Privacy Policy
We collect very little. If you email us, we keep the email so we can reply. This site runs no analytics and no advertising trackers. We never sell your data. You can ask us to show, correct or delete what we hold, and we will.
1. Who we are
Qann Commerce OÜ ("Qann", "we", "us", "our") runs this website, india.qann.co, with a team based in Mumbai. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for personal data collected here.
Registered entity: Qann Commerce OÜ. Registry code 17263654. Registered address: Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia. Operations team: Mumbai, India.
Email: privacy@qann.co.
2. What we collect
We collect only what you choose to send us, and a small amount of technical data that every web server sees.
- What you send us: your name, email address, phone number, business name and anything you write when you email or call us, request an audit or book a call.
- Technical data: IP address, browser and device type, pages requested and time of request. This sits in standard hosting logs and is kept for a short period for security and to keep the site running.
- Client work: if you become a client, the accounts, content and business data you give us access to so that we can deliver the service. That is covered by your agreement with us as well as this policy.
3. What we do not collect
- Payment card, UPI or bank login details. We invoice by bank transfer or payment link, and we never ask for these on this site.
- Aadhaar, PAN or other government identifiers, unless a client agreement needs them for tax or compliance and you send them to us yourself.
- Sensitive personal data such as health, religion or political views.
- Data of children under 18. This site is for businesses and we do not knowingly collect a child's data. If you think we have, write to us and we will delete it.
4. Why we use your data, and on what basis
Under the DPDP Act we process your personal data only with your consent or for a lawful use the Act allows. In practice:
| Purpose | Basis | Kept for |
|---|---|---|
| Replying to your enquiry, audit request or call booking | Your consent, given when you contact us | 3 years from last contact, or until you ask us to delete it |
| Delivering services to clients | Performance of the agreement, and your consent | Length of the agreement, plus the period tax and company law require |
| Invoicing, GST and accounting | Legal obligation | As long as Indian and Estonian tax and company law require, currently up to 8 years |
| Security and keeping the site running | Legitimate use, to prevent fraud and misuse | Up to 90 days for server logs |
5. Who we share it with
We do not sell, rent or trade personal data. We share it only with the service providers that help us run the business, under written terms:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting this website | USA and global edge locations |
| Email and workspace providers | Receiving and answering your emails | USA and EU |
| Accountants and tax advisers | Invoicing, GST, filings | India and Estonia |
We may also disclose data where a court, regulator or law enforcement body in India or Estonia lawfully requires it.
6. Transfers outside India
Some of our providers store data outside India, and our parent company is in Estonia. The DPDP Act permits transfers to any country the Government of India has not restricted. We transfer data only to providers that hold it under written terms with security and confidentiality duties.
7. Your rights
As a Data Principal under the DPDP Act you may:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct inaccurate data, complete incomplete data or update it;
- ask us to erase your data, unless we must keep it by law;
- withdraw your consent at any time. Withdrawing does not affect what we did before, and may mean we can no longer provide a service that needs the data;
- nominate another person to exercise these rights for you if you die or become unable to;
- make a complaint to us (section 10) and, if we do not resolve it, complain to the Data Protection Board of India.
To use any of these, email privacy@qann.co from the address we hold for you. We may ask you to confirm who you are first. We aim to reply within 15 days.
8. Security
We use reasonable security safeguards as required by the DPDP Act and the Information Technology Act, 2000: encrypted connections (HTTPS) across this site, access limited to people who need the data, and security reviews of our providers.
If a personal data breach affects you, we will tell you and the Data Protection Board of India in the form and time the law requires.
9. Cookies
See our Cookie Policy. In short, this site sets no cookies of its own and uses no analytics or advertising trackers.
10. Complaints
If you have a complaint about how we handle your data, write to privacy@qann.co. We acknowledge within 48 hours and aim to resolve within 15 days. If we do not resolve it, you may complain to the Data Protection Board of India.
11. Changes to this policy
We may update this policy when our practices or the law change. The new version goes on this page with a new date. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.
12. Contact
Privacy questions: privacy@qann.co. Post: Qann Commerce OÜ, Ahtri tn 12, Kesklinna linnaosa, 15551 Tallinn, Harju maakond, Estonia.