Privacy Policy

This Privacy Policy explains how Autocoat Engineering India Pvt Ltd ("Autocoat", "we", "us" or "our") — a private limited company registered in India and the Data Fiduciary for purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") — collects, uses, shares and safeguards your personal data when you visit our website autocoatindia.com (the "Website"), submit an enquiry, place an order, or otherwise interact with us.

By using the Website or sharing your personal data with us, you confirm that you have read and understood this Privacy Policy. Where applicable law requires consent, you are giving informed, specific consent to the processing described below.

1.Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data — as defined under the DPDP Act, 2023.
• "Processing" means any operation performed on personal data including collection, recording, organisation, storage, use, sharing, deletion or destruction.
• "Data Principal" means the individual to whom personal data relates — that is, you.
• "Data Fiduciary" means the entity that determines the purpose and means of processing personal data — that is, Autocoat.
• "Cookies" means small text files placed on your device by the Website to identify your browser or store preferences.

2.Data We Collect

We collect only the personal data necessary to respond to your enquiries, fulfil your orders and operate the Website. The categories include:

Category	Examples
Identity & Contact Data	Full name, company name, designation, business email address, phone number, country/city
Enquiry Data	Industry type, component specifications, paint type, throughput, site location, budget range
Commercial Data	Purchase order details, GST/PAN (for invoice), bank account references (for payment), shipping address
Communication Data	Email correspondence, WhatsApp messages, call notes, meeting minutes
Technical Data	IP address, browser type, device, operating system, referrer URL, pages visited, session duration
Marketing Preferences	Subscription status, communication preferences, opt-ins/opt-outs

We do not collect sensitive categories of personal data (such as financial account numbers beyond business invoicing requirements, biometric data, health data or caste/religion) through the Website.

3.How We Collect Data

• Directly from you — when you submit our Enquiry form, send an email, call us, message us on WhatsApp, or sign a purchase order;
• Automatically — via cookies and analytics scripts (see clause 7);
• From third parties — from public business directories (IndiaMART, TradeIndia), our channel partners or referral introductions, where you have already shared data with them and lawful basis exists;
• From our customers — if you are the employee or representative of a customer organisation, that organisation may share your business contact details with us in connection with a project.

4.Purpose of Processing

We process your personal data only for legitimate business purposes, including:

• Responding to your enquiries and providing quotations;
• Designing, manufacturing, supplying and installing paint booth equipment;
• Issuing invoices, receiving payments and statutory tax compliance (GST);
• Providing after-sales support, warranty service, AMC and spare parts supply;
• Improving our products, services and Website performance;
• Sending operational communications (order updates, service reminders);
• Sending marketing communications — only where you have opted in or where permitted under applicable law;
• Detecting and preventing fraud, security threats and misuse of the Website;
• Complying with applicable laws, court orders or regulatory requests.

5.Legal Basis & Consent

Under the DPDP Act, 2023, we process your personal data on one of the following lawful bases:

• Consent — when you voluntarily submit an enquiry, subscribe to communications, or otherwise provide data;
• Legitimate Use — for performing a contract with you (such as fulfilling an order), pursuing legitimate business interests (such as recovering dues) and compliance with law (such as GST records);
• Other Specified Purposes — as may be permitted under the DPDP Act.

You may withdraw your consent at any time for processing that relies on consent (see clause 12). Withdrawal does not affect processing already carried out on the basis of prior consent, nor processing on other lawful bases.

6.How We Share Data

We do not sell or rent your personal data. We may share your data with:

• Our employees and engineers — on a need-to-know basis to fulfil enquiries and projects;
• Service providers — web hosting (Hostinger), email service, analytics (Google Analytics), payment processors and freight/logistics providers, each bound by data-protection obligations;
• Channel partners and authorised dealers — where they are part of fulfilling your enquiry, only with appropriate consent;
• Statutory authorities — tax authorities (GST), regulators or law enforcement when required by law, court order or to enforce legal rights;
• Successors — in case of merger, acquisition, restructuring or sale of assets, subject to equivalent privacy protections.

7.Cookies & Analytics

The Website uses cookies and similar technologies to improve user experience and analyse traffic.

Type	Purpose	Provider
Essential	Allow the Website to function (e.g., form submissions, navigation)	Autocoat
Analytics	Anonymous usage statistics — pages visited, session duration, device type	Google Analytics 4 (GA4)

We do not currently use advertising cookies or remarketing pixels. We do not sell cookie data to third parties.

You can disable cookies through your browser settings. Disabling essential cookies may affect Website functionality. Disabling analytics cookies does not affect Website functionality.

8.Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy and to comply with legal obligations:

• Enquiry data: retained for up to 3 years from last contact, after which it is anonymised or deleted, unless converted to a customer Order;
• Order & invoice records: retained for at least 8 years as required under Indian GST and Companies Act record-keeping rules;
• Email correspondence: retained for 5 years for business and contract reference;
• Marketing data: retained until you withdraw consent or are inactive for 24 months;
• Website analytics data (GA4): retained for the period configured in our GA4 settings (currently 14 months);
• Backups: may persist in encrypted backups for up to 12 months after deletion from active systems.

9.Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. Measures include:

• HTTPS / TLS encryption across the entire Website;
• Hosting on Hostinger's secured infrastructure with managed firewalls;
• Access controls — data is accessible only to authorised personnel on a need-to-know basis;
• Regular software updates and security patching;
• Employee confidentiality obligations.

While we take reasonable measures, no system is completely secure. In the event of a data breach affecting your personal data, we will notify the Data Protection Board of India and affected Data Principals as required under DPDP §8(6).

10.Cross-Border Transfers

Some of our service providers (notably Google Analytics) may process data on servers located outside India. Such transfers are made only to jurisdictions not restricted by the Central Government under the DPDP Act, and we ensure that contractual safeguards are in place.

For customers in the Middle East (UAE, Saudi Arabia, Bahrain), we may share your data with our local installation and service partners only as needed to fulfil contracts.

11.Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights in relation to your personal data:

• Right to Information — to know what personal data we hold, the purposes of processing and the recipients with whom it has been shared;
• Right to Correction & Erasure — to correct inaccurate or misleading data, complete incomplete data, or have your data erased where it is no longer necessary;
• Right to Grievance Redressal — to raise grievances with our Grievance Officer (clause 13);
• Right to Nominate — to nominate another individual to exercise your rights in case of your death or incapacity;
• Right to Withdraw Consent — at any time where consent is the lawful basis for processing.

12.How to Exercise Your Rights

To exercise any of the rights above, please write to our Grievance Officer (clause 13) at [email protected] with the subject line "DPDP Rights Request — [Your Request Type]".

For verification and security, please include:

• Your full name and the business email/phone you used to share data with us;
• A description of the personal data your request relates to;
• The specific right you wish to exercise (information, correction, erasure, etc.);
• Proof of identity, if reasonably required for sensitive requests.

We will respond within a reasonable period and in any case as required by the DPDP Act and rules made thereunder. There is no fee for exercising your rights, except for manifestly unfounded or excessive requests where a reasonable fee may be charged.

13.Grievance Officer

In accordance with DPDP Act, 2023 §8 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we have designated the following Grievance Officer:

The Grievance Officer will acknowledge your grievance within 48 hours and resolve it within 30 days of receipt. If you are unsatisfied with the resolution, you may approach the Data Protection Board of India under the DPDP Act.

14.Children's Privacy

Our Website and services are intended for business and industrial customers. We do not knowingly collect personal data of children under the age of 18. If we become aware that we have inadvertently collected personal data of a child, we will delete it promptly.

If you are a parent or guardian and believe your child has submitted data through the Website, please contact our Grievance Officer.

15.Marketing Communications

We may send you operational communications (related to your enquiries and orders) without specific marketing consent, as these are necessary for performance.

For marketing communications — such as newsletters, product launch announcements or trade-show invitations — we will only send them if you have explicitly opted in. You may unsubscribe at any time by clicking the "unsubscribe" link in any marketing email or by writing to [email protected].

16.Third-Party Links

The Website may link to third-party websites (such as our LinkedIn, Facebook or YouTube pages, supplier sites, or industry references). This Privacy Policy does not apply to those sites. We are not responsible for their privacy practices. Please review their privacy policies before sharing data.

17.Automated Decision-Making

We do not use automated decision-making (including profiling) that produces legal effects on you or significantly affects you. All commercial decisions (quotations, credit approvals, design recommendations) involve human review.

18.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or applicable law. The "Last Updated" date at the top of this page indicates the most recent revision.

For material changes that affect your rights, we will provide reasonable notice (such as a banner on the Website or an email to active customers) before the changes take effect.

19.Governing Law

This Privacy Policy is governed by the laws of the Republic of India, including:

• Digital Personal Data Protection Act, 2023 (DPDP Act);
• Information Technology Act, 2000 (as amended);
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• Any rules, regulations or orders issued thereunder.

Disputes arising in connection with this Policy will be subject to the jurisdiction of the courts at Thane, Maharashtra, in accordance with our Terms of Service.

20.Contact Us

For any questions about this Privacy Policy or how we handle your personal data, please contact us at: