Privacy policy

Who we are and what this covers

B & R Creations (“we”, “us”) is a corporate gifting business based in Haryana, India. This policy explains what personal data we collect when you use https://brcreates.com, contact us on WhatsApp, phone or email, or place an order, and what we do with it.

It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, including the Reasonable Security Practices and Sensitive Personal Data Rules, 2011. We deal mainly with businesses, but the people who contact us and the employees who receive gifts are individuals, and their data is treated with the same care.

What we collect

Information you give us

• Contact details: name, designation, company, phone number and email address.
• Billing details for invoicing: legal entity name, GSTIN, billing address and purchase order references.
• Delivery details: office addresses and, for multi-location dispatch, the names, phone numbers and home addresses of individual recipients that you share with us.
• Artwork: logos, brand guidelines and any text you ask us to print or engrave.
• The content of your messages, enquiries and quote requests.

Information collected automatically

This website is a static site. Our hosting provider keeps standard server logs (IP address, browser type, pages requested and time of request) for security and capacity planning. We do not run advertising trackers or build behavioural profiles.

What we do not collect

We never ask for card numbers, net-banking passwords or UPI PINs on this website or over WhatsApp. Payments are made by bank transfer, UPI or cheque directly to the account named on your proforma invoice.

How we use it

• To answer your enquiry and prepare quotes, shortlists and mockups.
• To produce, pack, dispatch and track your order, including sharing tracking details with you.
• To raise proforma and GST invoices and keep the records Indian tax law requires.
• To send order updates on WhatsApp, email or phone, which is the primary way we communicate.
• To tell existing clients about seasonal collections such as Diwali, if they have asked to hear from us.
• To keep the website secure and understand which pages are useful.

We do not sell personal data, and we do not use it for third-party advertising. We rely on your consent and on the legitimate use of carrying out the order you have asked for, as the DPDP Act allows.

Data you share about employees and recipients

When you send us an address sheet for multi-location dispatch, your organisation decides why that data is collected and we process it only on your instructions. In DPDP Act terms you are the data fiduciary and we act as a data processor.

• We use recipient details only to pack, label and deliver the parcel and to resolve delivery issues.
• Details are shared with the courier handling that parcel and with nobody else.
• Recipient sheets are deleted 60 days after the last delivery from that order, once the claims window has closed.
• Please share address sheets through email or a protected link rather than public documents.

WhatsApp, email and third-party services

• WhatsApp is operated by Meta Platforms. Messages you send us are end-to-end encrypted in transit but are subject to WhatsApp’s own privacy policy. Links on this site open WhatsApp with a pre-filled message; nothing is sent until you press send.
• Email to brcreations.office@gmail.com is handled by Google's mail servers, which may be located outside India.
• Google Maps is embedded on the contact page and loads only when you scroll to it. Google may set cookies and record your IP address when the map loads.
• Image delivery: product and lifestyle photographs may be served from third-party content delivery networks, which receive your IP address in order to send the image.
• Couriers: delivery partners receive the recipient name, phone number and address for each parcel.

Cookies and local storage

We do not set advertising or cross-site tracking cookies. The website uses your browser’s local storage for three things only: the products you add to your quote list, the contact details you last typed into a quote form (so you do not have to retype them), and whether you have dismissed the quote pop-up (so it does not reappear for 24 hours). This data stays on your device, is never sent to us, and is removed when you clear your browser’s site data.

Who we share data with

• Courier and logistics partners, for delivery only.
• Production partners who brand or pack products: they receive artwork and quantities, never contact lists.
• Our accountants and, where the law requires, tax and regulatory authorities.
• Law enforcement or courts when we are legally obliged to respond.

We do not sell, rent or trade personal data, and we do not share client lists with other clients.

How long we keep it

• Enquiries that do not become orders: up to 24 months after our last exchange, so we can pick up the conversation.
• Orders, invoices and payment records: at least eight financial years, as required under the Goods and Services Tax Act and the Income-tax Act.
• Artwork and approved mockups: kept for repeat orders unless you ask us to delete them.
• Recipient address sheets: deleted 60 days after the last delivery (see above).

Your rights

Under the DPDP Act you can ask us to:

• Confirm what personal data we hold about you and provide a summary of it.
• Correct or update inaccurate or incomplete data.
• Erase data we no longer need for an order or a legal obligation.
• Withdraw consent for marketing messages at any time by replying “stop” or emailing us.
• Nominate another person to exercise these rights on your behalf.

Email brcreations.office@gmail.com with the subject line “Data request”. We may ask you to confirm your identity, and we respond within 30 days.

Security

The site is served over HTTPS. Artwork, address sheets and invoices are stored on access-controlled drives available only to the team members working on your order. Devices are password-protected and encrypted. No method of storage or transmission is completely secure, so if you believe your data has been compromised, tell us immediately and we will investigate and inform you of the outcome.

Children

Our services are offered to businesses and organisations. The website is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has shared data with us, email us and we will delete it.

Changes to this policy

We will update this page when our practices or the law change and show the date of the latest version at the top. Significant changes affecting existing clients will also be announced by email.

Grievance officer and contact

For questions, requests or complaints about personal data, contact our Grievance Officer, as required under the Information Technology Rules and the DPDP Act:

• B & R Creations, Haryana, India
• Email: brcreations.office@gmail.com
• Phone: +91 7082787837 (Monday – Saturday, 10:00 AM – 7:00 PM IST)

We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.