Telemetry Architecture
Our website utilizes strictly essential session cookies and local storage tokens (e.g. localStorage['aura_cart'], localStorage['aura_wishlist']) solely to preserve your active shopping bag and curated appliance wishlist across browsing sessions. We do not load third-party ad retargeting pixels, social trackers, or intrusive fingerprinting scripts.
Statutory Grievance Officer & Concierge Contact
To exercise your statutory Data Principal rights, file a grievance, or request an export of your transaction history, please contact our designated Grievance Officer:
Ginorias
Statutory Grievance Redressal & Data Protection Concierge