Privacy Policy

Who we are

TrimbakStore (trimbakstore.com) is an independent local directory for businesses and services in Trimbakeshwar, Nashik district, Maharashtra. We operate this website and decide how personal data on it is used, which makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

In this policy, "we", "us" and "our" mean the TrimbakStore team. "You" means any visitor, business owner or other person whose data we process — the Data Principal, in the language of the Act.

What data we collect, and why

We collect only what the directory needs to work. Each item below is tied to a specific purpose, and we ask for your consent at the point of collection:

• Account details (name, email, password): to create your account, keep it secure and let you manage your listings.
• Business details you submit (name, description, address, phone, WhatsApp, email, photos): to review and show your listing publicly.
• Enquiry details (your name, phone or email, message): to pass your message to the listing owner so they can reply.
• Questions sent to our FAQ (question, optional name and email): to answer and publish useful questions.
• Messages to us (name, email, message): to read and reply to what you send.
• Data rights and grievance requests (name, email, details): to identify you, verify the request and respond.
• Visit data (pages viewed, device type, browser, referring site): to understand which pages help people, in aggregate. This is not used to identify you personally.

What we do not do

We do not sell your data. We do not run advertising networks or third-party trackers. We do not collect data beyond what is listed above, and we do not use your details for any purpose you have not been told about.

How long we keep data

We keep personal data only as long as the purpose needs. An automatic daily sweep deletes anything that has passed the period below:

• Accounts: until you ask us to erase them or the account is closed.
• Published listings: while the listing is live, plus a short archive period before it is removed for good.
• Unclaimed submissions: if you send us a business and nobody claims it and it is never approved, we delete it, with its photos, after 6 months.
• Enquiries and messages: up to 12 months, then deleted.
• Published FAQ questions: the answer stays public, but the name and email attached to the question are removed after 12 months.
• Consent records, data rights requests and grievances: up to 8 years, as needed to demonstrate that we acted on your instructions.
• Visit data: up to 12 months.

Your rights

Under the DPDP Act you can ask us to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or update personal data that is inaccurate or incomplete.
• Erase your personal data, unless we must keep something to meet a legal obligation.
• Withdraw a consent you have given, at any time, without affecting earlier lawful processing.
• Raise a grievance if you are unhappy with how we handled any of the above.

How to use your rights or withdraw consent

Use the My Data Rights page to submit an access, correction or erasure request — it takes a minute and you receive a reference number by email. If you have an account, the Privacy & data section of your dashboard shows every consent you have given, with one-click withdrawal for optional ones.

We respond to requests within 30 days. If we need to verify your identity first, we will ask.

Grievance Officer

If something has gone wrong, write to our Grievance Officer. We will acknowledge your grievance, investigate it, and respond within the promised timeline.

Complaining to the Data Protection Board

If you are not satisfied with our response, you can complain to the Data Protection Board of India, which handles such matters online.

Lodge a complaint with the Data Protection Board of India →

How we protect data

Access to personal data is limited to the administrators who need it. Forms are protected against cross-site request forgery, passwords are stored hashed, and every consent, rights request and grievance is recorded with a timestamp so there is an audit trail. Data deletion happens on an automatic schedule rather than by hand. No system is perfect, but we design ours to collect as little as possible in the first place.

Children

The directory is not aimed at children. If you are under 18, please use the site only with a parent or guardian's involvement; if you believe a child has given us personal data, tell us and we will remove it.

Changes to this policy

If our practices change, this page changes with them, and the date above moves. Significant changes will also be flagged on the homepage for a reasonable period.