YOUR PRIVACY

Last updated: [TO PROVIDE — date of publication] · Applies to this website and to trade enquiries and orders placed through it.

This policy explains what Chirag Autos(“we”, “us”, “our”) does with information shared through this website. It is written to meet India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This is a business-to-business website. It serves dealers, distributors, retailers, workshops, service centres and fleet operators buying electric vehicles and spare parts for resale or commercial use. It is not a consumer retail store, and we do not take payment on this website.

1. Who is responsible for your information

Chirag Autos is the Data Fiduciary for the information described in this policy.

• Registered office: [TO PROVIDE — full registered address] (currently: Tohana, Fatehabad, Haryana, India)
• GSTIN: [TO PROVIDE — GSTIN]
• Contact: WhatsApp +91 81683 59540 · [TO PROVIDE — business email]
• Business hours: Monday to Saturday, 9:00 am – 7:00 pm IST

2. A note on business information

Most of what you send us is business information — a firm name, a shop address, a GSTIN, a trade reference. The DPDP Act protects individuals, not companies. However, details that identify a real person behind a business — a proprietor's name, a partner's mobile number, an employee's email — remain personal data and are protected exactly as this policy describes. We treat both with the same care rather than arguing about the boundary.

3. What we collect

Only what you choose to send us. We collect nothing about you in the background.

• Trade enquiries and quotation requests: your name, firm name, mobile number, and optionally your email, town or district, and the details of what you need.
• Dealership and distributor applications: in addition to the above, your business type, the area you cover, existing brands handled, years in the trade, and any business registration or GSTIN you choose to share so that we can assess the application.
• Bulk and fleet enquiries: approximate quantities, intended use, and delivery location.
• Orders you send us: the parts and quantities in your cart, together with the name and mobile number you provide so we can confirm rate, availability and despatch.
• Job applications: your name, contact details and whatever you tell us about your experience.
• Your cart, before you send it: held only in your own browser, on your own device. We cannot see it until you choose to send it to us.
• Technical records: our web server keeps standard logs — IP address, browser and device type, pages requested, date and time — for security, fraud prevention and troubleshooting.
• Staff and dealer-portal accounts: where an account exists, we store the username, a one-way encrypted password that even we cannot read, and a record of logins and changes made.

EMI interest requests: when you submit the Coming soon form, we store your name, mobile number, city, selected scooter and contact consent in our website database so our team can respond. This is not a loan application; no financial documents are requested.

4. What we do not collect

• No payment information. No card, UPI, netbanking or bank account details are ever entered on this website. No payment is processed here — rate and payment terms are agreed directly with our team.
• No advertising trackers, no behavioural profiling, no data sold or shared with data brokers.
• No sensitive personal data as defined by law — health records, biometric data, caste, religion, sexual orientation, or financial account credentials. Please do not send such information to us.
• We do not knowingly collect information about anyone under 18. This is a trade website and its users are businesses and their staff.

5. Why we use it, and on what basis

We use your information only for the purposes below. Our lawful basis is the consent you give by submitting a form, together with the legitimate uses recognised under Section 7 of the DPDP Act for performing a transaction you have asked for and for complying with law.

• Replying to your enquiry and preparing a quotation.
• Confirming, packing, despatching and delivering an order.
• Assessing a dealership, distributorship or bulk-supply application.
• Honouring warranty and replacement claims.
• Maintaining accounts, invoices and GST records as required by law.
• Sending you rate lists, stock updates or new-product information — only if you have asked for them.
• Protecting the website and our systems from fraud, abuse and unauthorised access.

We do not use your information to build advertising profiles, and no decision affecting you is made by automated means alone.

6. WhatsApp

Our enquiry forms and cart prepare a message and open WhatsApp for you. You decide whether to press send — nothing reaches us until you do. Once a conversation is inside WhatsApp it is also governed by WhatsApp's own terms and privacy policy, which we neither control nor can change. We retain those chats for as long as we need them to serve you and to keep a record of what was ordered.

7. Cookies and browser storage

• Your cartuses your browser's local storage on your own device. Clearing your browser data empties it. It is never transmitted to us on its own.
• Account login — where an account exists — uses one strictly necessary session cookie. It holds a random identifier and nothing else: no name, no number, no personal data. It is removed when the session ends.
• No advertising or cross-site tracking cookies are set. That is why this site shows you no cookie consent banner: there is nothing optional to consent to.

8. Where your information is stored

On servers operated by our hosting provider, Hostinger, within the hosting account controlled by Chirag Autos. Database records and uploaded files are held there, reached only over encrypted connections (HTTPS). Application code and configuration are kept outside the publicly served folder so they cannot be downloaded. Access is limited to authorised personnel, and every change made through our administration system is written to an audit log.

Where our hosting provider stores or processes data outside India, it does so under its own contractual and legal obligations. We do not transfer your information to any country restricted by the Central Government.

9. How long we keep it

The DPDP Act requires us to erase information once its purpose is served. Our retention periods are:

• Enquiries that do not result in an order: up to 24 months, then deleted.
• Order, invoice and GST records: retained as long as tax, accounting and company law require — currently up to 8 years under Indian law.
• Dealership applications not taken forward: up to 24 months.
• Active dealer and distributor records: for the duration of the trading relationship, plus the statutory record-keeping period afterwards.
• Job applications: up to 12 months, unless you ask us to remove them sooner.
• Server security logs: up to 12 months.

10. Who else sees it

We share the minimum necessary, and only with:

• Transport and courier partners — consignee name, mobile number and delivery address, so your goods can reach you.
• Our hosting provider — as the operator of the servers on which the data resides.
• Our accountants and auditors — for statutory audit and GST filing, under a duty of confidentiality.
• Manufacturers or suppliers — only where a warranty or replacement claim must be raised on your behalf, and only the details that claim requires.
• Government, regulatory or legal authorities — only where the law compels us, or to establish or defend a legal claim.

We do not sell, rent, trade or otherwise commercially disclose your information to anyone.

11. Your rights

As a Data Principal under the DPDP Act, 2023, you may ask us to:

• Access — a summary of the personal data we hold about you, how we have processed it, and who we have shared it with.
• Correct — anything inaccurate, incomplete or out of date, including updating your firm name, address or contact details.
• Erase — your personal data, where we are not required by law to retain it. Note that invoices and tax records cannot be erased before their statutory period expires.
• Withdraw consent — at any time, as easily as it was given. Withdrawing consent does not affect processing already carried out, and may mean we can no longer supply you.
• Nominate — another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — see section 14 below.

To exercise any of these, message us on WhatsApp at +91 81683 59540 or write to [TO PROVIDE — business email]. We respond within 30 days. We may first need to verify your identity or your authority to act for the firm, so that we do not disclose one business's information to another.

12. Your responsibilities

The DPDP Act also places duties on you: give us accurate information, do not impersonate another person or firm when applying for a dealership or placing an order, and do not raise false or frivolous complaints. If you send us the personal data of your own staff or customers, you are responsible for having their consent to do so.

13. How we protect it

• The entire website is served over HTTPS with a valid certificate.
• Passwords are stored using modern one-way hashing. They cannot be read or recovered by us, or by anyone who obtained a copy of the database.
• Administrative access requires a login, is rate-limited against password guessing, and destructive actions require the password to be entered again.
• Every change made through the administration system is recorded in an audit log with a timestamp.
• Application code, configuration and uploaded files are stored outside the public web folder and cannot be downloaded by URL.
• Database queries use bound parameters throughout, which closes off SQL injection by design.

No system can be guaranteed perfectly secure. If a breach ever affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

14. Grievances

If you are unhappy with how we have handled your information, contact our Grievance Officer, appointed under the DPDP Act, 2023 and the Information Technology Act, 2000:

• Name: [TO PROVIDE — grievance officer name]
• Designation: Grievance Officer
• Email: [TO PROVIDE — grievance officer email]
• WhatsApp: +91 81683 59540
• Address: [TO PROVIDE — full registered address] (currently: Tohana, Fatehabad, Haryana, India)

We acknowledge every grievance within 7 days and aim to resolve it within 30 days. If you remain dissatisfied, you may escalate the matter to the Data Protection Board of India.

15. Changes to this policy

If we change this policy we will revise the “last updated” date at the top of this page. Where a change materially affects how we use your information, we will say so prominently on the website and, where the law requires it, ask for your consent again.

[Draft — every field shown as [TO PROVIDE] must be completed in site/data/business.json, and this document reviewed by a qualified lawyer, before the website is opened to the public. This notice removes itself once those fields are filled.]