Privacy Policy

Who we are

This policy is issued by OrderPin. We run OrderPin, a business-to-business ordering platform for our trade customers and our own team. It is made up of a web portal, the OrderPin mobile app.

The OrderPin app is developed and published on Google Play by Absolin Digital, which builds and maintains the app and the software behind it for OrderPin. Where Absolin Digital handles personal data in doing so, it acts only on our instructions; OrderPin remains responsible for your data.

For the personal data described here, OrderPin is the data fiduciary under India's Digital Personal Data Protection Act, 2023: we decide why and how it is processed. Absolin Digital and the service providers listed below process it on our behalf.

OrderPin is meant for businesses and the people who act for them: distributors, retailers, agents, sales executives and our staff. It is not a consumer shopping service.

What we collect

Most of this comes from you or from the person who sets up your account with us.

How we use it

• To create and secure your account, and to sign you in (including by one-time password).
• To show you our catalogue and your prices, and to take, price, approve, invoice, dispatch and deliver your orders.
• To manage credit, outstanding balances, payments, receipts, returns and credit notes.
• To send you order updates, approval requests, payment reminders and other service messages by SMS, email, push or in-app notification.
• To issue tax invoices and keep the records required by GST and other laws.
• To keep the service secure: detecting misuse, investigating problems, and keeping an audit trail of changes.
• To provide support and to improve how the service works.

We do not sell personal data, and we do not use it for advertising or to build marketing profiles.

Why we may use it

We process personal data with your consent, which you give when you register or use the service, and for the legitimate uses the DPDP Act allows. These include performing the service you asked for, complying with the law (for example, keeping tax records), and responding to legal claims. Where we rely on consent, you can withdraw it — see Your rights. Withdrawing it may mean we can no longer take orders from you through OrderPin.

Who we share it with

We share personal data only as needed to run the service:

• Within OrderPin, with the people who handle your account: sales, approvals, credit, dispatch and accounts. Each sees only what their role allows.
• Your distributor, agent or sales executive, where your account is linked to one, so they can place and approve your orders.
• Service providers who process data for us under contract, including:
  • Absolin Digital, which develops, maintains and supports the OrderPin app and platform;
  • cloud hosting, database and file storage providers;
  • Google Firebase Cloud Messaging, for push notifications to the mobile app;
  • SMS and email delivery providers;
  • payment gateways, for online payments;
• Authorities, when the law requires it — for example, tax authorities or a court order.
• A successor business, if OrderPin is merged or sold, under the same protections.

The OrderPin app's permissions

• Notifications — to tell you about orders, approvals and payments. You can turn them off in your phone's settings.
• Camera and photos — only when you choose to attach a photo to a delivery confirmation or a return.
• Internet access — to connect to our servers.

Sign-in tokens are kept in your phone's secure storage and removed when you sign out.

How long we keep it

• Account and business details: while your account is active, and for a reasonable period after it is closed.
• Orders, invoices, payments and other accounting records: for as long as tax law requires. Under the GST law this is at least 72 months after the due date of the annual return for the year concerned, and longer if a proceeding is pending.
• Activity and audit logs: kept for 365 days, then deleted.
• Messages and notifications: for as long as they are useful to the service, then deleted.

When data is no longer needed, we delete it or make it anonymous.

How we protect it

• All connections to the portal, the app and our servers are encrypted (HTTPS).
• Access is controlled by role, so people see only what their job needs. Sign-in sessions expire and are refreshed securely.
• Passwords and one-time passwords are stored only as secure hashes; payment-gateway credentials are encrypted.
• Important changes are recorded in an audit trail.
• Incoming payment notifications are cryptographically verified before we act on them.

No system is perfectly secure. If a breach affecting your data occurs, we will inform you and the Data Protection Board of India as the law requires.

Your rights

Under the DPDP Act, 2023, you may:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it — we will, unless the law requires us to keep it (for example, tax records);
• withdraw consent you have given;
• nominate someone to exercise these rights for you in case of death or incapacity;
• raise a grievance with us, and, if you are not satisfied with our response, with the Data Protection Board of India.

To use any of these rights, write to us at the contact below. We may need to confirm your identity before acting on a request.

Where it is processed

Our data is hosted with cloud providers in India. Some service providers — for example, Google for push notifications — may process data outside India. Any such transfer complies with the DPDP Act and with any restrictions the Government of India places on it.

Children

OrderPin is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy as the service or the law changes. The date at the top shows when it last changed. If a change is significant, we will tell you in the app, the portal or by message before it takes effect.

Contact us