Privacy Policy

1. Who We Are & Role Under the DPDP Act

Tejas Industries acts as a Data Fiduciary under the DPDP Act for personal data of registered Users. Where you upload personal data belonging to third parties (e.g. employee names on a visiting card), you remain the Data Fiduciary and we act as a Data Processor on your behalf.

Grievance Officer: Mr. Jalindar Eknath Shendge · info@goprintpack.com · Survey No 312/1, Puntamba Road, Village Kokamthan, Taluka Kopargaon, District Ahilyanagar, Maharashtra 423601, India.

2. Data We Collect

Information you provide — identity & contact (name, email, phone, company, GSTIN, PAN, address, role); KYC & bank details; transactional data (briefs, artwork, chat, dispute evidence, ratings); payment data (invoice GSTIN mapping, Razorpay payment IDs).

Information collected automatically — IP, user-agent, device type, timezone, timestamps, session cookies, JWT access/refresh tokens, usage patterns (bids, click-throughs, dispute history, SLA metrics).

Information from third parties — Razorpay (payment status, settlements), Shiprocket (tracking, POD), Zoho Books (invoice IDs, IRN, E-Way Bill, TDS), Emergent Google Auth (name/email/picture), MSG91 / ZeptoMail (delivery receipts).

We treat bank account details, financial information, biometric data (if ever uploaded) and passwords as Sensitive Personal Data or Information (SPDI) and process them only with your consent.

3. Lawful Purposes for Processing

1. Account & KYC — creating, verifying and securing your account.
2. Marketplace operations — matching, auctions, scoring, anonymisation, RBAC enforcement.
3. Order fulfilment — artwork release, preflight, Shiprocket labels, Zoho invoicing.
4. Payments & escrow — Razorpay escrow, commission / GST / TDS computation, payouts, refunds.
5. Dispute resolution — moderation, arbitration, verdict publication, audit logs.
6. Communications — transactional emails, SMS, WhatsApp, in-app inbox, support.
7. Analytics & product improvement — aggregated and de-identified where possible.
8. Compliance — tax filings, AML, response to lawful government / court requests.
9. Security — fraud detection, rate-limiting, forensic audit.
10. Marketing (opt-in only) — newsletters, feature announcements.

4. How We Share Your Data

Within the Platform — Buyers and awarded Printers see each other's details only after escrow is funded; before that, Printer identity is anonymised.

With service providers (data processors) — each operates under contractual obligation to use data strictly for the service rendered: Razorpay (payments / escrow / payout), Shiprocket (shipping), Zoho Books (invoicing / EWB / TDS), MSG91 (SMS/WhatsApp), ZeptoMail (transactional email), Emergent Object Storage (artwork hosting), Emergent Google Auth (sign-in), MongoDB Atlas / cloud hosting.

With tax & regulatory authorities — GSTN (IRN push), Income-tax Department (TDS filings), law enforcement (only on valid legal request).

Corporate transaction — in the event of merger / acquisition / restructuring, data may transfer to the successor under the same obligations.

5. International Transfers

Primary data centres are in India. Some processors may process data in other jurisdictions under contractual safeguards equivalent to those required under Indian law and, where applicable, the DPDP Act's cross-border transfer rules.

6. Data Retention

7. Your Rights

• Access the personal data we hold about you
• Correct inaccurate or outdated data
• Erase data no longer required (subject to retention windows)
• Withdraw consent for consent-based processing including marketing
• Port your data in a machine-readable format
• Nominate a Data Principal nominee (DPDP Act)
• Grievance redressal through the Grievance Officer

Write to info@goprintpack.com from your registered email. We respond within 30 days.

8. Security Safeguards

• Encryption: TLS 1.2+ in transit, AES-256-equivalent at rest for sensitive artefacts.
• Authentication: JWT access + refresh with httpOnly, Secure, SameSite cookies; bcrypt-hashed passwords; brute-force throttling.
• RBAC: strict role-based access control at the API layer; least privilege for Admin accounts.
• Payment data: never stored on our servers; all flows through Razorpay's PCI-DSS environment.
• Logging & monitoring: tamper-evident audit logs for KYC, payout, dispute resolution and admin overrides.
• Incident response: CERT-In Direction 20(3)/2022 notification where applicable.

9. Cookies & Similar Technologies

See our Cookie Policy. In summary: (a) essential cookies for auth & session integrity, (b) functional for preferences, (c) analytics (opt-in). We do not use advertising cookies.

10. Children's Data

The Platform is a B2B service and is not directed at children under 18. We do not knowingly collect data of minors; discovered accounts will be deactivated and data deleted.

10A. Checkout, Shipping & Supplier-Anonymity Data

• Delivery address (consignee name, phone, address, city, state, pincode) is collected at checkout. It is used to calculate GST place of supply and the live delivery rate, and it is shared only with Shiprocket and the awarded Printer, to print the GoPrintPack™-branded blind label.
• Supplier identity (name, GSTIN, contact, internal account ID) is never disclosed to Buyers. Buyer-facing APIs mask supplier IDs and production-update authors, and Buyers receive only the GoPrintPack™ tax invoice.
• Commission and payout data (plan, take-rate, net payout, bank or Razorpay Route details) is visible only to the payee and to admins.
• Phone OTP is sent through MSG91 (DLT-registered templates) and transactional email through ZeptoMail. Both are processors acting on our instructions.

11. Changes to this Privacy Policy

Material changes will be notified by email and in-app banner at least 15 days before taking effect.