1. Who we are
This Privacy Notice explains how Convurtic ("we"), operator of DukaanRaabta, 1st Cross, 1st Main Road, Old Mangammapalya, Bengaluru, Karnataka 560068, processes personal data. For account and platform data we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). We also follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Privacy contact: convurtic@gmail.com.
2. Data we collect
Owner account data: name, email, login identifiers, role, plan and limits, accepted policy version. Business data: business name, addresses, branch details, phone and WhatsApp numbers, social links, catalogue content, photos and PDFs you upload. Contact-form data: name, email, purpose, message and your consent confirmation. Technical and security data: session cookie, IP address and browser details processed by our hosting and anti-abuse providers, audit logs of account actions, and usage counters. We do not ask for, and you should not upload, Aadhaar, PAN, bank or card details, health data or customer lists.
3. Why we use it
We process personal data on the basis of your consent and for legitimate uses permitted by Section 7 of the DPDP Act, in order to: create and secure invited accounts; enforce plan limits; host and publish profiles you choose to make public; store and deliver media; answer contact-form enquiries; prevent fraud, spam and abuse; keep audit records; and comply with legal obligations. We do not sell personal data, do not use it for behavioural advertising, and do not send marketing emails without separate consent.
4. Public information
When you publish a profile, the business details and content you choose become publicly visible and may be indexed by search engines, shared, saved or screenshotted by visitors. Unpublishing removes the profile from our site, but we cannot recall copies made by others, search-engine caches or printed QR material.
5. Service providers and transfers
We use these processors to run the service: Google Firebase (authentication and database), Cloudinary (image and document hosting), Vercel (application hosting) and Cloudflare Turnstile (spam protection on forms). They process data on our instructions under their published data-processing terms and may store or process it outside India. Such transfers are made in accordance with Section 16 of the DPDP Act and any restrictions notified by the Government of India. Following a WhatsApp, Google Maps, social-media or UPI link takes you to that provider, whose own privacy policy applies.
6. Retention
We keep account and store data while your account is active. After closure we delete or anonymise it within 90 days, except where we must keep it longer by law or to resolve disputes. Contact-form enquiries are kept for up to 12 months and security/audit logs for up to 180 days unless needed for an investigation. Backups held by providers are overwritten in their normal cycles.
7. Security
We use HTTPS, HttpOnly session cookies, server-side role and ownership checks, signed media uploads, database security rules, upload size/type restrictions and audit logging. No system is perfectly secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India, and report to CERT-In where required, within the prescribed timelines.
8. Your rights
Under the DPDP Act you may: access a summary of your personal data and how it is processed; correct, complete or update it; request erasure; withdraw consent (which does not affect processing already done); nominate another person to exercise your rights in the event of death or incapacity; and seek grievance redressal. Requests are free and are explained on the Data requests & grievance redressal page. If you are not satisfied with our response, you may approach the Data Protection Board of India.
9. Children
The platform is for business owners aged 18 or over. We do not knowingly collect personal data of children, and we do not track or target advertising at children. If you believe a child has given us data, contact us and we will delete it.
10. Changes
We will publish changes to this notice with a new version date. If a change materially affects how we use your data, we will notify account holders and seek fresh consent where the law requires it.
Operator & grievance contact
Convurtic (operator of DukaanRaabta) · convurtic.com
1st Cross, 1st Main Road, Old Mangammapalya, Bengaluru, Karnataka 560068
Support: convurtic@gmail.com
Privacy & grievances: convurtic@gmail.com · Convurtic
Governing law: India · Courts: Bengaluru