Privacy Policy

1. Definitions and Interpretation

In this Policy, unless the context otherwise requires, capitalised terms have the meanings assigned in this Clause 1 or in the body of this Policy, and headings are for convenience only and shall not affect interpretation. References to “including” mean “including without limitation”. The singular includes the plural and vice versa. A reference to a statute includes all amendments, re-enactments and subordinate legislation. No rule of construction against the drafter (contra proferentem) shall apply. In case of ambiguity, the interpretation most protective of the Company’s legitimate interests, security posture and legal compliance shall prevail to the extent permitted by mandatory law.

• “Affiliate” means any entity that controls, is controlled by, or is under common control with the Company.
• “Business Contact Data” means Personal Data relating to an individual in their professional or commercial capacity (name, designation, employer, official email, official telephone, project role).
• “Consent” has the meaning ascribed under the DPDP Act, and includes deemed, inferred or bundled consent to the extent not prohibited by mandatory law.
• “Data Fiduciary”, “Data Processor” and “Data Principal” have the meanings ascribed under the DPDP Act.
• “Legitimate Use” means any Processing permitted without Consent under the DPDP Act or other applicable law.
• “Processor” / “Vendor” means a third party Processing Personal Data on our documented instructions or as an independent controller for a discrete purpose (analytics, hosting, email, security).
• “Sensitive Personal Data” shall be construed as under applicable Indian law from time to time; you are prohibited from submitting such data via public forms or chat unless we have expressly designated a secure channel for that category.
• “Usage Data” means technical, device, network, log, cookie, pixel, diagnostic, security and telemetry data generated by your interaction with the Services.

2. Identity of the Data Fiduciary; No Designated DPO Unless Required

For the purposes of the DPDP Act, YNM Mega Industries Private Limited is the Data Fiduciary in respect of Personal Data collected through the Services, save and except where we Process solely as a Data Processor on documented instructions of another juristic person (in which event that person remains the Data Fiduciary and this Policy applies only to the extent of our Processor role).

We are not obliged to appoint a Data Protection Officer, consent manager integration, or significant-data-fiduciary enhanced obligations unless and until we are so classified by notification or threshold under the DPDP Act and rules. Correspondence purporting to impose such enhanced duties prior to such classification shall not, of itself, create those duties.

Privacy, access, correction, erasure, nomination and grievance communications must be sent in writing to BOTH sales@ynmsafety.com AND rishu@ynmsafety.com with the exact subject line “DPDP / Privacy Request – [Access|Correction|Erasure|Withdrawal|Nomination|Grievance]”, failing which we may treat the communication as general correspondence and not as a statutory request. Postal: Sy. No. 191 & 192, Plot No. 128, Mankhal Maheswaram, R.R. District, Telangana - 501359, India. Telephone (not a substitute for written request): +91 81215 50143.

3. Scope, Carve-Outs and Hierarchy of Instruments

This Policy applies solely to Personal Data Processed in connection with the Services. It does not apply to: (a) information that has been irreversibly anonymised or aggregated such that re-identification is not reasonably likely using means reasonably available to us; (b) information that is publicly available and was not collected by us from you as Personal Data; (c) deceased persons, except to the extent mandatory law requires otherwise; (d) juristic-person data that is not Personal Data of a natural person; (e) offline Processing undertaken exclusively under a separately negotiated written supply, NDA, employment, or government-tender contract that expressly states it supersedes this Policy for that dataset; or (f) Personal Data Processed by independent third-party websites linked from the Services.

Employee, contractor, intern and director HR files may additionally be governed by internal standing orders, appointment letters and HR policies. Portal users remain concurrently bound by this Policy, the Terms, any NDA, and their employment or engagement instrument. In case of conflict, the instrument most specific to the Processing activity shall apply, without prejudice to mandatory DPDP rights that cannot be contracted out.

Nothing on the Website, in sales literature, FAQs, chat responses, or oral statements of personnel constitutes a representation as to our Processing practices other than this Policy as published on the Effective Date stated above.

4. Categories of Personal Data Processed

WITHOUT ANY OBLIGATION TO PROCESS ALL SUCH CATEGORIES IN RESPECT OF EVERY DATA PRINCIPAL, AND WITHOUT CREATING A DUTY TO COLLECT DATA WE DO NOT NEED, we may Process some or all of the following, as generated by your conduct:

5. Sources of Personal Data

We obtain Personal Data: (a) directly from you; (b) automatically via cookies, pixels, logs, security middleware and analytics; (c) from your authorised colleagues, consultants, employers or principals who name you as a project or commercial contact, in which case YOU are responsible for ensuring such persons had a lawful basis to share your data, and we may treat the submitter as having warranted such authority; (d) from publicly available professional sources (company websites, tender portals, professional directories) for limited B2B outreach consistent with Legitimate Use; and (e) from Processors returning diagnostic or delivery data (email bounce, SMS delivery, CDN logs).

We are under no duty to independently verify the lawful basis of a third party who names you, save as required by mandatory law. If you object, Clause 14 applies.

6. Purposes and Lawful Bases of Processing

We Process Personal Data only for one or more of the following purposes, each of which you are deemed to have understood. Where Consent is relied upon, it extends to all purposes reasonably incidental to the purpose for which you interacted (for example, a quotation request includes credit-assessment, anti-fraud, follow-up, archival and dispute Processing). Where Legitimate Use or legal obligation applies, Consent is not required.

• Responding to enquiries; preparing non-binding quotations; negotiating and performing contracts for goods and services; logistics; after-sales and complaint handling.
• Operating, securing, authenticating, rate-limiting, logging and auditing the Services and portals, including identity verification and session management.
• Recruitment, background-consistency checks limited to information you supply, and talent-pool retention as per Clause 12.
• Improving content, translation, search, UX, capacity planning and product documentation; debugging and preventing regression of security controls.
• Measurement, analytics and (where pixels are active) advertising / remarketing, subject to browser controls which you are solely responsible for configuring.
• Detecting, investigating and prosecuting fraud, scraping, credential stuffing, denial-of-service, unauthorised portal access, and other abuse; sharing indicators of compromise with Processors and, where lawful, authorities.
• Complying with court orders, tax, GST, customs, labour, company-law, FEMA, anti-money-laundering, anti-bribery and sectoral directions; establishing, exercising or defending legal claims.
• Sending transactional notices. Marketing communications shall be sent only where permitted; you may opt out of marketing without affecting transactional mail. Opt-out of marketing is not opt-out of Processing necessary to perform a contract or legal duty.
• Corporate transactions (merger, demerger, amalgamation, slump sale, investment) under confidentiality and, where required, notice.

7. Cookies, Pixels, Local Storage and Similar Technologies

We deploy strictly necessary cookies and similar technologies (session, authentication, CSRF, portals-gate, load-balancing, language, security) without which the Services cannot be provided. YOU MAY NOT DEMAND THAT ESSENTIAL TECHNOLOGIES BE DISABLED WHILE CONTINUING TO USE AUTHENTICATED OR FORM FEATURES.

We may deploy analytics and advertising technologies, including those provided by Google and similar vendors. Such vendors may Process Usage Data as independent controllers under their own policies. Your sole and exclusive mechanism for limiting non-essential cookies is your browser, device OS, industry opt-out pages, and vendor ad-settings. We do not warrant that any particular opt-out will persist across devices, browsers or cookie-clears.

Do not place secrets, passwords, OTPs, payment-card PAN, Aadhaar, PAN or full bank account numbers in query strings. We may strip, ignore or reject tracking and credential-like parameters. Logs may still transiently capture URLs. YOU ASSUME ALL RISK OF DATA YOU PLACE IN URLS OR CLIENT-SIDE STORAGE.

8. Automated Processing, AI Assistants and Human Review

Chat, translation and routing may involve automated, including AI-assisted, Processing. Outputs are informational only, may be incomplete or incorrect, do not constitute professional, legal, engineering or tender advice, and are not an offer. We may log prompts and outputs for security, quality and abuse prevention.

YOU SHALL NOT SUBMIT TO CHAT OR PUBLIC FORMS: passwords, OTPs, full payment-card data, Aadhaar, PAN (unless a designated secure channel expressly requests a masked identifier), health data, or Personal Data of minors. If you do so contrary to this prohibition, you do so at your sole risk, you indemnify us for resulting claims, and our only obligation (subject to backups and legal holds) is to delete or restrict upon a valid Clause 14 request where feasible.

No fully automated decision producing legal effects concerning you is intended in respect of Website browsing. Credit, sanctions or fraud screening in connection with a supply contract may involve automated scoring plus human review; you have no right to a particular scoring methodology.

9. Restricted Portals

Portals are licensed, revocable facilities for authorised personnel only. Access may be gated by shared secrets, individual credentials, IP heuristics and session cookies. We may monitor sessions. Credentials are personal or as allocated by your employer; sharing is a material breach. We may suspend, throttle or terminate access without prior notice for security, inactivity, role change, or suspected abuse, without liability.

You warrant that every file, geotag, selfie and note you upload is accurate, lawful, and that you have obtained all consents and permissions from data subjects depicted or identified. THE COMPANY IS NOT THE ORIGINATING CONTROLLER OF THIRD-PARTY PERSONAL DATA YOU UPLOAD EXCEPT TO THE EXTENT THE DPDP ACT IMPOSES FIDUCIARY DUTIES UPON RECEIPT; YOU SHALL INDEMNIFY THE COMPANY AGAINST CLAIMS BY SUCH THIRD PARTIES.

10. Disclosure; No Sale; Compelled Production

We do not sell Personal Data for monetary consideration. We may disclose Personal Data:

• To Processors (cloud infrastructure including AWS or successors, databases, email/SMTP, SMS, analytics, CDN, security, PDF/export tooling) under confidentiality and purpose limitation no less protective than this Policy to the extent commercially obtainable, WITHOUT ANY WARRANTY THAT A GIVEN PROCESSOR’S STANDARD TERMS EQUAL THIS POLICY IN EVERY RESPECT.
• To Affiliates and authorised sales, logistics or quality partners solely to fulfil your request or a contract.
• To professional advisers bound by professional or contractual confidentiality.
• To courts, tribunals, police, regulators, tax authorities, customs, or the Data Protection Board of India, with or without notice to you where notice is legally prohibited, prejudicial to an investigation, or impracticable.
• To a counterparty in a bona fide corporate transaction, under customary confidentiality.
• To any person with your direction or Consent, or to whom disclosure is a Legitimate Use.

11. Cross-Border Transfer

Primary manufacturing and commercial operations are in India. Processors may Process on infrastructure located in India or in other jurisdictions. BY USING THE SERVICES YOU EXPRESSLY CONSENT TO TRANSFER TO, AND PROCESSING IN, INDIA AND ANY COUNTRY WHERE A PROCESSOR MAINTAINS FACILITIES, INCLUDING COUNTRIES THAT MAY NOT BE THE SUBJECT OF A GOVERNMENT WHITELIST UNDER DPDP RULES FROM TIME TO TIME, TO THE MAXIMUM EXTENT SUCH CONSENT IS VALID. Where a transfer is prohibited by a notified blacklist or equivalent, we shall suspend the affected Processing or rely on another lawful mechanism.

We do not guarantee that a foreign Processor is subject to Indian judicial process. Residual risk of foreign lawful-access requests is accepted by you as a condition of using internet-delivered Services.

12. Retention, Legal Holds and Backups

We retain Personal Data only for so long as, in our reasonable judgement, it is required for the purposes in Clause 6, for limitation-period protection, tax and company-law retention, security investigations, or a legal hold. INDICATIVE PERIODS BELOW ARE GUIDELINES ONLY, ARE NOT COMMITMENTS, AND MAY BE EXTENDED WITHOUT NOTICE WHERE A TRIGGER EVENT OCCURS.

• Sales / quote / chat enquiries: up to thirty-six (36) months after last meaningful contact, or longer if a tender, contract or dispute is pending or reasonably anticipated.
• Contracts, invoices, e-way bills and accounting records: as required by the Income-tax Act, GST law and Companies Act (often eight (8) years or longer from the end of the relevant year).
• Career applications: up to twenty-four (24) months unless you are hired (then HR retention applies) or you consent to a longer talent pool.
• Portal operational records: duration of authorisation plus a commercially reasonable archive, typically not less than thirty-six (36) months, longer for quality traceability.
• Security and access logs: typically ninety (90) to three hundred sixty-five (365) days, longer if an incident is under review.
• Backups: rotated on a cycle we determine; erasure from production systems does not guarantee immediate erasure from encrypted backups prior to expiry of the backup cycle.

13. Security; Residual Risk Accepted

We implement technical and organisational measures that we, in our sole professional judgement, consider reasonable having regard to the nature of data, state of the art, cost of implementation, and likelihood and severity of risk. Measures may include TLS in transit, access control, least privilege, origin and referer checks, rate limiting, session-cookie attributes, secrets management, network segmentation and monitoring. SUCH MEASURES DO NOT CONSTITUTE A WARRANTY, GUARANTEE, OR INSURANCE. THE INTERNET IS INHERENTLY INSECURE. YOU ACCEPT ALL RESIDUAL RISK OF UNAUTHORISED ACCESS, INTERCEPTION, UNAVAILABILITY AND CORRUPTION, EXCEPT TO THE EXTENT CAUSED BY OUR WILFUL MISCONDUCT OR TO THE EXTENT MANDATORY LAW IMPOSES A NON-EXCLUDABLE DUTY.

You shall notify us in writing within twenty-four (24) hours of becoming aware of any actual or suspected compromise of your credentials or of Personal Data relating to our Services in your possession. Delay in notice shall be deemed a material breach of your duties under the Terms.

14. Data Principal Rights — Conditions, Exceptions and Procedure

SUBJECT ALWAYS TO THE DPDP ACT AND OTHER MANDATORY LAW, AND ONLY TO THE EXTENT SUCH RIGHTS ARE IN FORCE AND APPLICABLE TO US, you may request: (a) a summary of Personal Data and Processing activities; (b) correction of inaccurate or incomplete Personal Data we control; (c) erasure where the DPDP Act so requires and no exception applies; (d) withdrawal of Consent for Consent-based Processing; (e) nomination of another individual in the manner prescribed by rules when notified; (f) grievance redressal; and (g) opt-out of marketing.

RIGHTS ARE NOT ABSOLUTE. WITHOUT LIMITATION, WE MAY REFUSE, LIMIT, DELAY OR CHARGE A REASONABLE FEE (WHERE PERMITTED) IF: the request is unfounded, excessive, repetitive, or manifestly vexatious; identity is not verified to our satisfaction; fulfilment would adversely affect the rights of others, reveal trade secrets, threaten security, or prejudice a legal claim or investigation; data is required for a legal obligation, tax, audit or Legitimate Use; data is embedded in backups not reasonably segregable; or you request a format, API, or forensic dump we do not ordinarily produce.

We may take the period permitted by law (and a further reasonable period for complex or multiple requests). Silence after that period shall not be deemed acceptance of your characterisation of the facts. We may fulfil by pointing you to self-service information already displayed in a portal.

15. Grievance Redressal and Data Protection Board

Internal grievance: rishu@ynmsafety.com with copy to sales@ynmsafety.com, subject “Grievance – Privacy”, with full particulars, supporting documents, and the specific relief sought. We may require notarised or digitally signed identity proof.

You shall exhaust this internal process before approaching the Data Protection Board of India or any other forum, except where mandatory law permits direct approach. Nothing herein confers jurisdiction on any foreign data-protection authority.

16. Children and Persons with Disability

THE SERVICES ARE DIRECTED EXCLUSIVELY TO BUSINESSES, PROFESSIONALS AND ADULTS OF FULL LEGAL CAPACITY. We do not knowingly solicit Personal Data from children (including persons under eighteen (18) years where that is the relevant age). Verifiable consent of a parent or lawful guardian, in the form prescribed by rules when applicable, is required before we knowingly Process a child’s Personal Data. If you believe we have inadvertently received such data, notify us under Clause 14 for deletion, subject to legal holds. Processing in respect of persons with disability shall follow nominated-representative rules when notified; until then, ordinary agency and guardianship law applies.

17. Third-Party Services

Links to maps, social networks, payment or government portals are provided as a convenience. THEIR PRIVACY PRACTICES ARE ENTIRELY OUTSIDE OUR CONTROL. Access is at your sole risk. This Policy does not bind such third parties.

18. Country Market Pages, National Flags and Geographic Presentation

The Website includes country / export-market landing pages and may display national, territorial or civic flags, colours, emblems, city names and similar symbols (“National Symbols”). THOSE PAGES AND SYMBOLS ARE NOT A PROCESSING OF YOUR NATIONALITY, CITIZENSHIP, ETHNICITY, RELIGION OR POLITICAL OPINION. Landing on, linking to, or remaining on a Country Page does not constitute a declaration that you are a national of that State, and we do not treat it as such. The Company’s sole purposes are to promote Goods toward buyers in or for that market and to present a market-specific Website design. The Terms (Clause 15) are controlling as to meaning, accuracy, stylisation, regret without admission, exclusive remedy, and IP in National Symbols.

Approximate location inferred from IP address, language preference, or the Country Page you request is Usage Data under Clause 4.5, used only for the purposes in Clause 6 (including content presentation, analytics and security). WE DO NOT BUILD A CITIZENSHIP, IMMIGRATION, SANCTIONS OR POLITICAL PROFILE FROM THE FLAG YOU SEE OR THE COUNTRY PATH YOU OPEN. Flags and hero artwork are not identity documents and are not used to identify a natural person.

WITHOUT PREJUDICE AND WITHOUT ADMISSION OF LIABILITY, if a Country Page or National Symbol is wrong, incomplete, or causes unintended offence, the Company is sorry that this occurred; the exclusive process and remedies are those in the Terms, Clause 15. A privacy request under Clause 14 is not the correct channel for a flag-accuracy or emblem complaint unless Personal Data of a named individual is actually involved.

19. Changes; Constructive Notice

We may amend this Policy at any time by posting a revised version at https://ynmsafety.com/privacy-policy and updating the “Last updated” legend. MATERIALITY SHALL BE DETERMINED BY US IN GOOD FAITH. We are not obliged to provide individual notice except where mandatory law requires it. CONTINUED USE AFTER POSTING CONSTITUTES ACCEPTANCE. It is your duty to review this URL periodically. The version published at the time of a given Processing activity governs that activity, except that security and disclosure clauses of the then-current Policy may apply retrospectively to residual stored data to the extent permitted by law.

20. Limitation of Privacy-Related Claims

ANY CLAIM, COMPLAINT OR CAUSE OF ACTION ARISING OUT OF OR RELATING TO THIS POLICY OR OUR PROCESSING OF PERSONAL DATA MUST BE COMMENCED WITHIN NINETY (90) DAYS AFTER YOU FIRST BECAME AWARE, OR OUGHT REASONABLY TO HAVE BECOME AWARE, OF THE FACTS GIVING RISE THERETO, AND IN ANY EVENT WITHIN ONE (1) YEAR OF THE RELEVANT PROCESSING EVENT, WHICHEVER IS EARLIER, EXCEPT WHERE A LONGER PERIOD IS MANDATORILY FIXED BY STATUTE AND CANNOT BE SHORTENED. FAILURE TO DO SO CONSTITUTES AN IRREVOCABLE WAIVER TO THE MAXIMUM EXTENT PERMITTED BY LAW. LIABILITY CAPS, EXCLUSIONS AND INDEMNITIES IN THE TERMS APPLY TO PRIVACY CLAIMS TO THE FULLEST EXTENT PERMITTED, SAVE THAT NOTHING EXCLUDES LIABILITY THAT CANNOT LAWFULLY BE EXCLUDED.

21. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the arbitration election in the Terms and to the jurisdiction of the Data Protection Board of India for matters exclusively assigned to it, the courts at Hyderabad, Telangana, India shall have exclusive jurisdiction, without prejudice to our right to seek interim, injunctive or enforcement relief in any other forum.

22. Contact

YNM Mega Industries Private Limited (YNM Safety)

Address: Sy. No. 191 & 192, Plot No. 128, Mankhal Maheswaram, R.R. District, Telangana - 501359, India

Email: sales@ynmsafety.com · rishu@ynmsafety.com

Phone: +91 81215 50143

Website: https://ynmsafety.com