Privacy Policy

Preamble

This Privacy Policy (the “Policy”) describes how Burhani Rubber Products (the “Company”, “we”) collects, uses, shares, keeps and protects personal data. It is published under, and is to be read consistently with:

1. the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and
2. the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025, as their provisions come into force.

For the personal data described in Clause 2, the Company is the Data Fiduciary within the meaning of the DPDP Act. Terms defined in the Terms of Use have the same meaning here, and this Policy forms part of them.

1. Whom this Policy covers

1.1 Covered

1. visitors to the Website;
2. persons who send an Enquiry or otherwise write to or call the Company;
3. proprietors, partners, directors and contact persons of the Company’s customers, suppliers, transporters and other business counterparties; and
4. persons the Company authorises to use the Business Systems.

1.2 Not covered

This Policy does not cover any website, application or service operated by another person, even where the Website links to it, or any data after it has left the Company’s systems by the act of its recipient, including a document downloaded, printed or forwarded by a person entitled to receive it.

2. Personal data we handle

2.1 Enquiries

Your name, company, e-mail address, telephone number and message, and anything you choose to include with it. The enquiry form carries an automated check against unsolicited submissions; that check records nothing that identifies you.

2.2 Correspondence

E-mails, messages and calls you exchange with the Company, with their attachments, including drawings and specifications sent for a quotation.

2.3 Business records

For customers and suppliers: the name of the business and its contact persons, GSTIN, billing and delivery addresses, telephone numbers and e-mail addresses, and the records of dealings with them, including quotations, orders, invoices, payments, receipts, balances and delivery and transport particulars. These are business records, and are personal data only to the extent they relate to an identifiable individual, such as a proprietor.

2.4 Business Systems accounts

For each authorised person: name, username, any contact particulars entered, roles and permissions; the password, stored only as a one-way hash and never in a form that can be read back; the devices signed in, with their sign-in tokens stored on the server only as hashes; a subscription for notifications on a device where the person turns them on; and a record of the actions taken under the account, kept for security and audit.

2.5 Technical data

When the Website or a Business System is used, the servers process the Internet Protocol address, the browser’s user-agent string, the address requested, the time and the outcome of each request, and security events such as sign-in attempts.

2.6 Data we do not want

The Company does not ask for, and you should not send through the Website, any Aadhaar number, bank or card credentials, password of any other system, health, biometric or genetic data, or any data of a child.

2.7 Children

The Website is meant for businesses and is not directed at persons under eighteen (18) years of age. The Company does not knowingly collect personal data of a child, and undertakes no tracking, behavioural monitoring or targeted advertising of anyone.

3. Purposes

Personal data is used only to:

1. reply to an Enquiry, prepare a quotation and deal with you on it;
2. perform a contract: supply, invoice, despatch and deliver Products, receive and make payments, and handle returns and after-sales matters;
3. keep the books of account and records that the Central Goods and Services Tax Act, 2017, the Income-tax Act and other laws require;
4. operate the Business Systems, including signing in, checking permissions, sending notifications and keeping an audit record;
5. protect the Website, the Business Systems and their users against misuse, fraud and attack;
6. comply with Applicable Law and with the lawful requests of any Governmental authority; and
7. establish, exercise or defend legal claims.

Particulars sent in an Enquiry are not added to any marketing list without your consent.

4. Lawful basis

Personal data is processed on one or more of the following grounds:

1. your consent under Section 6 of the DPDP Act, given when you send an Enquiry for the purpose of having it answered;
2. the legitimate uses recognised by Section 7 of the DPDP Act, including data you provide voluntarily for a specified purpose, the fulfilment of an obligation under law, compliance with an order of a court or tribunal, and purposes of employment and safeguarding the employer from loss or liability; and
3. the performance of a contract with you or with the business you act for.

5. What the Company does not do

The Company does not:

1. sell, rent or trade personal data to or with anyone;
2. use analytics, advertising, tracking pixels, fingerprinting, third-party scripts or third-party fonts on the Website;
3. offer sign-in through any social or third-party account;
4. use personal data for behavioural advertising, profiling or cross-site tracking;
5. use personal data to train, fine-tune or evaluate any machine learning model or artificial intelligence system; or
6. take any solely automated decision that has a legal effect on you.

6. Sharing

6.1 Recipients

Personal data is disclosed only as far as is necessary, and only to:

1. the Company’s own personnel, according to the permissions each holds;
2. the providers of its servers, network, e-mail and encrypted off-site backup, who process data on the Company’s behalf;
3. transporters and couriers, to deliver Products;
4. banks and payment providers, to make and receive payments;
5. its chartered accountants, auditors and advocates, under professional confidentiality;
6. Governmental authorities, tax authorities, courts and law enforcement agencies, where Applicable Law requires or permits it; and
7. a successor to the Company’s business, bound by obligations equivalent to this Policy.

6.2 Messaging and notifications

Where you or the Company send a document through WhatsApp or another messaging application, its provider handles it under its own terms. Notifications to a Business Systems device pass through the push service of that device’s browser, encrypted so that the push service cannot read them.

7. Where data is kept

The Company’s servers and its providers may store or process data in or outside India. Any transfer outside India is subject to such restrictions as the Central Government notifies under Section 16 of the DPDP Act.

8. Retention

Personal data is kept only for as long as its purpose requires, or for longer where Applicable Law requires it or a legal claim is reasonably expected.

9. Security

9.1 Measures

The Company maintains reasonable security safeguards, consistent with the Information Technology Act, 2000 and Section 8(5) of the DPDP Act, including:

1. encryption of every connection to the Website and the Business Systems with Transport Layer Security;
2. a content security policy that permits no third-party script on the Website;
3. passwords stored only as one-way hashes, and sign-in tokens stored on the server only as hashes, in a cookie no script can read;
4. permissions checked on the server on every request, so that a withdrawal takes effect at once;
5. an application database account that cannot alter the database structure or rewrite the audit record;
6. firewalls, intrusion prevention and the timely application of security updates; and
7. off-site backups held only in encrypted form.

Specific measures change over time, and any of them may be replaced by an equivalent or better one.

9.2 No absolute security

No system or transmission over the internet is completely secure. The Company does not warrant absolute security, and the security of your own devices, networks, e-mail accounts and credentials is your own responsibility.

9.3 Breach intimation

In the event of a personal data breach, the Company will intimate the Data Protection Board of India and each affected person in the form and within the time the DPDP Act and its rules require.

9.4 Vulnerability reports

Good-faith reports of a suspected vulnerability are welcome at admin@burhanirubber.com. No person is authorised to test, scan or probe the Website or the Business Systems without the Company’s prior written authorisation, and the Company operates no bug bounty.

10. Your rights

10.1 Rights

Subject to the DPDP Act, you may:

1. obtain a summary of the personal data the Company processes about you and of that processing;
2. obtain the identities of those with whom it has been shared, and a description of what was shared;
3. have it corrected, completed, updated or erased;
4. withdraw a consent you have given, as easily as you gave it;
5. nominate another person to exercise your rights in the event of your death or incapacity; and
6. have a grievance redressed under Clause 11.

10.2 Limits

Withdrawal of consent operates only for the future. A request for erasure does not reach data that Applicable Law requires the Company to keep, such as its books of account and tax records, or data needed to establish, exercise or defend a legal claim.

10.3 Making a request

Write to admin@burhanirubber.com, stating the right you wish to exercise and enough particulars to find the data. The Company may verify your identity before acting, and will respond within the period Applicable Law prescribes. A person making a request shall furnish only authentic particulars and shall not make a false or frivolous request, as Section 15 of the DPDP Act requires.

11. Grievance redressal

The Company designates for grievances under the Information Technology Act, 2000 and the DPDP Act:

Grievance Officer
The Grievance Officer, Burhani Rubber Products
E-mail: admin@burhanirubber.com

A grievance will be acknowledged and disposed of within the period Applicable Law prescribes. If the grievance is not resolved, you may approach the Data Protection Board of India after exhausting this mechanism, as Section 13(3) of the DPDP Act provides. Disputes are otherwise governed by Clause 13 of the Terms of Use, under the jurisdiction of the courts at Bengaluru, Karnataka.

12. Changes

The Company may amend this Policy by publishing a revised version on the Website with a new effective date. Where a change is material, it will take such further steps to give notice as the change warrants.