Privacy Notice

This notice applies to everyone who visits Sellveera, buys a service (with or without an account), creates an account, contacts us or signs up for our newsletter. It is written in line with the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the rules made under it.

The Act uses two terms worth knowing. You are the Data Principal: the person the data is about. We are the Data Fiduciary: the business that decides why and how your data is used, and that is responsible for looking after it.

It does not cover websites we link to, or systems that belong to you that we work inside while delivering a service. Section 7 explains that case.

The Data Fiduciary is SELLVERA TECHNOLOGIES PRIVATE LIMITED, 1st Floor, 962/171, Papareddypalya, Nagarbhavi, Bengaluru, Bengaluru Urban, Karnataka, 560072., which operates Sellveera.

Requests and complaints about personal data go to the Grievance Officer in section 17. One person owns each request from the moment it arrives.

We collect only what we need, from four places, plus basic technical data.

When you check out

• Your name, email address and mobile number.
• Billing details: address, city, state, PIN code and, if you give them, your business name and GSTIN, so that we can raise a correct tax invoice.
• What you tell us about the work: your website or product link, your requirements and any notes, plus the items listed under “What we need from you” that you send later from your order.
• Order records: the services bought, amounts, GST, any discount code, the order number, payment status and the payment reference from the gateway.

When you create or use an account

• Your name, email address and mobile number, and any saved billing details.
• Your password, stored only as a one-way hash. We cannot read it, and nor could anyone who obtained the database.
• Your orders are linked to your account by email address, which is why orders placed as a guest appear once you sign in with the same email.

When you contact us

• Your name, email address, optional phone number, the subject and your message, plus our replies.

When you join the newsletter

• Your email address and the fact that you asked to receive our updates.

When you use the site

• Technical data in our server logs, such as IP address, browser type, pages requested and the time of the request.
• Analytics data, only if analytics is switched on (see section 12).

We do not ask for Aadhaar, PAN or similar identifiers unless a specific legal requirement makes it unavoidable, and we would tell you why at the time.

Payments are made by UPI through our payment gateway partner. The payment itself happens with the gateway and your UPI app or bank.

• We never collect or store your UPI PIN, card numbers, CVV or net banking passwords.
• We share with the gateway only what it needs to take the payment: the amount, the order reference and your name and contact details.
• The gateway tells us whether the payment succeeded and gives us a transaction reference, which we keep with your order for reconciliation, refunds and tax records.

Each purpose below is specific. We do not quietly reuse data collected for one purpose for another.

We do not build advertising profiles, we do not run retargeting, and we do not sell, rent or trade personal data.

We rely on two grounds under the DPDP Act.

• Consent, given when you submit a form, place an order, create an account or sign up for the newsletter. Each form says what the data is for.
• Legitimate uses allowed by the Act, such as meeting legal obligations like keeping tax records.

You can withdraw consent at any time, as easily as you gave it, by writing to Shaik Aslam Basha and Chakali Naga Phani Kumar, our Grievance Officer, at grievance@sellveera.com. Withdrawal stops future processing. It does not undo processing already done lawfully, and it does not remove records the law requires us to keep. If withdrawing would stop us completing a service you have paid for, we will tell you before acting.

Newsletter consent is separate from everything else. Declining it never affects an order, and every newsletter email lets you unsubscribe.

Two different roles apply, and it matters which one we are in.

• Your details, held by us. For checkout, account, order and contact data, we are the Data Fiduciary. The rest of this notice describes that.
• Your customers’ data, in your systems. When a service takes us into your website, database or accounts, you remain the Data Fiduciary for your customers’ data and we act only on your documented instructions. We agree in writing, before work starts, how that data will be protected, accessed and deleted.

Our working rule is that we would rather not see your customers’ personal data at all. We ask for anonymised, masked or sample data by default, and where live access is unavoidable it is limited, logged and removed at delivery.

Personal data goes to service providers who help us run the business, only for the purpose named and under contracts that require them to protect it. We list them by type rather than by name, because a provider can change while the purpose and safeguards stay the same.

Beyond these, data may go to our accountants and auditors for statutory filings, and to a government body, court or law enforcement agency where a valid legal demand requires it. In that case we ask for the demand in writing, disclose only what is required and tell you unless we are not allowed to.

No provider may use your data for its own purposes.

Some of our providers, such as email delivery or analytics, may process data on servers outside India. Where that happens, we transfer only what the purpose needs, only to countries not restricted by the Government of India under the DPDP Act, and only to providers contractually required to protect it to the standard in this notice.

We keep data only as long as its purpose needs or the law requires, then delete it or make it permanently anonymous.

If you ask for erasure, we delete everything not covered by a legal obligation in the table and tell you what had to stay and why.

• The whole site is served over HTTPS, so data in transit is encrypted.
• Passwords are stored as salted one-way hashes and cannot be recovered, including by us.
• Payment details never touch our servers.
• Administrative access uses individual accounts, and access to customer data is limited to people who need it.
• Forms are protected against cross-site request forgery, and access you give us for a service is time-limited and removed at delivery.

No system is perfectly secure, and we will not pretend otherwise. If you find a weakness in this site, please tell us at info@sellveera.com and we will act on it quickly.

• Your basket is saved in your own browser’s local storage, not on our servers, until you check out. Clearing your browser data empties it, and no one else can read it.
• A session cookie keeps you signed in and protects forms against forgery. The site cannot work without it, so it does not need consent. It expires when your session ends.
• Analytics cookies are used only if we switch analytics on, to count visits and find broken pages. Analytics is currently switched on. The data is pseudonymous and used only in aggregate.

We do not use advertising or tracking cookies. You can block or clear cookies and site data in your browser settings at any time; if you block the session cookie, signing in and checkout will not work.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you, what we do with it and which types of provider have received it.
• Correct and update anything inaccurate, incomplete or out of date. Much of this you can do yourself in your account profile.
• Erase data we no longer need, subject to the legal retention periods in section 10.
• Withdraw consent for anything that relies on consent, as easily as you gave it.
• Nominate someone to exercise these rights for you if you die or become unable to do so.
• Grievance redressal: an accessible way to complain to us, answered within a published time, before you need to go elsewhere.

The Act also asks you to give accurate details, not to impersonate anyone and not to file false or frivolous complaints.

How to use a right. Write to Shaik Aslam Basha and Chakali Naga Phani Kumar, our Grievance Officer, at grievance@sellveera.com from the email address on your account or order, saying which right you are using. You can also use our contact form. We may ask a question or two to confirm it is you. We respond within 30 days, and if a request genuinely needs longer, we tell you why and when within those 30 days. There is no charge.

Our services are for businesses and adults, and this site is not directed at children. We do not knowingly collect personal data from anyone under 18, and we never track, profile or target advertising at children.

If you believe a child has given us personal data, tell us and we will delete it promptly. Where data about a child or a person with a lawful guardian is genuinely needed, verifiable consent from a parent or guardian must be obtained first, as the DPDP Act requires.

If a personal data breach happens, we act immediately to contain it and notify the Data Protection Board of India and everyone affected, in the form and within the time the DPDP Act and its rules require.

Our notice to you will say in plain language what happened, what data was involved, the likely consequences, what we have done and what you can do to protect yourself.

We update this notice when our processing or the law changes. The date at the top always shows the current version. Where a change needs fresh consent, we will ask for it rather than assume it. Earlier versions are available on request.

For any privacy question, data request or complaint:

• Grievance Officer, Shaik Aslam Basha and Chakali Naga Phani Kumar: grievance@sellveera.com · 9550574837
• General support: info@sellveera.com
• By post: 1st Floor, 962/171, Papareddypalya, Nagarbhavi, Bengaluru, Bengaluru Urban, Karnataka, 560072.

Complaints are acknowledged within 48 hours and answered in full within 15 days; data requests within 30 days. The full escalation route is on our grievance page.

If our answer does not satisfy you, you may complain to the Data Protection Board of India after first raising the matter with our Grievance Officer. This notice is governed by the laws of India.