Privacy Policy

Pramukh Toys decides why and how your personal data is processed on the Platform and is responsible for it (the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023). Our contact details and the details of our Grievance Officer are at the end of this policy.

We collect only what we need to run the Platform and fulfil orders:

• Account details: your mobile number, name, business name and preferred language. Your password is stored only as a one-way encrypted value (a hash), so nobody, including our staff, can read it.
• Business details that you or our team add: GSTIN, business email, alternate phone number, business address and agreed payment terms.
• Delivery addresses: contact person, contact phone number, address, landmark, city, district, state and PIN code.
• Order and payment records: products, quantities, prices, purchase order references and notes, order status history, dispatch details (such as the transporter, vehicle number, tracking reference and the name of the person who received the goods) and records of offline payments (amount, date, method and reference). No online payment is taken on the Platform, so we never collect card numbers, UPI PINs or banking passwords.
• Verification codes: one-time codes sent by SMS to confirm your mobile number. They are stored only in encrypted form and deleted within 24 hours.
• Enquiries: your name and mobile number and, if you choose to give them, your email, business name, city and message, when you use our contact form.
• Technical and security data: IP address, browser and device type, sign-in times and a record of important actions (such as sign-ins, order changes and changes to settings).

• to create and manage your account and verify your mobile number;
• to show you distributor prices and to accept, confirm, prepare, dispatch and deliver your orders;
• to record payments, payment due dates and outstanding balances;
• to send you service messages, such as verification codes by SMS and order updates as notifications in your account;
• to answer your enquiries and requests for support;
• to keep the Platform secure, prevent misuse and fraud, and keep records of important actions;
• to plan production using total order volumes and product demand; and
• to comply with our legal obligations, including tax and accounting requirements.

We do not sell your personal data and we do not use it for advertising by third parties. We will not send you promotional messages without your consent.

We process your personal data with your consent, which you give when you create an account or send us an enquiry, and for other legitimate uses allowed by law, such as data you voluntarily provide to place orders and compliance with legal obligations.

You may withdraw your consent at any time by contacting our Grievance Officer. Withdrawing consent does not affect processing done before it, and we may then be unable to keep your account open or accept new orders. We may keep records that the law requires us to keep.

We share personal data only where needed, with:

• Our staff, on a need-to-know basis. Administrators manage accounts and orders. Warehouse staff see only what they need to pack and dispatch orders, such as names, delivery addresses, phone numbers and quantities.
• Service providers who process data for us under our instructions: Google Cloud (hosting and storage, on servers in India) and Fast2SMS (delivery of SMS verification codes, which receives your mobile number and the message).
• Transporters and courier partners, who receive the name, address and phone number needed to deliver your order.
• Government authorities, courts, regulators or law enforcement agencies, when required by law.
• A buyer or successor of our business if it is merged, sold or restructured, who will remain bound by this policy.

The Platform uses only cookies that are necessary for it to work:

• pt_at and pt_rt: keep you securely signed in (pt_at expires after 15 minutes; pt_rt after 30 days without use);
• pt_csrf: protects your account against forged requests from other websites;
• NEXT_LOCALE: remembers the language you chose.

We do not use advertising or analytics cookies, and we do not allow third parties to track you on the Platform. If you block these cookies, you will not be able to sign in.

Your data is stored on servers in India (Google Cloud, Mumbai region).

We use reasonable security practices, including encrypted connections (HTTPS), one-way encryption of passwords, verification codes and sign-in tokens, role-based access for staff, limits on repeated attempts and logs of important actions. No system is completely secure. If a personal data breach occurs, we will inform affected users and the authorities as required by law.

• Account and business details: while your account is open, and afterwards only as long as needed for the purposes below.
• Orders, payments and related records: for as long as tax, accounting and other laws require.
• Verification codes: deleted within 24 hours.
• Sign-in sessions: deleted within 30 days after they expire or you sign out.
• Read notifications: deleted after 180 days.
• Enquiries: deleted 12 months after they are handled.
• Security logs: deleted after 3 years.

Subject to applicable law, you have the right to:

• get a summary of the personal data we hold about you and how we use it;
• correct, complete or update your personal data (you can edit many details yourself in your account);
• ask us to erase your personal data. Accounts that have orders are closed rather than deleted, because the law requires us to keep order and payment records;
• withdraw your consent;
• nominate another person to exercise your rights if you die or become unable to do so; and
• have your grievances addressed.

To use these rights, contact our Grievance Officer using the details below. We may ask you to confirm your identity, for example through your registered mobile number. We will respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

The Platform is meant for businesses and for people aged 18 or over. We do not knowingly collect personal data of children. If you believe a child has given us personal data, please contact us and we will delete it.

We may update this policy from time to time. The date at the top shows when it last changed. If we make important changes, we will tell you on the Platform.

For questions, requests or complaints about your personal data, contact our Grievance Officer: