DPDP Act 2023 Notice

Privacy Policy & Data Protection

Version: 3.0•Effective Date: October 1, 2026 [BUSINESS INPUT REQUIRED]•Statutory Authority: MeitY & DPDP Act, 2023

LEGAL REVIEW STATUS: DRAFT — PROFESSIONAL LEGAL REVIEW REQUIRED BEFORE PUBLICATION

This notice is drafted in strict adherence to Section 5, Section 6, and Section 8 of the Digital Personal Data Protection Act, 2023 (DPDP Act). It establishes our role as a Data Fiduciary and your statutory rights as a Data Principal.

1. Categories of Personal Data We Process

Identity & Auth Data

Customer full name, verified mobile phone number, OTP authentication records via Supabase/Firebase.

Geolocation & Address

Street address, house details, landmarks, and precise GPS coordinates via Google Maps API for 5.5 km route verification.

Financial & Payment Data

Payment method, Cashfree transaction reference IDs, and refund statuses. Sonh NEVER stores raw card CVVs, card numbers, or UPI MPINs.

Sonh Print Documents

Uploaded PDFs/documents, page counts, SHA-256 checksums, and malware scan status. Files undergo automated daily deletion at 2:00 AM post-retention expiry.

2. Specified Lawful Purposes of Processing

Under Section 4 of the DPDP Act 2023, your personal data is processed solely for specified, lawful fulfillment purposes:

Order Execution: Verifying delivery feasibility, routing riders, picking inventory, and delivering sealed totes.
Communication & Invoicing: Sending SMS/push notifications regarding live tracking and issuing legally compliant GST tax invoices.
Payment Reconciliation: Processing prepaid authorizations and executing automated bank/wallet refunds.
Age Verification: Enforcing statutory 21+ tobacco age limits under the Cigarettes and Other Tobacco Products Act (COTPA).

3. Document Retention & Automated Deletion Lifecycle

Sonh strictly complies with the Storage Limitation principle:

• Print Documents: Files uploaded to Sonh Print are stamped with a retention expiration timestamp and permanently deleted by an automated nightly cron job at 2:00 AM.

• Tax Invoices: Commercial invoices and order ledger records are maintained for 8 years in compliance with the Central Goods and Services Tax Act, 2017.

• Account Credentials: Maintained for the active duration of your account, deleted upon verified account erasure requests.

4. Your Statutory Rights under the DPDP Act, 2023

As a Data Principal, you are entitled to exercise the following enforceable statutory rights:

Right to Access InformationRequest a summary of personal data being processed and third parties shared with.

Right to Correction & ErasureRequest correction of inaccurate data or permanent deletion of outdated records.

Right to Grievance RedressalExpedited escalation to our designated Grievance Officer with 48h acknowledgment.

Right to NominateDesignate an individual to exercise your privacy rights in the event of death or incapacity.

5. Data Protection Officer & Grievance Contacts

Designated Grievance Officer: [GRIEVANCE OFFICER NAME — BUSINESS INPUT REQUIRED, e.g., Umar Hamid]

Official Privacy Email: [OFFICIAL GRIEVANCE EMAIL — BUSINESS INPUT REQUIRED, e.g., privacy@sonhmart.in]

Postal Redressal Address: Ushkara, Baramulla, Jammu & Kashmir - 193101, India

Customer Support Phone: +91 6006301589 [CONFIRM ACTIVE LINE]

Statutory Escalation: You retain the legal right to escalate unresolved grievances to the Data Protection Board of India.