Privacy Policy

brandsathi.in — operated by Seekhobecho Enterprises ("we," "us," "our," "Company") — respects your privacy and is committed to protecting your Personal Data. This Privacy Policy explains how we collect, use, store, share, and protect your data when you use our website and all associated services.

This Privacy Policy applies to:

• The website at www.brandsathi.in and all subdomains;
• All subscription plans: Silver, Gold, Titanium, Elite, Platinum, Platinum Plus, and Diamond;
• All catalogues, ecommerce integrations and marketing tools provided through the Platform;
• All communications between you and brandsathi.in.

By using the Platform, you confirm that you have read, understood, and consented to this Privacy Policy. If you do not agree, please do not use the Platform.

This Privacy Policy is governed by and complies with the following laws and regulations applicable in India:

3.1.Data Fiduciary

For the purposes of the DPDP Act, 2023, Seekhobecho Enterprises is the Data Fiduciary responsible for the processing of your Personal Data on brandsathi.in.

3.2.You — the Data Principal

For the purposes of the DPDP Act, 2023, you are the Data Principal — the natural person whose Personal Data is processed by us.

3.3.Data Processors

We engage third-party Data Processors to provide infrastructure, payment processing, analytics, customer support, and marketing services. These processors handle your data only on our instructions and are bound by Data Processing Agreements.

4.1.Categories of Personal Data

• Identity Data: Full legal name, date of birth (18+ verification), gender, photograph (optional)
• Contact Data: Mobile number (OTP-verified), email address, delivery address, alternate contact
• KYC & Verification Data: Aadhaar (last 4 digits only), PAN (masked storage), GSTIN, IEC (for international plans), bank account (masked)
• Transactional Data: Subscription payments, refund requests, GST invoices
• Ecommerce & Selling Data: Product listings, marketplace orders (Amazon/Meesho/Flipkart), shipping data, returns, customer feedback
• Device & Technical Data: Device model, OS version, IP address, advertising ID (if consented), crash logs, performance metrics
• Behavioural & Usage Data: Website page views, click events, feature usage, session duration, site search queries
• Communication Data: Support tickets, grievance submissions, chat with customer success, email correspondence
• Marketing Preferences: Opt-in/opt-out status for promotional messages, WhatsApp updates, notifications

4.2.Sensitive Personal Data

We minimise the collection of Sensitive Personal Data. Where collected (e.g., for KYC), it is processed under explicit consent, stored with strong encryption, and retained only as long as legally required.

5.1.Direct Collection

You provide most data directly when you:

• Sign up and create an account;
• Complete KYC for your plan;
• Make payments via the Platform;
• List products, upload catalogues, or use selling tools;
• Submit support tickets or grievances;

5.2.Automatic Collection

The Platform automatically captures the following through standard website technology:

• Device identifiers (model, OS);
• IP address and approximate geo-location (city/region level);
• Website usage analytics and custom logging;
• Crash and performance data;
• Cookies and similar tracking on the website.

5.3.From Third Parties

We may receive Personal Data from:

• Marketplace integrations (Amazon, Meesho, Flipkart) — your order data when you authorise the integration;
• KYC verification services — Aadhaar/PAN verification status;
• Referral sources.

6.1.Legal Bases for Processing (DPDP Act, 2023)

Under the DPDP Act, we process your Personal Data only on the following grounds:

6.2.Purposes of Processing

We process your data to:

• Operate the Platform and deliver your subscription benefits;
• Verify your identity (KYC) and process payments;
• Integrate with marketplaces (Amazon, Meesho, Flipkart) and process orders;
• Provide customer support and resolve grievances;
• Send service notifications (renewal reminders, alerts, order updates);
• Send marketing communications (only with your opt-in consent);
• Improve the Platform via analytics and aggregated insights;
• Detect and prevent fraud, abuse, and security threats;
• Comply with applicable laws and respond to legal requests.

7.1.Specific Use Cases

Below is a transparent map of how your data flows through the Platform:

7.2.We Never Sell Your Data

brandsathi.in does not sell, rent, or trade your Personal Data to any third party. We share data only as described in Section 8 — for operational, legal, or your explicitly consented purposes.

8.1.Categories of Recipients

We share your data only with:

8.2.No Sale, No Rental, No Trade

We do not sell, rent, lease, or trade your Personal Data to any third party for marketing or commercial purposes — including data brokers, advertising networks, or unrelated businesses.

11.1.Reporting a Minor's Account

If you believe a minor has created an account on brandsathi.in, please report immediately to contactbrandsathi@gmail.com with details. We will investigate and take action within 48 hours.

11.2.DPDP Act Position

The DPDP Act, 2023 requires verifiable parental consent for processing children's data. Since brandsathi.in is an adult platform with explicit 18+ eligibility, we do not engage with children's data at all. This is a structural compliance choice, not an operational one.

12.1.Cookies on the Website

The website www.brandsathi.in uses cookies and similar technologies. We use the following cookie categories:

13.1.Security Measures

We implement reasonable security practices and procedures as required by Section 8 of the DPDP Act, 2023 and the IT Rules, 2011, including:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256);
• Access Control: Role-based access (RBAC) with quarterly reviews; Multi-Factor Authentication for all admin and production systems;
• Network Security: Firewalls, intrusion detection, vulnerability scanning;
• Website Security: Secure coding practices, code review, dependency scanning;
• Monitoring: Real-time error monitoring (Sentry), uptime monitoring (UptimeRobot), payment fraud monitoring;
• Vendor Security: All third-party processors bound by DPAs and security requirements;
• Employee Training: Mandatory cybersecurity training; access only on need-to-know basis;
• Incident Response: Documented breach response plan with 72-hour DPDP Act notification protocol.

13.2.User Responsibility

While we implement strong security on our side, you are responsible for:

• Maintaining confidentiality of your login credentials and OTPs;
• Not sharing your account access with others;
• Reporting unauthorised access immediately to contactbrandsathi@gmail.com;
• Using a secure network and device (not public Wi-Fi for sensitive transactions).

14.1.Retention Principle

We retain your Personal Data only as long as necessary for the purposes set out in this Policy or as required by applicable law. After the retention period, data is either deleted, anonymised, or archived per the matrix below:

14.2.Earlier Deletion on Request

Where you exercise the right to erasure (Section 15), we will delete data earlier than retention periods wherever legally permissible. Data we are legally required to retain (e.g., GST records, KYC under PMLA) cannot be deleted until the legal retention expires.

15.1.Your Five DPDP Rights

As a Data Principal under the DPDP Act, 2023, you have the following rights with respect to your Personal Data:

15.2.Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect processing that is based on other legal grounds (contractual necessity, legal obligation).

To withdraw consent:

• Marketing emails: click "Unsubscribe" in any marketing email;
• WhatsApp updates: reply "STOP" to any marketing message;
• Push notifications: disable in app settings;
• All other: email contactbrandsathi@gmail.com.

15.3.Response Timelines

We will respond to your rights requests within:

• Access requests: Within 30 days;
• Correction requests: Within 7 business days;
• Erasure requests: Within 30 days (subject to legal retention);
• Grievances: Acknowledged within 48 hours, resolved within 30 business days.

15.4.Verification of Your Identity

To protect your data, we may require you to verify your identity before responding to a rights request. We will verify using the registered mobile number (OTP) and email on file.

15.5.Right to Approach Data Protection Board

If you are not satisfied with our response, you may approach the Data Protection Board of India (when constituted under the DPDP Act, 2023) with your grievance. Details will be published on the Board's official portal.

16.1.Default — Data Stored in India

By default, your Personal Data is processed and stored on servers located within India. Our primary cloud infrastructure (AWS Mumbai region / Google Cloud Mumbai region) keeps data within Indian borders.

16.2.Limited Cross-Border Transfers

Some processing may require limited cross-border transfer where:

• A specific service requires global infrastructure (e.g., WhatsApp Business API, certain analytics);
• Marketplace integrations (Amazon.com USA for Platinum Plus plan) inherently involve international data flow;
• You voluntarily use international features (cross-border ecommerce).

Such transfers occur only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and with appropriate contractual safeguards (DPAs, standard contractual clauses).

16.3.Your Consent for Transfers

Where required, we will obtain your explicit consent before any cross-border transfer of your Personal Data.

17.1.Our Incident Response

Our Cybersecurity Policy CY-02 (Data Breach Response & Incident Management) governs internal incident response. Key elements:

• Severity classification (P1/P2/P3/P4) within 1 hour of detection;
• Containment within 2 hours for P1 incidents;
• Post-Incident Report (PIR) within 14 days of resolution;
• Records retained for 5 years from incident date.

17.2.Reporting a Suspected Breach

If you suspect your account has been compromised or that a Personal Data breach has occurred, please report immediately to:

contactbrandsathi@gmail.com and contactbrandsathi@gmail.com

18.1.Updates to This Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable law (DPDP rules, IT Act amendments);
• New Platform features or processing activities;
• New third-party processors or integrations;
• Operational improvements in data handling.

18.2.Notification of Changes

Material changes will be communicated through:

• Email to your registered address;
• Banner on the website;
• Minimum 7 days advance notice before changes take effect, where feasible.

18.3.Version Control

The version number and "Last Updated" date at the top of this document indicate the currently active version. Historical versions are archived and available on request at contactbrandsathi@gmail.com.

19.1.Grievance Officer — IT Rules 2021

In compliance with Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Company has designated a Grievance Officer:

19.2.Data Privacy Officer

For all DPDP Act 2023 related queries — including rights requests, data deletion, consent withdrawal, or breach reporting:

contactbrandsathi@gmail.com

19.3.Statutory Authorities

• Data Protection Board of India — once operational under DPDP Act, 2023;
• National Consumer Helpline: 1800-11-4000 (toll-free) | consumerhelpline.gov.in;
• Cyber Crime Helpline: 1930 | cybercrime.gov.in (for cyber-related crimes only).