Privacy Policy — Sagarsan Services

1. Who is the data fiduciary

SAGARSAN SERVICES PRIVATE LIMITED, with GSTIN 23ABOCS9008G1Z6 and registered office at Ground Floor, 112, Shanti Nagar, Rajiv Gandhi Ward, Jabalpur, Madhya Pradesh - 482002, is the data fiduciary for personal data collected through https://sagarsan.com and through our engagements. This policy is intended to be consistent with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, including the Reasonable Security Practices Rules, 2011.

2. What we collect

We collect only the personal data we need, and we are explicit about what we ask for:

Contact form data — name, email, phone, company, service interest, and the message you send us.
Order and payment data — name, email, mobile, company, billing and GST details, order reference, amount, and payment status. Actual card or UPI credentials are never stored by us; they are handled by our payment gateway under their own PCI-compliant infrastructure.
Technical data — IP address, browser user agent, device type, and pages visited, collected through server logs and Google Analytics 4 for security and analytics purposes.
Cookies — session cookies required for login and checkout, and analytics cookies from Google Analytics. You can disable cookies via your browser settings, though some site features may then not function correctly.

3. Why we collect it (purpose)

We process your personal data for the following purposes only:

To respond to your enquiries and support requests.
To process orders, accept payments, and issue invoices.
To deliver services under an engagement (for example, accessing systems you grant us access to).
To meet legal, tax, and regulatory obligations (such as GST compliance and bookkeeping).
To improve the website and security posture of our systems.
To send transactional emails (order confirmations, payment receipts, service updates). We do not send marketing emails unless you explicitly opt in.

4. Legal basis & consent

We rely on your consent (when you voluntarily submit a form, create an order, or book a service), on the performance of a contract (for delivering services you have paid for), and on legitimate interest (for site security and fraud prevention), as appropriate under applicable law. Where we rely on consent, you may withdraw it at any time by writing to us.

5. Who we share it with

We do not sell personal data. We share it only with:

Payment gateway providers for processing your UPI payments (order identifier, amount, your name, email, and mobile only).
Email service providers (Hostinger SMTP) for delivering transactional emails.
Hosting and analytics providers (Hostinger, Cloudflare where applicable, Google Analytics) for hosting our website and measuring usage.
Tax authorities and regulators where required by applicable law.

We bind these providers contractually to use your data only for the specific purpose we engaged them for.

6. How long we retain it

Order and invoice data is retained for eight (8) financial years to meet tax and audit obligations under Indian law. Contact form submissions are retained for up to 36 months unless you request earlier deletion. Server logs are rotated every 30 to 90 days depending on volume.

7. How we protect it

We use HTTPS for all website traffic, bcrypt for admin password hashing, parameterised database queries to prevent injection, server-side session cookies marked HttpOnly and Secure, and role-based access to our admin panel. Backups are encrypted at rest. No system is perfectly secure, but we treat data protection as a standard, not an afterthought.

8. Your rights

Under applicable Indian law, including the DPDP Act, you have the right to:

Request a copy of the personal data we hold about you.
Request correction of inaccurate data.
Request erasure of data we are no longer legally required to keep.
Withdraw consent for any processing based on consent.
Nominate another person to exercise your rights in case of death or incapacity.
Raise a grievance with our Grievance Officer and, if unresolved, approach the Data Protection Board of India.

9. Children

Our services are intended for businesses and working professionals. We do not knowingly collect personal data from children under 18. If you believe a child has submitted personal data to us, write to our Grievance Officer and we will delete it promptly.

10. Cross-border transfer

Data is stored primarily on Indian infrastructure. Some providers (for example, Google Analytics) may process aggregated technical data on servers outside India; such transfers are governed by the providers' own terms and by applicable Indian law.

11. Grievance Officer

As required under Indian law, our designated Grievance Officer is:

Sandeep
SAGARSAN SERVICES PRIVATE LIMITED
Ground Floor, 112, Shanti Nagar, Rajiv Gandhi Ward, Jabalpur, Madhya Pradesh - 482002
Email: info@sagarsan.com
Phone: +91 7400767511

We acknowledge grievances within 48 hours and close them within 30 days.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the version in force. Material changes will be highlighted on the homepage for at least 30 days.