LEGAL · DATA PROTECTION

Privacy Policy & Data Protection Notice

Effective date: 10 November 2026 · Applies to: packsmithindia.com, our WhatsApp business number, enquiry forms, email and offline order processing.

This Privacy Policy is the notice required under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, read with the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It explains, in plain language, what personal data Packsmith India Private Limited collects, why, how long we keep it, who we share it with, and the rights you have.

1. Who we are (Data Fiduciary)

Packsmith India Private Limited (CIN U74300DL2013PTC254931, GSTIN 06AAFCB5521P1ZH), a company incorporated in India on 4 July 2013, is the Data Fiduciary – the entity that decides why and how your personal data is processed.

Registered factory and office: 46/18M, Village Ferozpur Banger, Near IMT Kharkhoda, Distt. Sonipat, Haryana – 131402, India.
Email: hello@packsmithindia.com · Phone / WhatsApp: +91 98107 42123

We are a business-to-business manufacturer of corrugated boxes and printed cartons. Almost all personal data we handle belongs to people acting for a business – purchase managers, owners, designers and transport staff.

2. Privacy notice – what we collect and why

2.1 Data you give us

Data When Purpose Legal basis
Name, phone / WhatsApp number, email, company name, message Enquiry form, WhatsApp, call, email To reply to your enquiry, send a quotation, arrange samples Your consent (you choose to contact us)
Billing name, GSTIN, delivery address, PO details, bank/UPI reference of payments made to us When you place an order To manufacture, invoice, deliver and account for the order; GST and Companies Act compliance Performance of a contract; legal obligation
Artwork files, brand assets, product photographs When you share them for printing To design and print your packaging Performance of a contract
Visitor name and vehicle number Factory visit register Site security Legitimate use – security

2.2 Data collected automatically

When you browse the website our hosting server and analytics tools record your IP address, approximate location (city level), browser and device type, pages viewed, referring page and time of visit. This is used only to keep the website secure, measure which pages are useful and improve them. See Cookies.

2.3 What we do not collect

We do not ask for or store card numbers, net-banking passwords, Aadhaar, PAN of individuals (a company PAN may appear on a GST invoice), biometric, health or any other sensitive personal data. Please do not send such data to us.

2.4 Marketing

We may send you a WhatsApp or email message about packaging products only if you have enquired or ordered from us, and you can opt out at any time by replying STOP or writing to hello@packsmithindia.com. We do not buy or rent contact lists.

4. Cookies and tracking

Cookies are small files stored by your browser. We use them as follows:

Type Examples Purpose Your choice
Strictly necessary Session, security and caching cookies set by WordPress and our hosting Make the site load and work securely Cannot be switched off; they store no personal profile
Analytics Google Analytics / Search Console (if enabled) Count visits and see which pages help buyers Decline via the cookie notice or block in your browser
Embedded content Instagram feed (Meta), Google reviews widget (Trustindex), Google Maps link Show our Instagram posts and Google reviews These providers may set their own cookies under their policies; block third-party cookies in your browser to prevent this
WhatsApp click-to-chat wa.me link Opens WhatsApp – no cookie set by us Governed by WhatsApp’s privacy policy

We do not use advertising pixels or sell browsing data. You can clear or block cookies in your browser settings; the website will still work, though embedded feeds may not load.

5. Who we share data with (Data Processors)

We share personal data only as needed to run the business, under written terms that require confidentiality and security:

  • Website hosting and email providers – store website data and emails.
  • Google (Workspace email, Search Console, Business Profile, Maps) and Meta (Instagram embed) – as described above.
  • Transporters and courier partners – receive the delivery contact name, phone number and address for your order.
  • Chartered accountants, auditors and GST/Government portals – receive invoice data as required by law.
  • Printing-plate, die and design vendors – receive artwork only, never your contact details, unless you ask us to connect you.

We never sell personal data. We disclose it to authorities only when legally required – for example a GST audit, a court order or a lawful request from the police.

Cross-border transfer: some providers (Google, Meta) may store data on servers outside India. Such transfers are made only to countries not restricted by the Central Government under the DPDP Act, and under the providers’ standard contractual safeguards.

6. Retention and deletion policy

Data Kept for Reason
Enquiries that do not become orders 24 months from last contact, then deleted Follow-up on quotations
Order, invoice and payment records 8 financial years Companies Act 2013 and GST law require it
Artwork and dielines Life of the product plus 3 years, unless you ask for earlier deletion Repeat orders need the same files
Website server logs 90 days Security
Visitor register 12 months Security

How to request deletion: email hello@packsmithindia.com with subject “Delete my data” from the email or phone number we hold. We will confirm identity, delete or anonymise your data within 30 days, instruct our processors to do the same, and tell you when it is done. Data that the law requires us to keep (invoices, GST records) is retained for the statutory period only and then securely destroyed. When data is no longer needed for its purpose we erase it even without a request.

7. Children’s data

Our website and services are intended for businesses and for adults aged 18 and above. We do not knowingly collect personal data of children (persons under 18) or persons with disabilities who have a lawful guardian, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children, as prohibited by Section 9 of the DPDP Act.

If we learn that we have collected a child’s personal data without verifiable parental or guardian consent, we will delete it within 7 working days. Parents or guardians who believe a child has shared data with us should write to the Grievance Officer below.

8. Data security

  • Encryption in transit: the website is served over HTTPS/TLS; forms post over encrypted connections.
  • Access control: customer data is accessible only to staff who need it (sales, accounts, dispatch) using individual password-protected accounts; administrator access to the website is limited and logged.
  • Hosting and backups: the website runs on a managed host with firewall, malware scanning, daily backups and automatic security updates; WordPress core, theme and plugins are kept current and unused plugins are removed.
  • Process controls: our ISO 9001:2015 quality management system covers document control and record retention; paper records are kept in locked storage at the factory office.
  • Vendor controls: processors are bound by confidentiality terms and may use data only on our instructions.
  • Breach response: in the event of a personal-data breach we will inform the Data Protection Board of India and each affected Data Principal in the form and time prescribed under the DPDP Rules, describing what happened and the steps to protect yourself.

9. Your rights under the DPDP Act, 2023

As a Data Principal you have the right to:

  1. Access – a summary of the personal data we hold about you, the processing activities, and the processors it has been shared with (Section 11).
  2. Correction and erasure – have inaccurate or incomplete data corrected, updated, or erased when it is no longer needed (Section 12).
  3. Grievance redressal – a readily available means to raise a complaint, answered within the time below (Section 13).
  4. Nominate – name another person to exercise your rights in the event of death or incapacity (Section 14).
  5. Withdraw consent – at any time, as described in Section 3.

To exercise any right, write to the Grievance Officer. We may ask for reasonable verification of identity. There is no fee. If you are not satisfied with our response you may complain to the Data Protection Board of India.

10. Grievance Officer and contact person

Grievance Officer / Data Protection contact
Mr. Munish Garg, Director
Packsmith India Private Limited
46/18M, Village Ferozpur Banger, Near IMT Kharkhoda, Distt. Sonipat, Haryana – 131402
Email: hello@packsmithindia.com (subject line: “Privacy”)
Phone: +91 98107 42123 (Mon–Sat, 9 AM – 7 PM IST)

Response time: acknowledgement within 48 hours; resolution within 7 working days, and in any case within the period prescribed under the DPDP Rules and the IT Rules (not more than 30 days).

11. Changes to this policy and governing law

We review this policy at least once a year and whenever the law or our processing changes. The effective date at the top shows the current version; material changes are highlighted on this page and, for customers, notified by email. This policy is governed by the laws of India; courts at Sonipat, Haryana have jurisdiction, subject to the powers of the Data Protection Board of India.

This policy is written to meet the DPDP Act, 2023 and is reviewed by the company; it is not a substitute for independent legal advice.