Copyright © 2025 Artisan Furniture India. All rights reserved.
Artisan Furniture India
India Privacy Policy
1. Introduction
Artisan Furniture (“Artisan”, “we”, “our”) values your trust and is committed to safeguarding your personal data.
This Privacy Policy explains how we handle personal data in India, in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
We operate primarily as a B2B business. Our customers are resellers and trade partners. We also process end-customer details (name, address, contact) strictly for delivery purposes in our dropship model.
2. Who We Are
- Global Vision Direct Private Limited, registered in India, is the local operating entity of Artisan Furniture.
- The company is controlled through Amit Basu (Ultimate Beneficial Owner & Person of Significant Control).
- Role allocation:
- Data Fiduciary for Indian B2B customer data.
- Data Processor for end-customer details provided by B2B clients (to enable deliveries).
3. What Personal Data We Process
We may process the following personal data:
- B2B Trade Customers (our direct clients):
- Business contact information (name, email, phone, job title, company).
- Login details (username/password, portal access records).
- Payment and invoicing details.
- Communications (emails, chats, calls, support records).
- Technical data (IP address, device/browser, cookies).
- End Customers (delivery recipients):
- Name, delivery address, postcode.
- Phone number and email (to enable courier delivery and notifications).
- Provided exclusively by resellers.
We do not knowingly process sensitive personal data or children’s data.
4. Why We Use Personal Data
We process personal data for:
- Order fulfilment and delivery.
- Providing B2B services (ERP portals, ArtisanFlo, inventory, APIs).
- Payments and invoicing (via secure gateways).
- Customer support (calls, email, Flo AI assistant).
- Regulatory compliance (tax, customs, trade laws).
- Security, fraud prevention, and audits.
- Improving services (aggregated, anonymised analytics).
We do not use personal data for direct marketing to end customers.
5. Legal Grounds (DPDP Act)
We rely on the following lawful grounds under the DPDP Act:
- Consent: freely given, specific, and informed (e.g., marketing to B2B clients, cookies/analytics).
- Legitimate Uses (Section 7 DPDP Act):
- Processing to perform contractual obligations (fulfilment, shipping).
- Processing by an employer for employment-related purposes.
- Processing required by law (tax, compliance).
- Processing in the public interest (fraud prevention, security).
Where we act as a Data Processor on behalf of B2B clients, we process end-customer data strictly on their instructions.
6. Cross-Border Transfers to India
- Data from UK, EU, US, Canada, and Australia may be transferred to India for operational support, logistics, and IT services.
- Indian customer data remains within India unless otherwise stated or required.
- We implement contractual safeguards (SCCs, IDTA, DPAs) with our group companies and clients to ensure that transfers into India meet international standards.
- Data transferred into India is encrypted, access-controlled, and processed on a need-to-know basis.
7. How We Share Data
We may share data with:
- Group companies (UK parent, affiliates).
- Courier partners (DHL, UPS, local Indian carriers).
- Payment gateways (PayPal, iwocaPay, local banks).
- Cloud hosting providers (AWS, Azure; servers may be located in India, UK, or US).
- Communication providers (e.g., Twilio, SendGrid).
- Approved developers and IT service providers (subject to confidentiality and DPAs).
- Regulators or law enforcement when required by Indian law.
We do not sell or trade personal data.
8. Data Retention
We keep personal data only as long as necessary:
- B2B account and financial data: active + 7 years.
- End-customer delivery data: retained only for fulfilment and audit (generally up to 7 years).
- Support records: 3 years.
- Cookies/analytics: per Cookie Notice.
9. Data Security
We take reasonable technical and organizational measures:
- Encryption in transit and at rest.
- Role-based access controls and authentication (MFA).
- Secure cloud hosting and vendor contracts.
- Monitoring, audits, and penetration testing.
Incident response plan and breach notification to the Data Protection Board of India when required.
10. Your Rights (DPDP Act 2023)
As a Data Principal, you have the right to:
- Access your personal data.
- Seek correction of inaccuracies.
- Request erasure when data is no longer necessary.
- Nominate another person to exercise rights in case of death/incapacity.
- Grievance redressal within prescribed timeframes.
- Complain to the Data Protection Board of India if unsatisfied with our response.
11. Consent Managers
Where applicable, you may manage or withdraw consent through a registered Consent Manager recognized under the DPDP Act.
12. Children’s Data
Our services are business-focused. We do not knowingly process children’s personal data.
13. Contact & Grievance Redressal
Grievance Officer (India)
Global Vision Direct Private Limited
Global Factory, Plot #1216/2, Mahapura Road, Jaipur-Mumbai Highway, Bhankrota, Jaipur – 302026, Rajasthan, India
Email: [Insert grievance email]
Phone: [Insert]
If you are not satisfied with our response, you may contact the Data Protection Board of India.
14. Updates
We may update this policy periodically to reflect changes in law or operations. Updates will be posted with a new Effective Date.
✅ This Indian Privacy Policy is built for DPDP Act compliance, acknowledges cross-border transfers into India, and clearly sets out rights, grievance redressal, and consent management.
CONTRACTUAL CROSS-REFERENCE
Must be construed together with the Master Terms & Conditions.
Applies concurrently with the applicable Regional Addendum.
Constitutes an incorporated part of the Compliance & Policies Hub obligations.
Published January 2026 | Effective from January 2026 until Superseded or Amended
