This Data Handling & Data Protection Policy (“Policy”) describes how Rokad Retail Ventures Pvt. Ltd. (“Rokad”, “Company”, “we”, “our”, or “us”) collects, processes, stores, protects, and uses personal and business-related data in compliance with applicable laws of India and, where applicable, international data protection principles.

Rokad is committed to ensuring transparency, security, purpose limitation, and lawful processing of data entrusted to us.

---

1. Company & Data Fiduciary Details

• Legal Entity Name: Rokad Retail Ventures Pvt. Ltd.
• Role under Indian Law: Data Fiduciary
• Registered / Communication Address: 808, Mahabir Tower, Main Road, Ranchi, Jharkhand – 834001, India
• Data Protection & Privacy Contact: 📧 data-handing@rokad.co

---

2. Legal Framework Governing This Policy

This Policy is framed in accordance with, and governed by, the following Indian laws and regulations:

1. Information Technology Act, 2000
2. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
3. Digital Personal Data Protection Act, 2023 (“DPDP Act”)
4. Applicable rules, notifications, circulars, and amendments issued thereunder

Where required due to the location of users, internationally recognised data protection principles (such as consent, transparency, and data minimisation) are also observed.

In case of any conflict, statutory provisions shall prevail.

---

3. Scope & Applicability

This Policy applies to all individuals and entities (“Data Principals”) who:

• Visit or use Rokad’s website or digital platforms
• Submit information via forms, emails, or other communication channels
• Subscribe to newsletters or marketing communications
• Engage with Rokad as customers, suppliers, partners, or prospects

This Policy does not apply to third-party websites or platforms linked from Rokad’s website, which are governed by their respective privacy practices.

---

4. Categories of Data Collected

4.1 Personal Data

• Name
• Email address
• Phone number (if voluntarily provided)
• Professional designation
• Communication preferences

4.2 Business & Commercial Data

• Business name and details
• Industry information
• Enquiry-related information
• Messages, documents, or information voluntarily submitted

4.3 Communication Data

• Emails, messages, and form submissions
• Newsletter subscriptions and preferences
• Feedback or responses

4.4 Technical & Usage Data

• IP address (processed in an anonymized or truncated form where supported)
• Browser type, operating system, and device information
• Access logs
• Pages visited, interaction data, and usage metrics collected through analytics tools

Rokad does not intentionally collect Sensitive Personal Data such as financial details, biometric data, health data, passwords, or government-issued identifiers unless explicitly required under a lawful obligation.

---

5. Modes of Data Collection

Data is collected through:

• Website forms (powered by Tally.so)
• Direct email communications
• Newsletter sign-ups
• Business communications
• Automated technical logs and analytics systems

All data is collected lawfully, fairly, and with user consent where required.

---

6. Technology Stack & Infrastructure

Rokad uses the following platforms strictly for internal operations:

• Strapi – Content Management System (CMS)
• Vercel – Website hosting and deployment infrastructure
• GitHub – Source code repository and access-controlled version management
• Tally.so – Secure form data collection
• Google Analytics – Used to understand website usage in an aggregated and anonymized manner

These services act as data processors and process data only on Rokad’s instructions, without independent rights over such data.

---

7. Purpose Limitation & Lawful Use

Collected data is used strictly for the following purposes:

• Responding to enquiries and communications
• Providing requested information, services, or support
• Sending newsletters, updates, and business communications (where opted in)
• Personalising email communications
• Internal analytics, reporting, and website improvement
• Ensuring platform security and preventing misuse
• Compliance with legal, regulatory, or contractual obligations

Data is not used for purposes beyond those stated without additional consent.

---

8. Consent & Lawful Basis

Under the DPDP Act, 2023 and applicable principles:

• Consent is obtained explicitly or implicitly through user actions (e.g., form submissions, newsletter opt-ins)
• Analytics cookies are not enabled by default and are activated only after explicit user consent via the website’s cookie consent mechanism
• Consent is free, informed, specific, and unambiguous
• Users may withdraw consent at any time by contacting Rokad or using available consent controls

Withdrawal of consent may limit certain services or functionalities.

---

9. Data Sharing & Disclosure

• Rokad does not sell, lease, or trade personal or business data

• Data remains strictly for Rokad’s internal use

• Data is not shared with third parties for independent marketing or commercial purposes

• Disclosure may occur only where:

  • Required by law, court order, or government authority
  • Necessary to protect Rokad’s legal rights or prevent fraud
  • Required for internal processors under strict confidentiality and data protection obligations

---

10. Data Retention Policy

Data is retained only for as long as necessary to:

• Fulfil the purpose for which it was collected
• Meet statutory, legal, or contractual obligations
• Resolve disputes or enforce agreements

Upon completion of retention requirements, data is securely deleted, anonymized, or irreversibly de-identified.

---

11. Data Security & Safeguards

Rokad implements reasonable security practices as required under Indian law, including:

• Secure hosting environments
• Access control and role-based permissions
• Authentication mechanisms
• Encryption where applicable
• Restricted internal access
• Periodic security and compliance reviews

Despite best efforts, no digital system is completely immune to security risks.

---

12. Rights of Data Principals

Subject to applicable law, Data Principals have the right to:

• Access personal data held by Rokad
• Request correction or updating of inaccurate data
• Request erasure of personal data (where legally permissible)
• Withdraw consent for communications or analytics
• Seek grievance redressal

Requests may be submitted to data-handing@rokad.co.

---

13. Grievance Redressal

In accordance with Indian law, grievances related to data handling may be addressed to:

📧 data-handing@rokad.co ⏳ Response timeline: Within a reasonable period, as prescribed by law

---

14. Cookies & Tracking Technologies

Rokad uses cookies and similar technologies to:

• Ensure essential website functionality
• Analyse website usage and performance

Analytics cookies are deployed only after user consent and collect aggregated and anonymized usage data. No directly identifiable personal information (such as names or email addresses) is collected through analytics cookies.

Users may manage or withdraw cookie consent through the website’s cookie settings or browser controls.

---

15. Children’s Data

Rokad does not knowingly collect personal data from individuals under 18 years of age. If such data is identified, it will be deleted without undue delay.

---

16. Cross-Border Data Transfer

Where data is processed or accessed outside India due to infrastructure or service providers, such processing is conducted with appropriate safeguards and in compliance with applicable Indian laws and recognized data protection standards.

---

17. Policy Updates & Amendments

Rokad reserves the right to update this Policy to reflect:

• Legal or regulatory changes
• Technological advancements
• Business or operational changes

Updates will be published on the website and become effective from the date stated therein.

---

18. Governing Law & Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Courts at Ranchi, Jharkhand shall have exclusive jurisdiction.