Privacy Policy

1Who we are and what this covers

V-Trust is the trading name of M/s Dev Brass Collection, a sole proprietorship whose principal place of business is 18/101 Durga Puri, Sasni Gate, Aligarh, Uttar Pradesh – 202001, India. In the language of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

This policy covers vtrustheight.com and any order, quotation or enquiry placed through it. It does not cover other websites we link to, including marketplaces such as Amazon where we also sell — those are governed by their own policies.

2What we collect

You give us

• Account details — name, email address, mobile number, and a password we store only as a one-way hash. We never see your password.
• Delivery and billing details — postal address, PIN code, and the name and number a courier should call.
• Business details, if you buy as a dealer or on a trade account — company name, GSTIN and the contact person we deal with.
• Anything you write to us — enquiries, quotation requests, reviews, complaints, and any photographs you send to support a return.

We record as you use the site

• Order and quotation history, and the contents of your cart and saved lists.
• Technical data — IP address, browser and device type, pages viewed, and the referring page. This is what lets us find a fault someone reports.

What we never hold

Card numbers, CVV, UPI PINs and net-banking credentials never reach our servers. Payments are taken on Razorpay Software Private Limited’s systems, and what comes back to us is a transaction reference and whether it succeeded. Nobody at V-Trust can see your card.

The list you see under “Your browsing history” on product pages is held in your own browser and is never transmitted to us. Clearing it there removes it entirely.

3Why we use it, and on what basis

Under the DPDP Act we may process your personal data where you have consented, or where it is a legitimate use such as fulfilling something you have asked us for. We use your data to:

• take, pack, despatch and deliver your order, and handle returns and refunds;
• issue invoices and meet our tax and accounting obligations;
• answer enquiries, prepare quotations and provide support;
• operate your account, including saved addresses, lists and trade pricing where it applies;
• send service messages about an order — confirmation, despatch, delivery, and a request for a review after delivery;
• detect and prevent fraud, abuse of promotions, and unauthorised access to accounts;
• keep the site working and improve it, by understanding which pages fail or confuse.

Marketing is separate. We send promotional email only if you have opted in, and every such message carries an unsubscribe link that works. Withdrawing marketing consent does not stop the service messages above, because those are part of delivering what you bought.

We do not sell your personal data, and we do not rent or trade it for advertising.

4Who else sees it

Only the parties who need it to do a job for us, and only the part they need. Each is bound to use it for that purpose alone.

• Courier and logistics partners — your name, delivery address and phone number, so a parcel can be delivered and you can be called about it.
• Razorpay Software Private Limited, our payment gateway — the amount and the contact details a payment needs. They handle the card data we never receive.
• Our email provider — your address and the message we are sending.
• Professional advisers and auditors, where they need records to do their work.
• Government authorities, where the law requires disclosure or where it is needed to establish or defend a legal claim.

If the business is ever sold or reorganised, customer records may transfer with it. You would be told before that happened, and the new owner would be bound by this policy until it told you otherwise.

5Cookies and similar storage

We load no third-party trackers and no advertising scripts. Nothing on this site reports your visit to Google, Meta or anyone else. What is stored falls into three groups:

• Strictly necessary — signing in, keeping your session, and remembering your basket. The shop cannot work without these, so they cannot be switched off.
• Preferences — your light or dark theme, and the “recently viewed” row. Held in your browser and never sent to us.
• Usage analytics — an anonymous identifier for your browser, and four events: a product viewed, an item added to the basket, a checkout started, an order placed. These go to our own server so we can see where the shop is losing people. They are not linked to advertising, not shared, and not sold.

You are asked about the last two the first time you visit, and you can change your answer at any time through Cookie preferences in the footer. Turning a category off also deletes what it had already stored — withdrawal removes rather than pauses.

Blocking cookies in your browser will stop you signing in or checking out. Clearing them signs you out and empties the basket on that device.

6How long we keep it

• Order records and invoices — retained for the period Indian tax and company law requires, currently eight years from the end of the relevant financial year. We cannot delete these on request while that obligation stands.
• Account details — while your account is open. Close it and we erase or anonymise what we are not required to keep.
• Enquiries and support messages — up to three years, so we can see the history of a recurring problem.
• Technical logs — a short period, typically weeks, sufficient to investigate faults and abuse.

7How we protect it

• The whole site is served over HTTPS; data in transit is encrypted.
• Passwords are stored only as one-way hashes, never as recoverable text.
• Administrative access is restricted to named staff accounts with per-person permissions, so someone who needs to edit the catalogue is not thereby able to read customer orders.
• Databases are backed up daily and the backups are encrypted.

No system is perfectly secure, and we will not claim otherwise. If a breach occurs that affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

8Your rights

Under the DPDP Act, 2023 you may:

• Ask what we hold about you and how it has been used and shared.
• Have it corrected where it is wrong, incomplete or out of date.
• Have it erased, where we are not required by law to keep it.
• Withdraw consent at any time, as easily as it was given. This does not undo processing already carried out.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and then to the Data Protection Board of India.

Write to info@vtrustheight.com. We may need to verify who you are before acting, which protects you rather than us. We respond within 30 days.

9Children

This site is intended for adults. We do not knowingly collect the personal data of anyone under 18, and we do not carry out tracking or targeted advertising directed at children. If you believe a child has given us data, tell us and we will delete it.

10Where your data is processed

Our systems are operated in India. Some service providers — for email or infrastructure — may process data outside India. Where that happens we use providers offering appropriate safeguards, and only to countries not restricted by the Government of India for this purpose.

11Changes to this policy

We may update this page as the business or the law changes. The date at the top always shows the current version. Where a change materially affects how we use your data, we will tell you directly rather than rely on you noticing.

12Contact and grievances

For any question about this policy, or to exercise a right above, contact our Grievance Officer. Complaints are acknowledged within 48 hours and resolved within one month.

If our response does not resolve matters, you may complain to the Data Protection Board of India.