Privacy policy

Who we are and when this Policy applies

This draft applies to Ceramic Portal as provided by the legal operator identified in the Customer's approved Order. The operator identity and this wording require independent legal approval before publication. The draft covers visits to ceramicportal.com, demo requests, contact enquiries, the CeramicPortal Admin portal and Retailer App accounts connected to a CeramicPortal business customer.

It does not govern an independent website, app or service that merely links to CeramicPortal. A connected wholesaler, distributor or other business may have its own privacy notice for the customer and transaction records it controls.

Our role and the Customer's role

For website, demo, account administration, billing, security and support information, CeramicPortal determines why and how the information is handled, subject to applicable law.

For customer, retailer, product, price, order, document, payment, stock and reporting records entered by a business customer, that Customer ordinarily decides the business purpose and access. CeramicPortal processes the records to provide the service and follow the Customer's lawful instructions, subject to our own security, legal and operational duties.

If you are a retailer user, employee or other person whose information was entered by a Customer, you may contact that Customer first because it controls the business relationship and account permissions. You may also contact us, and we will route or assist with the request where appropriate.

Information we collect

Demo request data

In the isolated functional form, a demo request can contain the person's name, business name, phone, work email, city, state, preferred language, business type, retailer, branch and godown counts, accounting software, current ordering method, main problem, preferred date and time, optional notes, consent record, landing page, referrer and supplied campaign parameters.

We use that information to prepare and respond to the requested product demonstration, detect repeated same-day requests, protect the form from abuse and notify the authorised operations inbox. A confirmation is issued only after persistence. The browser receives no bare lead identifier as proof, and the confirmation response contains no personal data.

Where information comes from

• Directly from you when you register, sign in, configure a business, submit a form, place an order or contact support.
• From the Customer or its authorised administrators when they create users, retailers, customers, products, prices or business records.
• Automatically from the website, Admin portal, Retailer App, security controls and server logs when the service is used.
• From connected service providers, such as a payment, communication or analytics provider, only for the relevant enabled function and subject to applicable controls.

Why we use information

• Provide accounts, authentication, catalogue access, retailer ordering, business records, documents, reports, exports and requested support.
• Configure a trial or subscription, issue billing and tax records, verify payment status and enforce included plan limits.
• Secure the service, prevent abuse, investigate incidents, maintain logs, restore availability and enforce legal or contractual terms.
• Respond to demo, sales, support, privacy and grievance requests and keep an appropriate record of the response.
• Maintain, troubleshoot and improve service reliability and usability using information that is limited, aggregated or de-identified where practical.
• Comply with applicable law, lawful authority, tax and accounting duties, and establish, exercise or defend legal claims.

Legal grounds and consent

We process personal data with consent where consent is required, for the purpose described in the notice presented to the person, and for other grounds or certain legitimate uses recognised by applicable law. We also handle information needed to take requested steps, provide and secure the contracted service, comply with law and address legal claims, to the extent those grounds are available under the law that applies.

A person may withdraw consent through the available preference control or by contacting us. Withdrawal does not make earlier lawful processing invalid. It may prevent a feature that depends on that information from continuing, and information may still be retained or processed where law permits or requires it.

When information is shared

We do not sell personal data. We share only what is reasonably needed for the purpose described below and apply contractual, access or legal safeguards appropriate to the relationship.

• With the Customer, its authorised administrators, team users and connected retailer users according to account roles and product assignments.
• With hosting, infrastructure, communications, support, security, analytics and payment service providers that help operate the relevant enabled function.
• With professional advisers, auditors, insurers or a party to a genuine corporate transaction under appropriate confidentiality duties.
• With a court, regulator, law-enforcement body or other authority when disclosure is lawfully required, or where reasonably necessary to protect rights, safety or service security.

Processing locations and international transfers

CeramicPortal and its service providers may process information in India and in other locations where an approved provider operates. We do not make an unverified India-only hosting promise. Where a cross-border transfer is restricted, we will apply the requirements, contractual protections and government directions then applicable to that transfer.

How long information is kept

We keep personal data only for as long as it is needed for the stated purpose, an active account or contract, security and fraud prevention, tax and accounting requirements, dispute handling, enforcement, backup integrity or another lawful reason. Different records therefore have different retention periods.

When the purpose ends and retention is no longer required or permitted, information is deleted, anonymised or placed beyond ordinary use as part of a controlled backup cycle. Deletion from active systems may occur before expiry from encrypted or disaster-recovery backups, which are isolated and overwritten on their normal cycle.

A final fixed retention schedule for demo requests has not been approved. That decision remains a release gate; this draft does not invent a period. Until approval, public lead collection remains closed and isolated test records must be handled under the test-surface controls.

Security

We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, tenant separation, authentication, logging, secure transport, controlled service credentials, backups and incident response. Abuse-protection values for demo requests are stored as one-way hashes, and demo-confirmation tokens are stored server-side as verifiers rather than exposed lead data.

No system is completely secure. Customers must protect their credentials, devices, roles and exports and should notify us promptly of suspected misuse. Where applicable law requires it, we will notify affected persons and the relevant authority of a personal-data breach in the required form and time.

Your choices and rights

Depending on the law in force and applicable to the request, a person may have rights to receive information about processing, access a summary of personal data, correct or update inaccurate data, complete incomplete data, request erasure, withdraw consent, nominate another person, and use a grievance process. Some rights or detailed procedures under the Digital Personal Data Protection Act and Rules take effect in stages.

Send a request from the email or mobile number associated with the account where possible. Explain the information or account involved and the action requested. We may verify identity, authority and organisational control, ask for information needed to locate the record, or refuse or limit a request where law permits or another person's rights would be affected.

Children

CeramicPortal is a business service and is not intended for a person under 18 years of age. Customers must not create a business or retailer account for a child or direct a child to submit personal data. If we learn that a child's personal data was provided without a lawful basis and required verifiable consent, we will take appropriate steps to restrict or delete it.

Automated decisions and marketing

CeramicPortal does not claim to make a solely automated legal or similarly significant decision about a person through the public website or demo form. We do not send optional electronic marketing merely because a person used the service; any consent or lawful basis required for a marketing channel must be obtained and an available opt-out respected.

Changes to this Policy

We may update this Policy when the service, data flow or law changes. The page will show its updated date. If a change materially affects how personal data is used, we will provide an appropriate notice and seek fresh consent where applicable law requires it.

Privacy requests and grievances

Use the verified contact details below to ask a privacy question, exercise an applicable right or raise a grievance. State “Privacy request” in the subject and identify the relevant account or relationship without sending passwords, OTPs or unnecessary sensitive material.

A named grievance officer or legal owner has not been approved in the governance record. We will not invent a person's name. The role, name, escalation route and response commitment must be added through human legal approval before this Policy is authorised for release.