CartureLegal
Privacy Policy
1. Introduction and scope
Effective Date: [DD/MM/YYYY] Last Updated: [DD/MM/YYYY]
This Privacy Policy explains how [Carture Legal Entity Name] (CIN: [CIN]), having its registered office at [Registered Address] (“Carture”, “we”, “us” or “our”), collects, uses, shares, stores and protects personal data when you use our website [www.carture.in], our cloud software platform, mobile applications, POS, inventory, reporting and related services (the “Services”).
This policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000 and the rules made under it, to the extent applicable.
It applies to:
- visitors to our website;
- prospective customers who request a demo, trial or quote;
- our customers (retail businesses that subscribe to the Services) and the individuals who act for them, such as owners, partners, directors, managers and staff (“Authorized Users”);
- individuals who contact our support, sales or grievance teams.
Capitalised terms not defined here have the meaning given in our Terms & Conditions. In this policy, “personal data”, “Data Principal”, “Data Fiduciary”, “Data Processor” and “processing” have the meanings given in the DPDP Act.
2. Our role: Data Fiduciary or Data Processor
We play two different roles depending on whose data it is and who decides why it is processed.
| Data | Who decides the purpose | Carture’s role | Where to send requests |
|---|---|---|---|
| Website visitor, lead, account, billing, support and Authorized User login data | Carture | Data Fiduciary | Carture’s Grievance Officer (Section 11) |
| Personal data our customers enter into the platform — e.g. their end consumers’ names, phone numbers and purchase history; their employees’ details; supplier contacts (“Customer Data”) | Our customer (the retail business) | Data Processor, acting only on the customer’s instructions | The retail business you dealt with. If you contact us, we will forward your request to them. |
Where we act as a Data Fiduciary, this policy governs our processing in full.
Where we act as a Data Processor, our customer is the Data Fiduciary. The customer is responsible for giving notice to, and obtaining consent from, its own end consumers and staff, and for responding to their rights requests. We process Customer Data only to provide the Services under our contract with the customer, keep it confidential, protect it with the safeguards described in Section 8, assist the customer with rights requests and breach notifications, and delete or return it when the contract ends. Our Terms & Conditions set out these obligations in detail.
3. Personal data we collect (as Data Fiduciary)
We collect only the personal data needed for the purposes in Section 4. Itemised:
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, designation, mobile number, email address, business address | You, during sign-up, demo requests, onboarding or support |
| Business and licence details | Business name, GSTIN, PAN of the business or proprietor, excise licence number and type, store locations | You, during onboarding |
| Account and login | Username, encrypted password, role and permissions, OTPs, linked devices | You and your administrator |
| Billing and payment | Plan, invoices, billing contact, transaction reference IDs. Card and UPI details are collected and held by our payment gateway, not by us. | You and our payment gateway |
| Usage and technical | IP address, device and browser type, app version, log-in times, pages and features used, error logs | Automatically, when you use the Services |
| Communications | Support tickets, call recordings (with prior notice), emails, WhatsApp and chat messages with us | You |
| Website and marketing | Cookie identifiers, form entries, campaign source, marketing preferences | Automatically and from you |
We do not intentionally collect sensitive information such as health, biometric or financial account data from Authorized Users. Please do not upload such data unless the Services specifically require it.
4. Why we process your data, and on what basis
Under the DPDP Act, we may process personal data either with your consent or for a “legitimate use” permitted by Section 7 of the Act. Each purpose and its basis:
| Purpose | Data used | Basis |
|---|---|---|
| Create and manage your account; authenticate users | Identity, contact, account | Consent, and data you voluntarily provide for this purpose (Sec. 7(a)) |
| Provide, configure, support and maintain the Services | Account, usage, communications | Consent / Sec. 7(a) |
| Billing, invoicing, collections and GST compliance | Identity, business, billing | Consent; compliance with law (Sec. 7(d)) |
| Verify business and excise licence details during onboarding | Business and licence details | Consent / Sec. 7(a) |
| Security, fraud prevention, troubleshooting, audit logs | Usage and technical | Consent; compliance with law, including log retention under the DPDP Rules |
| Service notices — outages, updates, policy changes, payment reminders | Contact | Consent / Sec. 7(a) |
| Improve the Services using aggregated or de-identified analytics | Usage and technical | Consent |
| Marketing — newsletters, product announcements, offers, events | Contact, marketing preferences | Separate, optional consent. You may opt out at any time. |
| Comply with law, court orders and requests from authorities | Any, as required | Compliance with law (Sec. 7(d)–(e)) |
We will not use your personal data for a purpose that is materially different from the above without telling you and, where required, asking for fresh consent.
5. Consent and how to withdraw it
Where we rely on consent, it will be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action such as ticking an unticked box or clicking “I agree”. We will present this notice in clear, plain language, and on request in English or any language listed in the Eighth Schedule to the Constitution of India.
Withdrawing consent. You may withdraw consent at any time, as easily as you gave it, by:
- using [Settings → Privacy] in the platform, or the unsubscribe link in any marketing email;
- writing to [privacy@carture.in]; or
- through a Consent Manager registered with the Data Protection Board of India, once that facility is available.
After withdrawal, we will stop processing the relevant data within a reasonable time and ask our processors to do the same, unless the law requires or permits us to keep it. Withdrawal does not affect processing already carried out.
Some data is essential to run your account. If you withdraw consent for it, we may be unable to continue the Services; we will tell you this before acting on the withdrawal. The consequences for your subscription are covered in our Terms & Conditions and Refund & Cancellation Policy.
6. Who we share data with
We do not sell personal data. We share it only as described below, and only to the extent needed.
| Recipient | Why | Safeguard |
|---|---|---|
| Cloud hosting and infrastructure providers | Host and back up the platform | Contract requiring confidentiality and security |
| Payment gateways and banks | Process subscription payments and refunds | They act under their own RBI-regulated obligations |
| Communication providers (SMS, email, WhatsApp Business) | Send OTPs, alerts, reports and service notices | Contract; data limited to what is needed to send the message |
| Support, CRM and analytics tools | Manage tickets and understand product usage | Contract; analytics de-identified where possible |
| Professional advisers — auditors, lawyers, accountants | Audit, legal and tax compliance | Professional confidentiality duties |
| Government, regulators, courts, law-enforcement | When required by law or a lawful order | Disclosure limited to what the order requires |
| A buyer or successor entity | Merger, acquisition or restructuring | The successor must honour this policy |
Our current list of sub-processors is available at [link] and on request. We engage every processor under a written contract, as required by Section 8(2) of the DPDP Act, and remain responsible for their processing of data on our behalf.
Transfers outside India. Our primary hosting is in [India — region]. Some service providers may process data outside India. We will transfer personal data outside India only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and in line with any conditions under the DPDP Rules.
7. How long we keep data
We keep personal data only as long as the purpose requires or the law obliges, then erase it or irreversibly de-identify it.
| Data | Retention period |
|---|---|
| Account and Authorized User data | Life of the subscription, plus [90] days for data export and account closure |
| Billing records and invoices | [8] years, to meet GST and Companies Act record-keeping requirements |
| Security logs, traffic data and access logs | At least 1 year, as required by the DPDP Rules, and up to [2] years |
| Support tickets and communications | [3] years from closure of the ticket |
| Leads and demo requests that did not convert | [24] months from last interaction, or earlier if you ask |
| Marketing preferences | Until you withdraw consent, plus a suppression record so we do not contact you again |
| Customer Data (we are Data Processor) | As instructed by the customer; deleted within [90] days of termination unless the customer asks for earlier deletion or the law requires retention |
Where personal data is to be erased because its purpose is over, we will, where the DPDP Rules require it, notify you at least 48 hours before erasure so that you can log in or contact us if you wish to keep it.
Backups are overwritten on a rolling [30]-day cycle, so deleted data may remain in backups until that cycle completes.
8. Security and breach notification
We take reasonable security safeguards, as required by Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, including:
- encryption of data in transit (TLS) and at rest [confirm], and encryption or masking of passwords and OTPs;
- role-based access controls, so each Authorized User sees only what their role needs;
- logical separation of each customer’s data;
- access logging and monitoring to detect and investigate unauthorised access;
- regular backups to support continuity of processing;
- written security and confidentiality obligations on our employees and processors.
No system is perfectly secure. You are responsible for keeping your login credentials confidential and for controlling which of your staff have access.
If a personal data breach occurs, we will:
- inform the Data Protection Board of India without delay, followed by a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows);
- inform affected Data Principals without delay through their registered email, mobile or account, describing what happened, the likely consequences, what we are doing about it, the steps you can take to protect yourself, and whom to contact;
- where we are the Data Processor, notify the affected customer promptly so it can meet its own notification duties, and assist it with information we hold.
We will also report incidents to CERT-In where the law requires it.
9. Your rights as a Data Principal
Where Carture is the Data Fiduciary, you have the following rights under the DPDP Act:
| Right | What it means |
|---|---|
| Access (Sec. 11) | A summary of the personal data we hold about you and how we process it, and the identities of Data Fiduciaries and Processors we have shared it with |
| Correction, completion and updating (Sec. 12) | Fix inaccurate or incomplete data, or update it |
| Erasure (Sec. 12) | Have data erased once it is no longer needed, unless the law requires us to keep it |
| Withdraw consent (Sec. 6) | Stop processing based on consent, as described in Section 5 |
| Grievance redressal (Sec. 13) | Complain to us and receive a response; escalate to the Data Protection Board of India if unsatisfied |
| Nomination (Sec. 14) | Nominate a person to exercise your rights if you die or become incapable |
How to exercise them. Write to [privacy@carture.in] or use [Settings → Privacy]. We may ask you to verify your identity before acting. We will acknowledge your request within [7] days and resolve it within [30] days, and in any case within the 90-day maximum period set by the DPDP Rules.
If your request concerns Customer Data held by a retail business that uses Carture, we will forward it to that business and help it respond.
Your duties. Under Section 15 of the DPDP Act, you must not impersonate another person, suppress material information, provide false particulars, or file false or frivolous complaints. Breach of these duties can attract a penalty of up to ₹10,000.
10. Children, cookies and changes
Children. The Services are for licensed businesses in the alcohol retail sector and are not intended for anyone under 18. We do not knowingly process the personal data of children. If we learn that we have, we will delete it, unless verifiable parental consent has been obtained as required by Section 9 of the DPDP Act.
Cookies. Our website uses essential cookies to make it work and, with your consent, analytics and marketing cookies. You can accept or reject non-essential cookies through our cookie banner and change your choice at any time. The platform itself uses only session and security cookies needed to keep you logged in.
Changes to this policy. We may update this policy to reflect changes in law or in our Services. For material changes, we will notify Authorized Users by email or in-app notice at least [15] days before the change takes effect and, where the change requires it, seek fresh consent.
11. Grievance Officer and contact
For questions, rights requests or complaints about your personal data, contact:
Grievance Officer: [Name], [Designation]
[Carture Legal Entity Name], [Registered Address]
Email: [privacy@carture.in] · Phone: [+91 XXXXX XXXXX]
Hours: [Monday–Friday, 10:00–18:00 IST]
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India through its online portal, after first using our grievance process.