Privacy Policy & Data Protection

1. Statutory Commitment & Scope

DUSTWON PRIVATE LIMITED ("Dustwon", "we", "us", "our") is committed to protecting the confidentiality, integrity, and privacy of personal data entrusted to us by our clients, website visitors, and business partners. This Privacy Policy outlines our data governance framework in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Dustwon acts as a Data Fiduciary with respect to information collected directly through our enterprise portal, website, and commercial contracts, and as a Data Processor when hosting or maintaining software applications containing end-user data on behalf of our enterprise clients.

2. Categories of Personal Data Collected

We collect and process only such personal data as is reasonably necessary to fulfill legitimate commercial, contractual, and technical obligations:

• Identity & Contact Data: Name, official designation, organization name, registered office address, email address, mobile number, and identity verification records (such as PAN, GSTIN, or CIN);
• Domain Registration & WHOIS Data: Registrant, administrative, and technical contact details required by ICANN, registry operators (e.g., VeriSign, Public Interest Registry, NIXI/.IN Registry), and our upstream registrar partner (Dynadot LLC);
• Billing & Commercial Transaction Data: Invoicing history, milestone schedules, payment references, transaction IDs (UTR/TXNID), GST breakdown, and tax compliance data;
• Technical & Telemetry Data: IP addresses, browser specifications, operating system telemetry, session timestamps, and authentication audit logs recorded for platform cybersecurity;
• Customer Support Records: Ticket correspondence, chat transcripts, and bug report attachments submitted to our support desk.

3. Purpose & Lawful Grounds of Processing

Under Section 4 and Section 7 of the DPDP Act 2023, we process personal data under the lawful grounds of consent and for certain legitimate commercial uses, including:

• Executing and fulfilling Master Service Agreements, Quotations, and Proposals;
• Registering, renewing, and administering domain names with global registries;
• Generating statutory GST tax invoices and accounting records required under Indian fiscal law;
• Authenticating client portal access and preventing unauthorized system breaches;
• Sending critical transactional notices (e.g., OTP authentications, invoice due dates, domain expiration drop alerts, support ticket responses).

4. Payment Gateway Security & Financial Data Isolation

We do NOT store or process complete credit card numbers, debit card numbers, CVVs, or UPI PINs on our application servers. All online monetary transactions are handled directly through authorized, PCI-DSS compliant third-party payment gateways (e.g., Easebuzz, Razorpay, PhonePe) utilizing end-to-end 256-bit TLS cryptographic encryption. Our systems only record the gateway transaction status, payment mode, and unique transaction reference (UTR) for reconciliation.

5. Third-Party Disclosures & Data Processors

We never sell, rent, or trade your personal data to marketing brokers. We share personal data only with trusted entities under strict confidentiality agreements:

• Accredited Domain Registrars & Registries: For domain orders, registrant information is transmitted to Dynadot LLC (ICANN-accredited registrar) and relevant central registry operators as mandated by ICANN regulations. Where permissible by the registry, free WHOIS Privacy is applied to mask personal phone numbers and physical addresses from public RDAP searches;
• Cloud Infrastructure Providers: Encrypted application and database hosting on enterprise cloud servers (AWS, DigitalOcean, local Tier-3/Tier-4 data centers);
• Communication Partners: Transactional SMS gateways (2Factor.in), WhatsApp Business API (Meta), and SMTP dispatch services for vital account alerts;
• Statutory Authorities: Law enforcement agencies or judicial authorities when legally compelled by a valid subpoena, court order, or statutory audit under applicable Indian law.

6. Data Retention & Erasure Schedule

Personal data is retained only for as long as necessary to achieve the commercial purposes for which it was gathered. Financial, tax, and invoicing transaction records are preserved for a statutory minimum of eight (8) financial years as mandated by Section 128 of the Companies Act, 2013 and Section 36 of the CGST Act, 2017. Technical session telemetry and security logs are automatically rotated and purged after 365 days.

7. Cybersecurity Safeguards & Technical Measures

We enforce rigorous administrative, physical, and technical safeguards, including:

• HTTPS / TLS 1.3 encryption across all public and internal web endpoints;
• Bcrypt and Argon2 cryptographic hashing for user authentication credentials;
• PDO parameterized database queries eliminating SQL injection vulnerabilities;
• Granular Role-Based Access Control (RBAC) ensuring employees access data on a strict need-to-know basis;
• Zero plain-text rendering of third-party API keys or sensitive gateway secrets in client-side HTML or logs.

8. Rights of Data Principals (DPDP Act 2023)

In accordance with Chapter III of the DPDP Act 2023, clients and individuals whose personal data we hold possess the right to:

• Obtain confirmation whether personal data is being processed, and a summary thereof;
• Request correction, completion, and updating of inaccurate or misleading personal data;
• Request erasure of personal data that is no longer necessary for statutory compliance or contractual fulfillment;
• Register a grievance with our designated Grievance Officer;
• Nominate an individual to exercise rights on their behalf in the event of death or incapacity.

9. Protection of Children's Data

Our website, enterprise software, and domain services are strictly designed for commercial enterprises and individuals aged 18 years and above. We do not knowingly process personal data relating to minors under 18 years of age without verifiable parental or guardian consent.

10. Grievance Officer & Statutory Contact Details

Pursuant to Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Section 12 of the DPDP Act 2023, the details of our designated Grievance Officer are:

Designated Grievance & Data Protection Officer
Entity: DUSTWON PRIVATE LIMITED
Office: Office No. 102, Shinote park, Manjari BK, Pune, Maharashtra 412307, India
Official Email: support@dustwon.com
Direct Telephone: +91 8839351440
Statutory Response Window: Acknowledgment within 48 hours; resolution within 30 days.