Privacy Policy

1. Who We Are

JBM Buildcare Products is the Data Fiduciary responsible for your personal data under the DPDP Act.

• Registered address: Sr No. 20, Kiwale Gaon, Dehuroad, Pune - 412101, Maharashtra, India
• GSTIN: 27EHDPM8440L1ZV
• Email: JBMBUILDCAREPRODUCT@GMAIL.COM
• Phone: +91 85303 86363

2. Personal Data We Collect

Data you give us directly

• Account details — first and last name, email address, phone number, and a password. Passwords are stored only as a salted one-way hash and are never readable by us or stored in plain text.
• Profile photo — only if you choose to upload one, or if it is supplied by Google when you sign in with a Google account.
• Delivery addresses — recipient name, phone number, and address details you save to your account or enter at checkout.
• Order and cart contents — items selected, quantities, order value, payment method, order status and history, and any delivery notes you add.
• Enquiries — the name, email, phone number, subject and message you submit through our contact form or a bulk quote request.
• Reviews — any rating or review text you choose to publish against a product, shown publicly with your first name.

Data collected automatically

• Sign-in session records, including a session identifier and its expiry, used to keep you logged in securely.
• Technical data such as IP address, browser type and request logs, retained for security, fraud prevention and diagnosing faults.
• Records of transactional emails we send you (for example order confirmations, cart reminders and review requests).

Data we do not collect

We do not collect or store your card number, UPI ID, net-banking credentials or any other payment instrument details. These are entered directly with our payment partner, Razorpay, and never pass through or rest on our servers. We also do not knowingly collect any special or sensitive category data such as health, biometric, caste, religious or political information, and you should not send such data to us.

3. Why We Use Your Data, and Our Legal Basis

We do not use your personal data to make any decision about you that is based solely on automated processing and produces a legal or similarly significant effect.

4. Consent, and How to Withdraw It

Where we rely on your consent, you gave it by creating an account and accepting these terms, and we record the date and time you did so. You may withdraw your consent at any time by writing to our Grievance Officer at the address in section 12, or by using the unsubscribe option in any reminder or review-request email.

Withdrawing consent does not affect anything we lawfully did with your data beforehand. Please note that some data is necessary to run your account and fulfil orders you have already placed — if you withdraw consent for that data, we may no longer be able to provide the service, and we may still need to retain records we are legally required to keep.

5. Who We Share Your Data With

We share the minimum data necessary with service providers who process it on our instructions and are bound to keep it confidential. We do not sell your personal data, and we do not share it with third parties for their own advertising.

• Razorpay — to process payments and refunds. Razorpay receives your name, contact details and order amount, and collects payment instrument details directly from you under its own privacy policy.
• Google — only if you choose to sign in with a Google account, in which case Google shares your name, email address and profile photo with us.
• Resend — to deliver transactional email. Receives your email address and the message content.
• Cloudinary — to host images and documents, including any profile photo you upload and our product images and technical data sheets.
• Delivery and logistics partners — the recipient name, address and phone number needed to deliver your order.
• Professional advisers and authorities — where we are required to disclose data by law, a court order, or a lawful request from a government agency, or to establish or defend legal claims.

6. Transfers Outside India

Some of the service providers listed above operate infrastructure outside India, so your data may be processed outside the country. We transfer data only to providers that offer contractual protections and security standards comparable to those required here, and only to countries not restricted for transfer by the Central Government under the DPDP Act.

7. Cookies

We use a small number of strictly necessary cookies. These hold your sign-in tokens, are marked HttpOnly so they cannot be read by scripts in your browser, and exist only to keep you securely signed in and to protect against request forgery. Your cart contents are also held so your basket survives a page refresh.

We do not use advertising cookies, third-party analytics, tracking pixels or cross-site profiling. Because our cookies are strictly necessary for the service to work, blocking them in your browser will prevent you from signing in or placing an order.

8. How We Protect Your Data

We maintain reasonable security practices and procedures as required by section 43A of the IT Act and the SPDI Rules, including encryption of traffic in transit over HTTPS, one-way hashing of passwords, HttpOnly session cookies with expiry, role and permission-based access so staff can only reach the records their role requires, and audit logging of staff actions on customer records.

No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for any activity under your account, and should tell us immediately if you believe it has been compromised.

9. How Long We Keep It

• Account data — for as long as your account is active, and for a reasonable period afterwards to resolve disputes and enforce our agreements.
• Order records and tax invoices — for the period required by Indian tax and company law, which is generally eight years, even if you close your account.
• Contact-form messages and quote requests — for as long as needed to deal with the enquiry and keep a record of it.
• Session and security logs — for a short period appropriate to security monitoring.

When data is no longer required for any of these purposes, we delete it or anonymise it so it can no longer be linked to you.

10. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• obtain a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with;
• have inaccurate or incomplete data corrected, updated or completed — much of which you can do yourself from your profile and address pages;
• have your personal data erased where it is no longer needed for the purpose it was collected for, and where we are not required by law to keep it;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• have your grievance addressed by us, and to escalate it to the Data Protection Board of India if you are not satisfied with our response.

You also have a duty under the DPDP Act not to raise frivolous or false complaints and to give authentic information when exercising a correction right.

Visitors from outside India

If you are in the European Economic Area or the United Kingdom, you may also have the right to restrict or object to processing, to receive your data in a portable machine-readable format, and to lodge a complaint with your local supervisory authority. We honour these requests as a matter of policy. To exercise any right, contact our Grievance Officer below. We will verify your identity before acting, and will respond within the timelines in section 12.

11. Children

This website is intended for people aged 18 and over, and we do not knowingly collect the personal data of children. Under the DPDP Act, processing a child's data requires verifiable parental consent, and tracking or targeted advertising directed at children is prohibited — we do neither. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.

12. Grievance Officer and Contact

In accordance with the IT Act and the SPDI Rules, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, the following officer may be contacted about this policy, your personal data, or any grievance about our service:

We will acknowledge your complaint within 48 hours of receiving it, and resolve it within one month, as required by the Consumer Protection (E-Commerce) Rules, 2020. If you are not satisfied with how we have handled a complaint about your personal data, you may escalate it to the Data Protection Board of India.

13. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will always show when it last changed, and where a change materially affects how we use your data, we will notify you by email or through a notice on the website. Continuing to use the site after a change takes effect means you accept the updated policy.

This policy should be read together with our Terms & Conditions and our Refund & Cancellation Policy.