Privacy Policy
What personal data we collect through the Atreyo store, and how we treat it
Effective Date: 31 August 2026 · Version 2.2
This Privacy Policy applies to personal data that Atreyo Research and Development Pvt. Ltd. ("Atreyo", "we") collects and processes when you use our online store at www.atreyo.in. It is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and Section 43A of the Information Technology Act, 2000 read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules").
Atreyo has published a broader privacy policy for its corporate website at www.atreyo.in/en/privacy-policy. This document sits alongside it and covers the specific data flows that arise when you buy a product from our store — placing an order, paying for it, having it shipped within India, and receiving support afterwards.
1. Who is responsible for your data
For the purposes of the DPDP Act, Atreyo is the Data Fiduciary in respect of the personal data described here. If you have questions or want to exercise any right described below, please write to us at support@atreyo.in or contact our Grievance Officer (details in section 8).
2. What we collect
We collect only what we need to run the store, ship your order, meet our legal obligations, and support you afterwards.
2.1 You give it to us
• your name and, for business orders, your organisation name;
• billing and shipping addresses within India;
• email address and phone number;
• GSTIN (only if you provide it for tax-compliant invoicing);
• account credentials (email and a hashed password, if you register);
• information you send when you write to support, request a warranty claim, or raise a grievance.
2.2 Collected automatically when you visit the store
• IP address and approximate location derived from it;
• device and browser identifiers, operating system, and language settings;
• pages viewed, referral source, and timestamps of your visit;
• essential cookies needed for the shopping cart, login, and checkout (see our Cookie Policy).
Consistent with our long-standing policy on the corporate website, we do not run third-party advertising trackers or use third-party analytics platforms like Google Analytics on the store. Where we need aggregate usage statistics for improvement, we rely on server logs and on aggregate reports from our hosting infrastructure.
2.3 From our payment and logistics partners
Our payment gateway shares with us the outcome of your transaction (success, failure, reference number) and the last four digits of the card, but not your full card number or CVV. Courier partners share tracking events and delivery confirmations.
3. Why we use it
We use your data only for reasons connected with your order and our relationship with you:
• to process your order, collect payment, and arrange shipping within India;
• to keep you informed about the status of your order and any follow-up (invoices, dispatch alerts, warranty communications, service updates);
• to answer your questions and resolve support tickets or grievances;
• to comply with obligations under Indian law — for example, retaining invoices under the Central Goods and Services Tax Act, 2017, and books of account under the Companies Act, 2013;
• to detect and prevent fraud and to protect the security of our systems;
• with your consent (and only with your consent), to send occasional product announcements or newsletters that you can unsubscribe from at any time.
We do not use your data for automated decision-making that produces legal or similarly significant effects on you.
4. The legal basis on which we process
Under the DPDP Act we process personal data on the basis of your consent given at the time of the transaction, and — where the Act permits — for certain 'legitimate uses' such as fulfilling a purpose for which you have voluntarily provided data. Under the SPDI Rules, sensitive personal data (as defined in Rule 3) is processed only with your consent and only for the purpose for which it was collected.
5. Who we share your data with
We do not sell your personal data to anyone. We share it only with specific categories of recipients, and only to the extent needed:
• the payment gateway that processes your transaction;
• the courier that delivers your order within India;
• our chartered accountants, auditors, and legal advisors, under confidentiality;
• our hosting and IT-infrastructure providers, under contractual data-protection commitments;
• government or regulatory authorities where a valid legal request requires disclosure — a subpoena, court order, GST enquiry, or similar.
We may also share aggregate, non-identifiable data (for example, total number of orders in a month) for reporting purposes.
6. Where your data is stored
Personal data collected through the store is primarily stored and processed within India, on infrastructure operated for us by reputable cloud and hosting providers. Where any processing occurs outside India — for example, a service provider that maintains support facilities abroad — we do so in a manner consistent with the DPDP Act and any restrictions notified by the Central Government under Section 16 of that Act.
7. How long we keep it
Retention is driven by the purpose and the applicable law. In broad terms:
• order records, tax invoices, and related communications — 8 years, per the Companies Act, 2013 and the CGST Act, 2017;
• warranty records — for the full warranty period plus 3 years;
• account data — while your account is active, plus 3 years after inactivity, after which it is deleted or anonymised;
• server and access logs — up to 12 months;
• marketing consent records — until you withdraw consent, plus a short residual period to evidence the withdrawal.
8. Your rights and how to exercise them
Under the DPDP Act you can ask us to:
• confirm what personal data we hold about you and provide a summary of it;
• correct anything that is inaccurate or incomplete, and complete any incomplete data;
• erase your data where it is no longer needed and we are not required to keep it;
• withdraw consent for uses that rely on consent (this does not affect prior lawful processing);
• nominate a person under Section 14 of the DPDP Act to exercise your rights in the event of your death or incapacity;
• raise a grievance with our Grievance Officer regarding any act or omission of Atreyo affecting your rights.
To exercise any right, please email support@atreyo.in. We will acknowledge your request within 7 days and respond substantively within 30 days (or the shorter period required by law). We may need to verify your identity before we act, especially where the request could affect someone else's data.
Our Grievance Officer under Rule 3(2) of the IT (Intermediary Guidelines) Rules, 2021 and under Section 8(9) of the DPDP Act:
• Name: [Grievance Officer name to be inserted]
• Email: support@atreyo.in
• Address: Atreyo Research and Development Pvt. Ltd., 414, Sunrise Complex, Mansi Cross Road, Ahmedabad — 380052, Gujarat, India
• Working hours: Mon–Fri, 10:00–18:00 IST
If you are not satisfied with the response, you may complain to the Data Protection Board of India once it becomes operational.
9. How we protect your data
We follow the security practices required under Section 43A of the IT Act read with the SPDI Rules, 2011, and update them as the technology and threat landscape evolves. Our safeguards include transport-layer encryption (HTTPS/TLS), role-based access controls, hardening of production systems, regular security review, secure backups, and vendor due-diligence on our processors. That said, no system on the internet is invulnerable. In the unlikely event of a personal-data breach that is likely to cause significant harm, we will notify affected users and the Data Protection Board within the statutory timeline.
10. Cookies
For details of the cookies we use on the store and how you can control them, please see our Cookie Policy.
11. Changes to this Policy
We will update this Policy from time to time. The current version is always available at www.atreyo.in. If we make a change that materially affects your rights, we will highlight it on the store and — where you have an account — email you before it takes effect.
How to reach us
For any questions about this document, please contact us at our India office:
• Atreyo Research and Development Pvt. Ltd.
• Registered office: 414, Sunrise Complex, Mansi Cross Road, Ahmedabad — 380052, Gujarat, India
• GSTIN: 24ABFCA4789H1ZF
• Email: support@atreyo.in
• Phone: +91 9727741417 (Mon–Fri, 10:00–18:00 IST, excluding public holidays)
• Website: www.atreyo.in · Technical documentation: docs.atreyo.in