Privacy Policy

Last updated: 24 October 2026

1. Compliance with Digital Personal Data Protection (DPDP) Act, 2023

This Privacy Policy is formulated in strict accordance with the Digital Personal Data Protection (DPDP) Act, 2023 (Act No. 22 of 2023) enacted by the Parliament of India, read alongside the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

• Data Fiduciary vs Data Processor Roles:

(a) Merchant as Data Fiduciary: When you (the merchant/store owner) enter customer personal data (such as customer name, phone number, vehicle details, or khata balances), you are the Data Fiduciary determining the purpose of processing.

(b) DSR MATRIX as Data Processor: DSR MATRIX operates solely as a Data Processor providing software tools, multi-tenant database infrastructure, and automated billing workflows under your explicit direction.

2. Purpose-Bound Data Collection (Section 6, DPDP Act 2023)

We collect and process digital personal data strictly for specified, legitimate business purposes:

  • Merchant Profile & Credentials: Owner full name, verified business email, 10-digit mobile number, business name, and encrypted password (bcrypt) for authentication and statutory tax invoicing.
  • Commercial Invoicing Data: Product catalog, inventory batch numbers, purchase bills, and sales transactions necessary for GST self-filing and compliance.
  • IT Act 2000 Section 65B Audit Logs: Tamper-evident electronic records including login timestamps, user roles, IP addresses, and device fingerprints to protect against unauthorized account breaches and cyber fraud.
  • Zero Payment Storage: We do NOT store debit/credit card CVVs, netbanking PINs, or UPI MPINs. All transactions are securely routed through RBI-licensed payment aggregators (Razorpay / Stripe) adhering to PCI-DSS standards.

3. Technical Safeguards & Multi-Tenant Database Isolation

To prevent accidental or unlawful destruction, loss, alteration, or unauthorized disclosure:

  • PostgreSQL Schema-Per-Tenant Physical Walls: Your store data is maintained inside an isolated database schema (tenant_xyz). Other business subscribers on the platform cannot access, view, or query your data.
  • Data in Transit & at Rest: All web traffic is encrypted using 256-bit TLS 1.3 encryption. Cloud databases utilize automated AES-256 transparent data encryption (TDE).
  • Automated Disaster Recovery: Cloud servers run automated point-in-time recovery (PITR) backups with strict geo-redundancy within India (Central India Azure region).

4. Data Principal Rights (Sections 11, 12, 13 & 14, DPDP Act 2023)

Every individual whose personal data is processed under this platform possesses legally guaranteed rights:

Right to Access & Portability (Section 11)

You have the right to a summary of personal data processed. You can export your entire product catalog, customer khata ledger, purchase records, and sales books at any time via 1-Click CA Master Excel and CSV Export.

Right to Correction & Erasure ("Delete My Account") (Section 12)

You have the right to request correction of inaccurate data or complete erasure of your store account and personal data. Upon receiving a verified request via your registered email or the Settings console, your tenant database schema and authentication records will be permanently expunged within 30 days, subject only to statutory tax retention rules mandated under the Central Goods and Services Tax (CGST) Act, 2017.

Right of Grievance Redressal (Section 13)

If you have any questions or unresolved privacy concerns, you have the statutory right to seek redressal from our designated Data Grievance Officer or escalate to the Data Protection Board of India (DPBI).

Right to Nominate (Section 14)

In the event of death or incapacity, a registered store owner may designate a nominee to exercise data access and account transfer rights.

5. Data Retention & Statutory Accounting Rules

In accordance with Section 8(7) of the DPDP Act 2023, personal data is retained only as long as your subscription is active or as necessary to satisfy legal obligations. Under Section 36 of the CGST Act 2017, business sales invoices and tax records must be preserved for 72 months (6 years). Upon account closure, all non-tax personal identifiers are deleted, and operational accounts are permanently deactivated.

6. Statutory Data Protection & Grievance Redressal Officer

In compliance with Section 8(9) of the DPDP Act 2023, the contact details of our designated Data Grievance Redressal Officer are published below:

Designation: Data Grievance Redressal Officer

Organization: DSR MATRIX TECHNOLOGIES (dsrmatrix.com)

Official Compliance Email: privacy@dsrmatrix.com

Direct Helpline / WhatsApp: +91 79893 19230 / +91 85000 34230

Jurisdiction & Governing Law: Courts of Hyderabad / Bengaluru, Republic of India

Response Turnaround: Maximum 48 working hours acknowledging receipt; full resolution within 30 days.

For any privacy-related concerns, please email us at support@dsrmatrix.com