Data Protection
This notice summarises your rights under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) in respect of personal data processed by SutraOS Technologies Private Limited in connection with SutraFin.
It is a summary. The Privacy Policy is the full statement of what personal data is collected, why it is processed, who it is shared with and how long it is kept, and it governs where the two differ.
For personal data processed in connection with the Platform, SutraOS Technologies Private Limited acts as the Data Fiduciary under the DPDP Act, except where it processes personal data on behalf of another person in a capacity recognised under applicable data protection laws.
Your rights
Subject to applicable data protection laws, you may:
- seek information about the processing of your personal data;
- request correction, updating or completion of personal data that is inaccurate or incomplete;
- request erasure of your personal data, where applicable;
- withdraw your consent, where the processing is based on consent; and
- raise a grievance about the processing of your personal data.
A request for erasure is subject to retention obligations. Records that law requires us to keep — invoices, GST and tax records, accounting and transaction records, and fraud, dispute and audit records — are retained for the period applicable law prescribes, even after an account is closed. Personal data held in backups is deleted in accordance with the applicable backup cycle.
Consent
Where consent is required, we give notice of what personal data is proposed to be collected and for what purpose, and obtain consent through an appropriate affirmative mechanism. Where applicable data protection laws require consent to be demonstrable, a record of it is kept, which may cover the account, the version of the notice or document, and the date and time.
Not all processing rests on consent. Where applicable data protection laws recognise another lawful basis, we may process personal data on that basis without separately relying on consent.
Consent to promotional communications is separate from consent to processing necessary for the Platform. Refusing or withdrawing consent to promotional communications does not stop service, security and transactional messages such as one-time passwords, order confirmations and delivery updates.
Withdrawing consent
Where processing is based on consent, you may withdraw it at any time — through the mechanism made available to you on the Platform, or by writing to the contact below.
Withdrawal takes effect going forward. It does not affect the lawfulness of processing carried out before it.
Withdrawal has consequences, and where it affects our ability to provide a Platform feature or service those consequences may be communicated to you. Personal data is necessary to identify a business, route an order to a distributor and issue an invoice, so withdrawing consent will in practice prevent new orders being placed. It does not cancel orders already placed: those, and the delivery, invoicing, payment, return and record-keeping obligations attached to them, continue.
How to exercise a right or raise a grievance
Write to the privacy and grievance contact:
Email: support@sutrafin.com
Address: 5th Floor, Watermark, Technopark, Kondapur, Madhapur, Hyderabad, Shaikpet, Telangana, India, 500081
Say which right you are exercising and give enough detail to identify the account. We may ask for reasonable information to verify your identity or your authority to act, particularly for a request concerning access, correction or erasure.
Requests and grievances are addressed within the timelines prescribed under applicable data protection laws. Nothing in this notice restricts any right or remedy available to you as a Data Principal under those laws, including the right to approach the Data Protection Board of India.
The full statement
Read the Privacy Policy for the complete position, including the categories of personal data collected, the purposes of processing, sharing with distributors and other transaction counterparties, third-party service providers, security, retention periods and cross-border processing. This notice adds nothing to it and creates no separate entitlement.