Privacy Policy — Dravyaa

This Privacy Policy explains how Good Folks Innovations Private Limited ("Good Folks", "Dravyaa", "we", "us" or "our") collects, uses, discloses and protects information about you when you visit www.dravyaa.com (the "Site") or use the Dravyaa ERP platform (the "Service"). It also describes your rights under applicable data protection law, including the EU General Data Protection Regulation (GDPR) (Regulation 2016/679).

If you are located in the European Economic Area (EEA), UK or Switzerland, please read this policy carefully — it contains specific information about your GDPR rights.

1. Data Controller

The data controller responsible for your personal data is:

Good Folks Innovations Private Limited
4B-75, Bangur Avenue, Block C, Kolkata — 700055
Email: [email protected]

2. EU / EEA Representative (Article 27 GDPR)

Dravyaa's primary market is India. Where we process personal data of individuals in the EEA, UK or Switzerland, we are in the process of formalising an EU-based representative under GDPR Article 27. In the meantime, EEA individuals may direct all data protection enquiries directly to [email protected] and we will respond promptly.

3. Data Protection Contact

For any questions about how we process your personal data, contact [email protected]. We aim to respond within 5 business days. A formal Data Protection Officer (DPO) will be appointed as required under the DPDPA 2023 rules once notified by the Central Government.

4. Personal Data We Collect

4.1 Data you provide directly

Account data: name, work email address, phone number, company name, job title, country.
Billing data: billing address, VAT/tax number. Payment card data is processed directly by our payment processor and is never stored by us.
Communications: content of emails, chat messages, support tickets and demo booking details.
ERP data: inventory records, purchase orders, invoices, supplier and customer contacts that you enter into Dravyaa. This is processed on your behalf as a data processor under a separate Data Processing Agreement.

4.2 Data collected automatically

Usage data: pages visited, features used, session duration, browser type, operating system, device type and screen resolution.
Log data: IP address, access timestamps, HTTP referrer and error logs.
Cookie data: see our Cookie Policy for full details. Analytics and marketing cookies are only set with your prior consent.

4.3 Data from third parties

If you authenticate via Google OAuth, we receive your Google account name and email.
Where you have given marketing consent, HubSpot may share engagement signals from our email campaigns.

5. Purposes and Legal Bases

Purpose	Legal basis (GDPR Art. 6)
Provide and operate the Service (accounts, billing, authentication)	Art. 6(1)(b) — performance of contract
Customer support and service communications	Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests
Product improvement and development (usage analytics)	Art. 6(1)(f) — legitimate interests
Security, fraud prevention and legal compliance	Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interests
Website analytics (Google Analytics)	Art. 6(1)(a) — consent (withdrawable at any time)
Marketing, lead nurturing and campaign measurement (HubSpot)	Art. 6(1)(a) — consent (withdrawable at any time)
Product newsletters (opt-in)	Art. 6(1)(a) — consent

Legitimate interests: Where we rely on Art. 6(1)(f), our interests have been balanced against your rights. You may request details of our balancing test by emailing [email protected].

6. Cookies and Tracking

We use cookies and similar technologies. Our Cookie Policy lists every cookie by name, provider, purpose, category and lifetime. You can update your choices at any time via the Cookie settings panel or your browser controls. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

7. Sharing Your Data

We do not sell personal data. We share data only with:

Sub-processors acting on our documented instructions under written agreements — including Google LLC (analytics), HubSpot Inc. (CRM/marketing), AWS / cloud infrastructure, and our payment processor. Full list in the DPA.
Legal authorities when required by applicable law, court order or regulation.
Business transfers in a merger, acquisition or asset sale, subject to appropriate confidentiality obligations.
With your consent for any other purpose you have explicitly agreed to.

8. International Data Transfers

Good Folks is based in India, which is not currently designated an adequate country by the European Commission. When we transfer personal data from the EEA, UK or Switzerland to India or to other third countries, we rely on:

EU Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914. Copies available on request at [email protected].
Supplementary measures — end-to-end encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls and pseudonymisation where appropriate.

9. Retention Periods

Account data: retained for the life of the account, then deleted or anonymised within 90 days of account closure.
Billing and financial records: 7 years (statutory accounting obligations).
Support records: up to 3 years after case closure.
Analytics data: up to 26 months (Google Analytics, with IP anonymisation enabled).
Marketing data: until consent is withdrawn or you request erasure.
Log data: up to 90 days for security monitoring.

10. Your GDPR Rights

If you are in the EEA, UK or Switzerland, you may exercise the following rights:

Access (Art. 15): confirm whether we process your data and obtain a copy.
Rectification (Art. 16): correct inaccurate or incomplete personal data.
Erasure (Art. 17): request deletion where there is no overriding lawful reason for continued processing.
Restriction (Art. 18): ask us to limit processing in certain circumstances.
Portability (Art. 20): receive your data in a structured, machine-readable format or transfer it to another controller, where processing is consent- or contract-based and automated.
Objection (Art. 21): object to processing based on legitimate interests or to direct marketing at any time.
Withdraw consent (Art. 7(3)): withdraw any consent you have given at any time via our Cookie settings or by emailing us. Withdrawal does not affect prior lawful processing.
No automated decisions (Art. 22): we do not make solely automated decisions with significant legal or similarly significant effects.

11. How to Exercise Your Rights

Email [email protected] with subject "Data Subject Request". We will respond within 30 days (extendable by a further 60 days for complex or multiple requests, with notice). We may ask you to verify your identity. Rights requests are free unless manifestly unfounded or excessive.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with your national supervisory authority. A list of EEA authorities is available at the European Data Protection Board website. We would appreciate the chance to address your concerns first — please contact us at [email protected].

13. Children

Our Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have done so, please contact us and we will delete it promptly.

14. Security

We implement appropriate technical and organisational security measures, including TLS encryption, role-based access controls, regular vulnerability assessments and staff training. No system is 100% secure; we cannot guarantee absolute security of data transmitted over the internet.

15. Changes to This Policy

We may update this Policy periodically. Material changes will be notified to registered users by email or in-app notice at least 14 days before taking effect. The "Last updated" date above will always reflect the current version.

16. Contact

Privacy queries: [email protected]
General: [email protected]
Post: Good Folks Innovations Private Limited, 4B-75, Bangur Avenue, Block C, Kolkata — 700055, West Bengal, India.