Privacy Policy & Data Notice

📄 1. Introduction & Scope

This Privacy Policy outlines how Hindustan Sanitary House ("we", "us", "our") processes, protects, and respects personal data when you access or interact with our official website (https://hindustansanitaryhouse.in/). We provide wholesale and retail supply of sanitaryware, CPVC/UPVC/HDPE pipes, water pumps, overhead tanks, and Jal Jeevan Mission (JJM) project materials in Jorhat and Assam.

We are dedicated to safeguarding your personal data in full compliance with the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the Digital Personal Data Protection Rules, 2025, respecting their phased enforcement. We collect only what is genuinely necessary, ensure data minimization, provide clear consent controls, and never sell or rent your personal details.

🏛️ 2. Data Fiduciary Identity

Under Section 2(i) of the DPDP Act, 2023, the Data Fiduciary that determines the purpose and means of processing personal data collected through this website is:

🔍 3. What Information Is Genuinely Collected?

We believe in strict data minimization. We only collect information that you knowingly submit or that is essential for delivering secure web services. Following our thorough technical audit of the website's codebase, forms, and APIs, we confirm that only the following categories of data are collected:

A. Information You Voluntarily Provide

• Contact & Product Enquiry Forms (index.html, products.html):
  • Full Name
  • 10-Digit Mobile / Telephone Number
  • Email Address (optional)
  • Selected Product Category (e.g., Pipes & Fittings, Bathware, Tanks & Pumps, JJM Supply)
  • Specific Message or Requirements
• Interactive AI Website Assistant: Questions, product inquiries, or queries submitted during your chat session with our virtual catalog guide.

B. Technical & Infrastructure Information (Automated)

• Server Security & Network Routing Logs: IP address, user-agent string (browser type/version), operating system, requested page URL, timestamp, and HTTP response code. These are processed ephemerally by our hosting infrastructure and Cloudflare reverse proxy for DDoS mitigation, bot blocking, and network security.
• Anonymous Performance Analytics (Consented Only): When you grant explicit consent for analytics, Cloudflare Web Analytics collects aggregate metrics (page load timing, country, device class) via a privacy-first beacon. It does not use cross-site tracking cookies or track individual visitor identities.
• Local Browser Storage (Client-side Only):
  • hsh_cookie_consent: Stores your cookie preferences (Essential, Analytics), version, and timestamp in your browser's localStorage so we do not repeatedly prompt you.
  • hsh_ann_dismissed: Stores a temporary session flag in sessionStorage when you close a top announcement banner.

🎯 4. Why Is Information Collected? (Specified Purposes)

Under Section 4 and Section 6 of the DPDP Act 2023, personal data is processed strictly for specified, lawful purposes:

1. Responding to Customer Enquiries & Quotations: To follow up on your request regarding plumbing fittings, sanitaryware, pumps, tanks, or Jal Jeevan Mission supply requirements via telephone, WhatsApp, or email.
2. Catalog & Product Guidance: To answer your questions through our store assistant and help you select appropriate items conforming to IS/BIS standards.
3. Website Security & Operational Integrity: To prevent cyberattacks, brute-force requests, DDoS threats, spam submissions, and unauthorized automated harvesting.
4. Consented Website Performance Optimization: With your permission, aggregate pageview metrics help us identify slow-loading pages and improve catalog navigation.

We do not use your personal information for automated profiling, behavioural advertising, credit evaluation, or bulk commercial email marketing.

⏱️ 5. Data Retention Schedule

In accordance with the DPDP principle of storage limitation, personal data is retained only for as long as necessary to fulfill the purpose for which it was collected or to comply with statutory obligations.

Note: Data retention periods flagged for business review are scheduled for formal annual review by the shop proprietors. Where legal, tax, or GST obligations apply (e.g. issued tax invoices under GSTIN 18ADGPG3640M1ZF), physical and accounting records are preserved for the statutory period mandated by Indian tax law.

🤝 6. Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data. We engage select, trusted infrastructure and technical service providers who assist us in operating this website. Each third party processes data solely on our instructions and under strict security standards:

🍪 7. Cookie Policy & Consent Management

Our website uses a transparent, modern cookie management system compliant with the DPDP Act. We never preselect optional tracking cookies.

• Essential Cookies: Strictly required for basic website operation, security, and storing your consent preferences. They cannot be disabled.
• Analytics Cookies: Optional. Cloudflare Web Analytics is kept disabled by default and only activates if you click "Accept All" or toggle Analytics to ON.
• Marketing Cookies: We do not deploy any third-party marketing or ad retargeting trackers.

You can review, change, or withdraw your cookie preferences at any time by clicking the button below or via the persistent "Cookie Settings" link in the footer of every page:

⚖️ 8. Your Rights as a Data Principal (DPDP Act, 2023)

As a Data Principal residing in India, you are entitled to statutory rights under Chapter III of the Digital Personal Data Protection Act, 2023:

1. Right to Access Information (Section 11): You have the right to obtain a summary of personal data about you that is being processed by us and the identities of third parties with whom it has been shared.
2. Right to Correction & Updating (Section 12): You may request the correction of inaccurate or misleading personal data, completion of incomplete data, and updating of your contact details.
3. Right to Erasure (Section 12): You have the right to request the erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to statutory retention requirements.
4. Right to Withdraw Consent (Section 6(4)): Where processing is based on your consent, you have the right to withdraw that consent at any time as easily as it was given. Withdrawal does not affect lawful processing prior to withdrawal.
5. Right of Grievance Redressal (Section 13): You have the right to readily available grievance redressal in respect of any act or omission by us regarding your personal data.
6. Right to Nominate (Section 14): You have the right to nominate an individual who, in the event of death or incapacity, shall exercise your rights.

To exercise any of these rights, please contact our designated privacy contact detailed in Section 11 below. We will verify your identity and respond within 30 days as prescribed by law.

🔒 9. Security Safeguards & Data Breach Response

In accordance with Section 8(5) of the DPDP Act 2023, we implement reasonable technical and organizational security safeguards to protect personal data from accidental or unlawful destruction, loss, alteration, or unauthorized access:

• HTTPS & TLS 1.3: All communications between your browser and our server are encrypted in transit.
• Content Security Policy (CSP): Strict headers prevent unauthorized cross-site scripting (XSS) and code injection.
• Access Controls: Enquiries received via email are restricted to authorized store management with two-factor authentication.
• Personal Data Breach Protocol: In the unlikely event of a personal data breach affecting your data, we maintain procedures to contain the incident, investigate the cause, and notify the Data Protection Board of India (DPBI) and affected Data Principals in the form and manner prescribed by the DPDP Rules 2025.

👶 10. Protection of Children's Personal Data

Under Section 9 of the DPDP Act, 2023, enhanced safeguards apply to children's personal data. Hindustan Sanitary House is a business-to-consumer and wholesale supplier of building, plumbing, and sanitary supplies. Our website is intended for adults, contractors, builders, architects, and property owners seeking bathroom fixtures and pipes.

We do not knowingly collect personal data from children under 18 years of age without verifiable parental consent. If we become aware that a child under 18 has submitted personal data through our enquiry form without parental consent, we will promptly delete that data from our records.

📞 11. Website Privacy & Developer Contact

For any questions regarding this Privacy Policy, your cookie preferences, exercise of Data Principal rights, or technical website queries, please reach out to our designated website developer and technical privacy contact: