Skip to content
Cart

Privacy Policy

Last updated · Procure Services, operating Parichy

1. Who this policy covers, and who is responsible

This policy explains how Procure Services, based in Jalgaon, Maharashtra, India (“Procure Services”, “we”, “us”) collects, uses, shares and protects personal information when you visit www.parichy.com, place an order, sign in, use a Parichy Smart Profile or contact us. Smart Profiles that our customers publish are run by those customers; see Visitors to a Smart Profile.

For the information described in this policy, Procure Services is the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the “controller” under the GDPR and UK GDPR, and the “business” under US state privacy laws. How to reach us is in the contact section.

2. What we collect

  • Account and identity

    Examples
    Name, email address, mobile number, how you signed in (Google, LinkedIn, an email and password, or a one-time code), and — only if you choose a password — a salted one-way hash of it, never the password itself
    Where it comes from
    You, and Google or LinkedIn when you sign in with them

  • Sign-in codes

    Examples
    The mobile number or email address a one-time code was sent to, when, and a scrambled (HMAC) value of the code. A code works once, expires within 10 to 30 minutes and is stopped after a few wrong tries; old ones are deleted within days
    Where it comes from
    Created by us when you ask for a code

  • Orders and delivery

    Examples
    Delivery and billing address, PIN code, company name, GSTIN (optional), what you ordered, notes and delivery instructions
    Where it comes from
    You

  • Design and artwork

    Examples
    Text, logos and images you supply, your design choices, the preview you approved and when you approved it
    Where it comes from
    You

  • Payment

    Examples
    Payment ID, status, amount and method type. We do not receive or store your full card number, CVV, UPI PIN or net-banking login
    Where it comes from
    Razorpay, our payment gateway

  • Smart Profile content

    Examples
    What you publish: text, photos, links, contact details, products, opening hours, bookings and settings
    Where it comes from
    You

  • Enquiries and support

    Examples
    What you write in forms, emails or messages, and our replies
    Where it comes from
    You

  • Team orders

    Examples
    Names, email addresses and phone numbers of team members supplied by a business customer
    Where it comes from
    The business customer who ordered

  • Consent records

    Examples
    When you accepted our policies, which version, and your marketing choice
    Where it comes from
    You

  • Technical data

    Examples
    IP address, browser and device type, pages requested, date and time, error logs, and the cookies and browser storage in our Cookie Policy
    Where it comes from
    Collected automatically

Apart from the password you may choose for an email-and-password account — which we keep only as a salted one-way hash, so we cannot read it — we do not ask for “sensitive personal data” such as bank or card details, health or biometric information, and we ask you not to put it on your profile or in forms. You choose what to give us, but we cannot make or deliver an order without the details it needs.

3. How and why we use it

  • Make, deliver and support your order; set up your account and Smart Profile

    Basis (GDPR / UK GDPR)
    Contract

  • Take payment, confirm and refund orders, prevent fraud

    Basis (GDPR / UK GDPR)
    Contract; legitimate interests; legal obligation

  • Send order confirmations, delivery updates, invoices and other service messages

    Basis (GDPR / UK GDPR)
    Contract

  • Keep the Services secure; prevent abuse; enforce our Terms

    Basis (GDPR / UK GDPR)
    Legitimate interests; legal obligation

  • Meet tax, accounting, consumer-protection and other legal duties, and respond to lawful requests

    Basis (GDPR / UK GDPR)
    Legal obligation

  • Answer enquiries and complaints

    Basis (GDPR / UK GDPR)
    Contract; legitimate interests

  • Improve and fix the Services using technical logs

    Basis (GDPR / UK GDPR)
    Legitimate interests

  • Send marketing emails — only if you opt in, with a separate box that is never pre-ticked

    Basis (GDPR / UK GDPR)
    Consent, which you can withdraw at any time

  • Establish, exercise or defend legal claims

    Basis (GDPR / UK GDPR)
    Legitimate interests; legal obligation

In India we rely on the consent you give when you place an order or sign in, and on the other uses the law allows without consent, such as complying with a legal obligation. You can withdraw consent at any time (see Your rights); that does not affect what we did before, or uses the law allows without consent.

We do not sell your personal data. We do not share it for advertising across other companies’ sites, except that — only if you allow marketing cookies — the ad platforms listed in the Cookie Policy learn that a visit or order came from their ad. We do not make decisions about you by automated means that have legal or similarly significant effects.

4. Who we share it with

  • Payment. Razorpay processes online payments for us.
  • Sign-in. Google and LinkedIn confirm your identity when you sign in with them. They learn that you signed in to Parichy. We use your name and verified email address, and we do not ask for access to your contacts, files or other account data.
  • One-time codes. When you ask for a code, we send it to your mobile number by SMS and by WhatsApp (a service of Meta Platforms) through the messaging providers we use, and to your email address through our email provider when you verify an email or reset a password. Each of them receives the number or address and the message, and handles them under its own terms. We never ask you for a code except on our own sign-in page.
  • Delivery. Courier and postal partners receive your name, phone number and delivery address so they can deliver.
  • Production. Where we use a printing or manufacturing partner, it receives what it needs to make your item — the artwork and text you approved.
  • Service providers. Companies that host our systems, deliver email and provide other IT services act on our instructions and may use the data only to serve us.
  • Advisers. Lawyers, auditors and accountants, under a duty of confidentiality.
  • Authorities. Courts, police, tax authorities and regulators when the law requires, or to protect rights, safety and security.
  • Business changes. If the business is sold, merged or reorganised, data may pass to the successor, which must honour this policy.
  • You. Anything you publish on a public profile, and anything you ask us to send on.

We require service providers to protect the data and use it only for the services they provide to us.

5. Visitors to a Smart Profile, and people whose details customers give us

A Smart Profile is published by our customer, the profile owner. When someone opens it — by NFC tap, QR scan or link — we handle limited technical information (such as IP address, device type, language, location — such as your country, or your device’s location where a location-based rule needs it and your device shares it — the time, and view counts) to deliver the page, keep it secure and give the owner statistics. If the owner has set redirect rules (for example by time, country, language or device), we use these signals to apply them.

If a profile has forms, lead capture, bookings or an AI assistant, what a visitor submits goes to the profile owner. For that information the profile owner decides why and how it is used and is responsible for telling visitors and following the law; we act as the owner’s processor, storing and passing it on for them. To see, correct or delete what a profile owner holds about you, ask the profile owner; you can also write to us and we will pass your request on.

AI assistant messages are processed by AI service providers to produce replies and may be stored and shown to the profile owner. Please do not share sensitive information in them. Replies can be wrong.

When a business customer gives us team members’ details to create profiles or print on hardware, that customer is responsible for having the right to share them; we process them only for the order. If you are a team member with questions about your data, ask your employer or write to us.

Anything a profile owner publishes is public, and can be copied or cached elsewhere.

6. Cookies and similar technologies

We use only the cookies and browser storage that the website needs to work — signing in, opening your order after checkout, and remembering your basket and builder choices. Analytics and marketing cookies are used only if you agree to them in the cookie banner, and only for the tools the Cookie Policy lists; with that consent we also note which campaign or website brought you here and keep it with your order, so we can tell which campaigns lead to sales. The full list, and how to control them, is in the Cookie Policy. The homepage and demo pages show pictures of sample profiles; when you choose to try one live (or open it in a new tab), the real sample is served by our own platform and sets two strictly necessary cookies of its own, described there. When you are on a page run by another company, such as Google, LinkedIn or Razorpay, that company may set its own cookies.

7. How long we keep it

  • Account and profile information

    How long
    While your account is active. After you ask us to delete it, we delete or anonymise it within a reasonable time, apart from what we must keep (next row)

  • Orders, invoices, payments and consent records

    How long
    For as long as tax, accounting and company law require — in India generally six to eight years

  • Enquiries and support messages

    How long
    Until resolved and for a reasonable period afterwards, generally up to three years, the usual period in which a claim can be brought in India

  • Artwork and design approvals

    How long
    For the life of the order and any warranty or dispute period

  • Security and server logs

    How long
    For a limited period needed for security and troubleshooting

  • Information visitors submit through a profile

    How long
    As the profile owner decides; removed when they delete it or their account is closed, apart from backups

When we no longer need information we delete or anonymise it. Backups are overwritten on a regular cycle.

8. How we protect it

We use reasonable security practices and procedures suited to the information we hold, as India’s IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require. They include encrypted (HTTPS) connections; signed, HTTP-only session cookies; passwords kept only as salted one-way hashes and one-time codes only as scrambled values that work once; limits on wrong passwords and wrong codes; not storing your card, UPI or banking credentials (payments go through Razorpay); server-side checks so that an email address or mobile number on its own can never open an order — it must first be confirmed by a code or by Google or LinkedIn; limiting staff access to what their work needs; and validation and rate limits on forms and uploads.

No system is perfectly secure. Please keep your password, your Google or LinkedIn account, your phone and email and your devices secure, and never share a code. If a personal-data breach affects you, we will tell you and the authorities as the law requires, including CERT-In and, when in force, the Data Protection Board of India.

9. Where your information is processed

We are based in India, and our service providers may process information in India and in other countries — for example cloud hosting and email delivery. We transfer personal data out of India only as Indian law permits. If you are in the United Kingdom or European Economic Area and your data is sent to a country that has not been recognised as providing adequate protection, we use appropriate safeguards such as the standard contractual clauses.

10. Your rights and choices

In India (the IT Act and SPDI Rules, and the DPDP Act as it comes into force), you can ask what personal data we hold and how it is used; have inaccurate or incomplete data corrected or updated; ask for it to be erased; withdraw your consent; nominate someone to exercise your rights if you die or cannot; and complain to us (see the Grievance Redressal Policy).

In the UK and European Economic Area, you also have the right to restrict or object to processing, to receive your data in a portable format, and to complain to your data protection authority — for example the ICO in the UK. We would appreciate the chance to put things right first.

In California and other US states, you may have the right to know what personal information we collect and use, and to delete or correct it. You may also ask us not to sell or share it — we do not sell or share personal information as those laws define the words, and we do not use sensitive personal information beyond what is needed to provide the Services. We will not treat you worse for using these rights, and you may use an authorised agent.

How to use them. Email support@parichy.com from the address on your account with the subject “Privacy request” and say what you want. We may ask you to confirm your identity so that we do not give your data to someone else. We reply within 30 days, or sooner if your law requires. It is free unless requests are clearly unfounded or excessive. We may decline a request where the law allows — for example where we must keep records, or another person’s rights are affected — and we will tell you why.

Marketing. Use the unsubscribe link in any marketing email, or write to us. We will still send service messages about your orders.

Deleting your account. Write to us. We delete or anonymise what we can, and keep what the law requires us to keep, such as invoices.

11. Children

The Services are not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@parichy.com and we will delete it.

12. Changes to this policy

We may update this policy, for example when the law or our Services change. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you on the Website and, if you have an account, by email. The version you accepted at checkout is recorded with your order.

13. Contact, Grievance Officer and complaints

Privacy questions and requests: support@parichy.com. If you have a complaint about how we handle your personal data, write to our Grievance Officer — we acknowledge within 48 hours and aim to resolve within 30 days.

Designation
Grievance Officer
Company
Procure Services
Email
support@parichy.com
Address
Jalgaon, Maharashtra, India

You may also complain to the relevant authority: in India, the Data Protection Board of India once the relevant provisions of the DPDP Act are in force; in the United Kingdom, the Information Commissioner’s Office; in the European Economic Area, your national data protection authority.