Privacy Policy

1. Introduction and Scope

M/s Madanlal Narayan, trading as Nivrá by Porwals (“Company”, “we”, “us”, “our”), respects the privacy of individuals whose personal data we process in the course of our wholesale trade — including business contacts at buyer companies, website visitors, vendors, and employees or applicants.

This Policy explains what personal data we collect, why we collect it, and the rights available to individuals under the EU/UK General Data Protection Regulation (“GDPR”) and India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), as applicable.

• This Policy applies to personal data processed via our website, email and telephone correspondence, purchase orders, and related business communications.
• As a B2B wholesale business, we do not knowingly collect personal data from consumers for retail transactions. Data collected relates primarily to representatives of our business buyers, suppliers, and site visitors.

2. Who We Are — Controller / Data Fiduciary

For the purposes of the GDPR, M/s Madanlal Narayan acts as the data controller. For the purposes of the DPDP Act, M/s Madanlal Narayan acts as the Data Fiduciary in respect of the personal data described in this Policy.

3. Personal Data We Collect

We collect the following categories of personal data:

1. Business contact data — name, job title, company name, business email, phone or WhatsApp number, business address.
2. Transactional data — purchase order details, billing and shipping addresses, bank or payment references (processed via payment providers; we do not store full card details), and tax/GST identifiers.
3. Website and technical data — IP address, browser type, device identifiers, pages visited and referral source, where such data is generated by your visit.
4. Communications data — emails, enquiry-form submissions, and WhatsApp or call records relating to orders and support.
5. Vendor and supplier contact data — for weavers, artisans and supply-chain partners we engage with directly.

4. How We Collect Personal Data

• Directly from you — when you enquire, register as a buyer, place a purchase order, or correspond with us.
• Automatically — through standard web server and third-party resource logs when you visit our website.
• From third parties — payment processors, logistics partners, and publicly available business directories such as trade platform listings, where relevant.

5. Purpose of Processing and Legal Basis

We process personal data for the following purposes, relying on the legal bases indicated under GDPR Article 6 and the corresponding grounds under the DPDP Act:

1. Performance of a contract — processing order, billing and shipping data to fulfil a wholesale purchase order. GDPR Art. 6(1)(b); under the DPDP Act, processing for the specified purpose for which data was voluntarily provided.
2. Legitimate interests — business development, trade-fair follow-up, fraud prevention and website analytics, balanced against your rights. GDPR Art. 6(1)(f).
3. Consent — marketing communications such as catalogue updates and new-collection announcements, and any non-essential cookies, where consent is sought and can be withdrawn at any time. GDPR Art. 6(1)(a); under the DPDP Act, consent as the general basis, subject to the “legitimate uses” exceptions under Section 7.
4. Legal obligation — retaining records for tax, customs, export documentation and accounting purposes as required under Indian and applicable foreign law. GDPR Art. 6(1)(c).

6. Cookies and Website Analytics

Our website loads a small number of third-party resources — web fonts and a JavaScript library — from external content delivery networks. Those providers may log your IP address and browser information as part of serving those files. We do not receive or store that data.

If we introduce analytics or marketing cookies in future, non-essential cookies will be set only with your consent, obtainable and withdrawable through a cookie banner, and this Policy will be updated with a detailed cookie notice listing each cookie's name, purpose, duration and provider.

7. Sharing of Personal Data

We share personal data only as necessary, with:

• Logistics and freight partners, for shipment and customs documentation.
• Payment processors and banks, for transaction processing.
• IT and hosting service providers, for operating our website and business systems. This includes the third-party form service that delivers enquiries submitted through our website to our inbox.
• Professional advisers such as accountants, auditors and legal counsel, as required.
• Regulators, customs and tax authorities, where legally required.

We do not sell personal data to third parties.

8. International Data Transfers

Under the GDPR

As we are based in India, transfers of personal data from the EU or UK to India constitute a cross-border transfer. Since India does not currently hold a European Commission adequacy decision, such transfers are made subject to appropriate safeguards — principally the European Commission's Standard Contractual Clauses incorporated into our contracts with EU and UK counterparties, supplemented by a transfer impact assessment where required.

Under the DPDP Act

Section 16 of the DPDP Act permits cross-border transfer of personal data by default, except to countries specifically restricted by the Central Government by notification. We will comply with any such restriction list as and when notified.

9. Data Retention

• Transactional and tax-related records are retained for the period mandated under applicable Indian tax, customs and company law — typically seven to eight years.
• Business contact data is retained for as long as the business relationship subsists, plus a reasonable period thereafter for legitimate business or legal purposes, or until deletion is requested and no legal ground for retention exists.
• Website analytics data, where any is collected, is retained per the retention settings of the tool in use, generally not exceeding 26 months.

10. Data Security

• Access to personal data is restricted to personnel with a legitimate business need.
• Payment data is processed via PCI-DSS-compliant third-party payment gateways. We do not store full card numbers.
• We apply reasonable technical and organisational measures — including access controls and encrypted transmission where applicable — appropriate to the nature of the data processed, consistent with the reasonable security safeguards required under Indian law (including the Information Technology Act, 2000 and the SPDI Rules, 2011, alongside the DPDP Act) and GDPR Article 32.

11. Rights of Individuals in the EU/UK

Subject to applicable conditions and exemptions, individuals in the EU and UK have the right to:

• Access the personal data we hold about them.
• Rectify inaccurate or incomplete data.
• Erase their data (the “right to be forgotten”), subject to legal retention obligations.
• Restrict or object to certain processing, including direct marketing.
• Data portability, for data processed by automated means under a contract or consent.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with their relevant supervisory authority, such as the Irish Data Protection Commission or the UK Information Commissioner's Office, depending on their location.

12. Rights of Data Principals in India

Individuals whose personal data we process as a Data Fiduciary under the DPDP Act (“Data Principals”) have the right to:

• Obtain a summary of personal data processed and the processing activities undertaken — right to access information, Section 11.
• Seek correction, completion, updating and erasure of personal data — Section 12, subject to retention required by law.
• Have readily available means to register a grievance with the Company's Grievance Officer, with a response expected within the timeline prescribed under the Act and Rules — Section 13.
• Nominate another individual to exercise these rights in the event of death or incapacity — Section 14.
• Withdraw consent at any time where processing is based on consent, with withdrawal being as easy as giving consent — Section 6.

Requests may be sent to our Grievance Officer using the contact details in Section 2. We will verify the identity of the requestor before actioning a request.

13. Children's Data

Our services are directed at business buyers and are not intended for individuals under the age of 18. We do not knowingly collect personal data relating to children. Should we become aware of any such data, it will be deleted promptly, consistent with Section 9 of the DPDP Act on the processing of children's personal data.

14. Data Breach Notification

• In the event of a personal data breach likely to result in a risk to individuals, we will notify the relevant supervisory authority and affected individuals as required under GDPR Articles 33 and 34, where EU or UK data is involved.
• Under the DPDP Act, we will notify the Data Protection Board of India and affected Data Principals of any personal data breach, in the manner and form prescribed under the Act and Rules — Section 8(6).

15. Changes to This Policy

We may update this Policy periodically to reflect changes in our practices or legal requirements, including forthcoming DPDP Act Rules and Data Protection Board guidance. The effective date at the top of this page will be revised accordingly. Material changes will be communicated to registered buyers by email where appropriate.