Privacy Policy

1. Introduction & scope

This Privacy Policy (“Policy”) describes how Basantile (“we”, “us”, “our”, the “Data Fiduciary”) collects, uses, stores, discloses, transfers, retains, and otherwise processes personal data when you visit basantile.com (the “Site”), submit an enquiry through the contact form, request a quote on a product page, or reach out to our trade desk via WhatsApp, email, telephone, or any other channel.

Basantile is a curated tile and surface brand. The Site is enquiry-led — there are no customer accounts, online checkout, or payment journey on the Site itself. Every commercial relationship begins with a conversation that follows an Enquiry. This Policy describes the limited information that conversation requires.

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and other applicable Indian law (collectively, “Applicable Law”).

By accessing the Site or submitting an Enquiry, you confirm that you have read, understood, and accepted this Policy and our Terms of Use and Cookies Policy, and you provide free, specific, informed, unconditional, and unambiguous consent — through clear affirmative action — to the processing of your personal data for the purposes described below. If you do not agree, do not use the Site or share information with us.

2. Definitions

In this Policy, unless the context requires otherwise:

• “Personal Data” means any data about an individual who is identifiable by, or in relation to, such data, as defined under the DPDP Act.
• “Processing” means any operation performed on Personal Data, whether automated or not, including collection, recording, organisation, structuring, storage, retrieval, use, disclosure, transfer, restriction, erasure, or destruction.
• “Data Principal” means the individual to whom Personal Data relates — typically, you.
• “Data Fiduciary” means Basantile, which determines the purpose and means of Processing.
• “Data Processor” means a third party that Processes Personal Data on our behalf under written contract.
• “Enquiry” means any contact-form submission, quote request, callback request, WhatsApp message, email, or other communication sent to Basantile through any channel.
• “Specified Purposes” means the purposes set out in Section 4 (How we use your information).

3. Information we collect

We collect only the Personal Data necessary for the Specified Purposes. The categories below are illustrative and not exhaustive; the actual data we hold about you depends on the channel and content of your Enquiry.

a. Contact information

Your name, telephone number, email address, and the city or location of your project — provided by you when you fill the contact form, request a quote on a product page, or message the trade desk on WhatsApp, email, or telephone.

b. Project information

Information you choose to share to enable an accurate response — including the room or surface in scope, indicative quantities, references, photographs of the space, design preferences, budget indications, and timing. You determine the level of detail.

c. Technical & usage information

Routine server and application logs, including pages requested, timestamps, the IP address from which the request originated, the user-agent (browser and device family), referring URL, approximate location derived from IP, and similar diagnostic data. We use this data to operate, secure, and improve the Site, not to construct a marketing profile.

We do not collect or store financial information, payment-card data, account credentials, biometric data, health data, or government-issued identification numbers through the Site. None of these are part of the Enquiry flow. You are requested not to share such information with us; if you do so voluntarily, we may delete it without notice.

You represent and warrant that any Personal Data you submit is accurate, current, and lawfully provided, and that, where the data relates to any other individual, you have obtained that individual's informed consent to share it with us for the Specified Purposes.

4. How we use your information (Specified Purposes)

We Process Personal Data for the following purposes:

• To respond to your Enquiry with a shortlist, indicative pricing, samples, or next steps;
• To continue the conversation on the channel through which the Enquiry was received (WhatsApp, email, or telephone), strictly in connection with that Enquiry;
• To verify the authenticity of an Enquiry and protect against fraud, impersonation, and misuse of the trade desk;
• To operate, maintain, secure, and improve the Site, debug errors, and analyse aggregated usage trends;
• To detect, prevent, and respond to spam, scraping, automated abuse, security incidents, and unauthorised access;
• To maintain internal records, conduct audits, and enforce our Terms of Use;
• To comply with Applicable Law, respond to lawful requests from competent authorities, and establish, exercise, or defend legal claims; and
• To send you transactional or service communications relating to your Enquiry; we send marketing or promotional communications only where you have separately opted in, and you may opt out at any time.

We do not sell Personal Data, rent it, trade it, or share it with advertisers, data brokers, or third-party marketing platforms.

5. Lawful basis & consent

Under the DPDP Act and the SPDI Rules, every Processing activity must rest on a clear lawful basis. Ours are:

• Consent — your free, specific, informed, unconditional, and unambiguous consent, given through clear affirmative action when you submit an Enquiry, request a quote, message the trade desk, or otherwise interact with us;
• Certain legitimate uses recognised under Section 7 of the DPDP Act, including Processing for purposes you have voluntarily provided data for and have not objected to, for fulfilling legal obligations, for responding to medical or public-safety emergencies, and for performance of a function under law;
• Compliance with Applicable Law — including responding to a lawful written request from a competent authority, court, or regulator;
• Legitimate business interests recognised under Applicable Law — including securing the Site, preventing fraud and abuse, defending legal claims, and conducting routine business operations, in each case subject to your rights.

You have the right to withdraw your consent at any time by writing to [email protected]. Withdrawal of consent will be as easy as the giving of it; however, withdrawal does not affect the lawfulness of any Processing carried out before the withdrawal, and does not require us to delete data we are entitled or required to retain under another lawful basis (for example, to comply with law, to defend a legal claim, or to maintain audit records). Withdrawal may also mean that we are unable to continue assisting you with the matter to which the data relates.

6. Disclosure & sharing

We disclose Personal Data only on a need-to-know basis and only to the categories of recipients set out below:

• Communication and messaging providers — the email, WhatsApp, telephony, or messaging services we use to deliver our reply receive the contact details necessary to deliver that communication;
• Hosting, infrastructure, and security providers — the platforms that host the Site, store enquiry records, deliver content, and protect against attack process the data on our behalf as Data Processors, under written contract that requires confidentiality and reasonable security;
• Analytics and operational tools — limited diagnostic and aggregated-usage analytics tools that assist us in operating and improving the Site, in each case configured to minimise the Personal Data Processed;
• Professional advisers — lawyers, auditors, accountants, and consultants engaged under confidentiality, only where genuinely necessary;
• Government, regulatory, and law-enforcement authorities — where we are legally compelled to disclose by a written demand or order from a competent authority, or where disclosure is necessary to comply with Applicable Law, to enforce our Terms of Use, to defend a legal claim, or to protect the rights, safety, or property of Basantile, our enquirers, or any third party;
• Successors-in-interest — in the event of a merger, acquisition, restructuring, sale, or other corporate transaction, in which case Personal Data may be transferred to the relevant successor or acquirer subject to this Policy or a substantially equivalent privacy policy.

All Data Processors engaged by us are bound by contractual obligations of confidentiality, purpose limitation, and security. We are not liable for the independent acts or omissions of any third party that processes data on its own account rather than as our Data Processor.

7. Cross-border transfers

Personal Data may be Processed and stored on infrastructure located outside India where our hosting, communication, security, or analytics providers operate global platforms. Where we transfer Personal Data outside India, we do so in compliance with the DPDP Act and any restrictions notified by the Central Government from time to time. By submitting an Enquiry, you consent to such transfer for the Specified Purposes, provided that we continue to take reasonable steps to ensure that such transferred data is afforded protection consistent with this Policy.

8. Data retention

We retain Personal Data only for as long as is necessary to fulfil the Specified Purposes for which it was collected, or for such longer period as may be required or permitted under Applicable Law:

• Enquiries and quote requests — retained for the duration of the active conversation and for a reasonable period thereafter to allow the project to resume; reviewed periodically and deleted when no longer relevant;
• Server, application, and security logs — typically rotated within ninety (90) days, save where retention is required for security investigations, legal claims, or compliance with Applicable Law;
• Records required for legal, tax, audit, or regulatory purposes — retained for the period mandated under Applicable Law;
• Records required to defend or pursue a legal claim — retained for the duration of the relevant limitation period and any associated proceedings.

If you would like an enquiry record removed sooner, write to us referencing the email address or phone number you used and we will action your request to the extent permitted by Applicable Law.

9. Your rights as a Data Principal

Subject to and in accordance with the DPDP Act and any rules made thereunder, you have the following rights in respect of your Personal Data:

• Right to access — to obtain a summary of the Personal Data we Process about you and the Processing activities undertaken;
• Right to correction and erasure — to have inaccurate or misleading Personal Data corrected, and Personal Data we no longer have a lawful basis to retain erased;
• Right to withdraw consent — to withdraw consent previously given, with effect for future Processing only;
• Right to nominate — to nominate any other individual to exercise your rights in the event of your death or incapacity;
• Right of grievance redressal — to lodge a grievance with our Grievance Officer (Section 15) and, where unsatisfied, with the Data Protection Board of India.

To exercise any of these rights, write to [email protected] with the subject line “Privacy Request”. We will acknowledge your request promptly and respond within the timelines required by Applicable Law. We may require you to verify your identity before acting on a request, and we may decline or limit a request to the extent permitted by Applicable Law — for example, where the request is manifestly unfounded, excessive, repetitive, or would prejudice the rights of any other person, or where retention is required by law.

10. Security

We adopt and maintain reasonable security practices and procedures appropriate to the nature, scope, and sensitivity of the Personal Data we Process, in accordance with the DPDP Act and the SPDI Rules. These include, without limitation:

• Encryption of data in transit using HTTPS / TLS;
• Role-based access controls restricting access to Personal Data to authorised personnel on a need-to-know basis;
• Storage on infrastructure that is protected by industry-standard physical, network, and application-layer controls;
• Periodic review of our Data Processors and the security measures they apply;
• Incident-response procedures designed to detect, contain, and remediate security incidents.

In the event of a personal-data breach affecting your Personal Data, we will notify the Data Protection Board of India and affected Data Principals to the extent required by Applicable Law.

No system, transmission, or storage method is impervious to compromise, and we cannot and do not guarantee absolute security. To the maximum extent permitted by Applicable Law, we are not liable for any unauthorised access to or use of Personal Data caused by events beyond our reasonable control, including acts of any third party, the act or omission of any Data Processor performing materially in accordance with its contract, or the compromise of credentials or devices used by you. The most effective step you can take is to share only the information that is genuinely relevant to your Enquiry.

11. Cookies & site analytics

The full breakdown is set out in our Cookies Policy, which is incorporated by reference into this Policy. In summary, we use only the cookies and similar technologies necessary for the Site to function, together with limited analytics. We do not run third-party advertising, retargeting pixels, behavioural tracking, or cross-site tracking.

12. Children

The Site and our services are intended for adults. We do not knowingly Process Personal Data of any individual under the age of eighteen (18) years, nor of any person with a disability who has a lawful guardian, except in accordance with the DPDP Act (including, where applicable, after obtaining verifiable consent of the parent or lawful guardian). By using the Site or submitting an Enquiry, you represent that you are at least 18 years of age. If you believe that a child or a person with a disability has shared Personal Data with us, please write to us and we will take appropriate steps to delete it.

13. Automated processing & AI

We do not engage in solely automated decision-making that produces legal or similarly significant effects on you. Limited automated tools may be used to triage Enquiries, detect spam and abuse, route messages, and assist our team in drafting responses; in each case, a human reviews material decisions before they are acted upon. We do not use your Personal Data, your Enquiry, or our correspondence with you to train any third-party large-language model or generative-AI system.

14. Limitation of liability

To the maximum extent permitted by Applicable Law, our liability arising out of or in connection with this Policy and the Processing of Personal Data is governed by, and limited in accordance with, the Limitation of Liability section of our Terms of Use, which is incorporated into this Policy by reference. Nothing in this Policy or the Terms of Use limits or excludes any liability that cannot be limited or excluded under Applicable Law, nor does it reduce any right of a Data Principal under the DPDP Act or any non-excludable right of a “consumer” under the Consumer Protection Act, 2019.

15. Grievance Officer

In accordance with the DPDP Act, the IT Act, 2000, the SPDI Rules, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, complaints, grievances, and requests relating to your Personal Data may be addressed to our Grievance Officer:

16. Changes to this Policy

We reserve the right, at our sole discretion, to amend, modify, supplement, or replace this Policy at any time, including in response to changes in our practices, our service providers, or Applicable Law. Any change will take effect upon publication on the Site, and the “Last updated” date at the top of this page will reflect the most recent revision. It is your responsibility to review this Policy periodically. Your continued use of the Site after a change has been published constitutes your acceptance of the revised Policy. If a change materially expands the categories of data we Process or the purposes for which we Process it, we will, where required by Applicable Law, seek fresh consent before applying the change to your Personal Data.

17. Governing law & jurisdiction

This Policy and any non-contractual obligation arising out of or in connection with it are governed by the laws of the Republic of India. Subject to the dispute-resolution and grievance-redressal mechanisms set out above, the courts at New Delhi have exclusive jurisdiction over any dispute, claim, or proceeding arising out of or in connection with this Policy.

18. Contact us

For anything else — including questions you would like answered before sharing any information with us — please reach the trade desk:

Email · [email protected]
WhatsApp · Message the trade desk
Office · Sector 6, Karnal, Haryana 132001, India