Last Updated: 2026-09-28

DOIT DIGIFABB INDIA PRIVATE LIMITED (“DigiFabb”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit https://digifabb.co.in, purchase our products, use our services, contact us, create an account, submit an enquiry, or otherwise interact with us.

This Privacy Policy is intended to provide a common framework for the protection of personal data and to address applicable requirements under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules, as well as the General Data Protection Regulation (EU) 2016/679 (“GDPR”) where the GDPR applies to our processing activities.

Where a particular law provides additional rights or imposes additional obligations, those rights and obligations will apply to the extent required by that law.

1. WHO WE ARE

The entity responsible for your personal data is:

DOIT DIGIFABB INDIA PRIVATE LIMITED
Brand: DigiFabb
Website: https://digifabb.co.in
Email: [email protected]

For purposes of applicable Indian data-protection law, DigiFabb acts as a Data Fiduciary.

Where the GDPR applies, DigiFabb acts as a data controller for personal data that we determine the purposes and means of processing.

Where we process personal data on behalf of another organisation, we may act as a data processor or service provider, as applicable.

2. PERSONAL DATA WE COLLECT

We collect only personal data that is reasonably necessary for the purposes described in this Privacy Policy.

2.1 Information You Provide

Depending on how you interact with us, we may collect:

Name
Email address
Telephone or mobile number
Company or organisation name
Billing address
Shipping or delivery address
Account information and credentials
Order and transaction information
Product or service enquiries
Information submitted through contact forms, quotation requests, support requests, or other forms
Communications and correspondence with us
Information you voluntarily provide when requesting demonstrations, technical assistance, quotations, or other services

Where payment services are provided through third-party payment providers, payment credentials may be collected and processed directly by those providers. We do not intend to collect or retain full payment-card credentials except where necessary and permitted for the relevant transaction.

2.2 Information Collected Automatically

When you use our website, we may automatically collect certain technical and usage information, including:

IP address
Browser type and version
Device type and operating system
Website pages visited
Date and time of access
Referring and exit pages or URLs
Approximate usage and interaction information
Cookies and similar technologies
Website performance and security information

Some of this information may constitute personal data under applicable law.

2.3 Information Received from Other Sources

We may receive personal data from third parties where permitted by law, including:

Payment service providers
Delivery and logistics providers
Analytics and technology providers
Advertising or marketing platforms
Business partners
Social media platforms when you interact with us through those platforms
Publicly available sources
Other parties involved in providing services to you

Where required by applicable law, we will provide appropriate information regarding the source and processing of such data.

3. HOW WE USE PERSONAL DATA

We may process personal data for the following purposes:

3.1 Providing Products and Services

Processing and fulfilling orders
Delivering products
Processing payments
Providing quotations and demonstrations
Providing technical support and after-sales service
Managing customer accounts
Responding to enquiries and requests
Providing products or services requested by you

3.2 Communications

We may use your contact information to:

Send order confirmations and updates
Provide shipping and delivery information
Respond to enquiries
Provide technical or service-related communications
Communicate about your account or transactions

Where required by applicable law, promotional or marketing communications will be sent only where an appropriate legal basis exists, including consent where required.

You may unsubscribe from marketing communications at any time.

3.3 Website and Service Improvement

We may process information to:

Understand how our website and services are used
Improve website functionality
Improve products and customer experience
Diagnose technical problems
Analyse website performance
Develop and improve our services

Where consent is legally required for analytics or similar technologies, we will obtain that consent before using them for those purposes.

3.4 Security and Fraud Prevention

We may process personal data to:

Protect our website, systems, customers, and business
Detect and prevent fraud, abuse, unauthorised access, and other security incidents
Investigate suspicious activity
Maintain system integrity and security

3.5 Legal and Regulatory Compliance

We may process and retain personal data where necessary to:

Comply with applicable laws and regulations
Maintain tax, accounting, financial, and business records
Respond to lawful requests from authorities
Establish, exercise, or defend legal claims
Enforce our agreements and terms
Protect our legal rights and legitimate business interests

4. LEGAL BASES AND LAWFUL GROUNDS FOR PROCESSING

We process personal data only where permitted by applicable law.

Where the GDPR applies, our legal bases may include:

Consent

We may process personal data based on your consent where consent is required, including for certain marketing activities, optional cookies, or other optional processing.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Contractual Necessity

We may process personal data where necessary to enter into or perform a contract with you, including processing orders, payments, deliveries, accounts, and requested services.

Legal Obligation

We may process personal data where necessary to comply with applicable legal or regulatory obligations.

Legitimate Interests

Where permitted under applicable law, we may process personal data where necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by applicable rights and freedoms.

Such interests may include:

Website and information-security measures
Fraud prevention
Service improvement
Business administration
Customer relationship management
Certain forms of direct communication
Establishment, exercise, or defence of legal claims

Where we rely on legitimate interests under the GDPR, we consider the impact of the processing on individuals and whether their rights and freedoms require additional safeguards.

Other Lawful Grounds

Under Indian data-protection law, including the DPDP Act, personal data may also be processed where permitted as a legitimate use or otherwise authorised under applicable law.

We do not require consent where applicable law permits processing on another lawful basis.

5. CONSENT

Where processing is based on consent, we will seek consent in a manner that is appropriate to the applicable law.

Consent will be requested for specific purposes and will not be treated as permission for unrelated processing.

Where required, consent will be capable of being withdrawn as easily as it was given.

Withdrawal of consent will not affect the lawfulness of processing that occurred before withdrawal.

Please note that withdrawing consent does not necessarily require us to stop all processing. We may continue processing personal data where another lawful basis applies, such as contractual necessity or legal obligations.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate, secure, and improve our website.

These technologies may be used to:

Maintain essential website functionality
Remember preferences
Maintain shopping-cart or account functionality
Understand website usage
Measure website performance
Improve our services
Support marketing or advertising activities where permitted

Where applicable law requires consent for non-essential cookies or similar technologies, we will request consent before placing or using those technologies.

You may also manage cookies through your browser settings and, where available, through our cookie-consent mechanism.

Disabling certain cookies may affect website functionality.

7. HOW WE SHARE PERSONAL DATA

We may disclose personal data only where necessary for the purposes described in this Privacy Policy or otherwise permitted or required by applicable law.

Recipients may include:

Service Providers and Data Processors

We may share personal data with service providers that assist us with:

Website hosting
Cloud services
Information technology
Payment processing
Order fulfilment
Shipping and logistics
Customer support
Analytics
Marketing and communications
Security
Business administration

Where required, we take appropriate contractual and organisational measures to require service providers to protect personal data and process it only for authorised purposes.

Legal and Regulatory Authorities

We may disclose personal data where required or permitted by applicable law, regulation, court order, governmental request, or other lawful process.

Business Transactions

If DigiFabb is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar business transaction, personal data may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

Business Partners

We may share relevant information with business partners where necessary to provide requested products or services or where otherwise permitted by applicable law.

We do not sell your personal data.

8. INTERNATIONAL DATA TRANSFERS

DigiFabb is based in India, and some of our service providers or technology partners may process personal data in countries outside India.

Where personal data is transferred across jurisdictions, we will take measures required by applicable law to protect that data.

Where the GDPR applies, transfers of personal data outside the European Economic Area (“EEA”) will be made using a legally recognised transfer mechanism where required, which may include:

An adequacy decision;
Standard Contractual Clauses approved by the European Commission;
Binding Corporate Rules, where applicable;
Another lawful transfer mechanism recognised under the GDPR.

The European Commission recognises adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules and other mechanisms as tools for lawful international transfers under the GDPR.

For transfers governed by Indian law, we will comply with applicable requirements and restrictions concerning transfers of personal data outside India.

9. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by applicable law.

Retention periods may depend on:

The nature of the relationship with you
The purpose for which the data was collected
Whether an account or contractual relationship remains active
Legal, tax, accounting, and regulatory requirements
Dispute resolution requirements
Fraud prevention and security requirements
The establishment, exercise, or defence of legal claims

When personal data is no longer required, we will delete it, anonymise it, or otherwise dispose of it in accordance with applicable law and our data-retention practices.

Where applicable Indian law requires certain personal data or processing records to be retained for specified periods, those requirements will take precedence.

10. YOUR PRIVACY RIGHTS

Depending on where you are located and which law applies to the processing of your personal data, you may have some or all of the following rights.

10.1 Right to Access

You may request information about the personal data we process about you and, where applicable, obtain a copy of that data.

Under Indian law, this may include a summary of the personal data being processed and information regarding the parties with whom the personal data has been shared, as provided by applicable law.

10.2 Right to Correction

You may request correction or updating of inaccurate, incomplete, or outdated personal data.

10.3 Right to Erasure

You may request deletion of your personal data where permitted by applicable law.

We may retain certain information where retention is required or permitted by law, including for tax, accounting, regulatory, security, dispute-resolution, or legal purposes.

10.4 Right to Restriction of Processing

Where the GDPR applies, you may have the right to request restriction of processing in circumstances specified by the GDPR.

10.5 Right to Object

Where the GDPR applies, you may have the right to object to certain processing, including processing based on legitimate interests and certain direct-marketing activities.

You may object to direct marketing at any time.

10.6 Right to Data Portability

Where the GDPR applies and the applicable conditions are satisfied, you may request certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, request its transmission to another controller.

10.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out before withdrawal and does not prevent us from continuing processing where another lawful basis applies.

10.8 Right to Nominate

Where applicable under Indian law, a Data Principal may nominate another individual to exercise applicable rights in accordance with the DPDP Act and applicable rules.

10.9 Rights Relating to Automated Decision-Making

Where applicable under the GDPR, you may have rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.

We will provide the information and safeguards required by applicable law where such processing occurs.

11. HOW TO EXERCISE YOUR RIGHTS

You may contact us regarding your personal data or to exercise applicable privacy rights using:

Email: [email protected]

When making a request, please provide sufficient information to allow us to understand and process your request.

For security purposes, we may need to verify your identity before providing access to personal data or making changes to an account or personal information.

We will respond to requests within the time period required by applicable law.

Under the GDPR, requests will generally be answered without undue delay and, in principle, within one month, subject to applicable extensions and exceptions.

Certain rights are subject to legal conditions and exceptions. For example, we may be required to retain information even where deletion has been requested.

12. GRIEVANCE REDRESSAL

To contact our designated Grievance Officer regarding any disputes or data requests, please find their direct contact details on our Contact Us page.

We will review and address your grievance in accordance with applicable law and our internal procedures.

Where required under Indian data-protection law, you may exercise your statutory rights and, after following the applicable grievance-redressal process, may have the right to approach the Data Protection Board of India.

Where the GDPR applies, you also have the right to lodge a complaint with the competent supervisory authority in the EEA country where you live, work, or believe that an infringement has occurred.

13. DATA SECURITY

We maintain reasonable and appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, destruction, or other unlawful processing.

Depending on the nature and risks associated with processing, these measures may include:

Access controls
Authentication and authorisation controls
Encryption or other appropriate security measures
Monitoring and logging
Backup and recovery procedures
Security testing and review
Contractual controls for service providers
Organisational procedures for handling personal data

No method of transmission or storage can be guaranteed to be completely secure. However, we take reasonable measures to reduce the risks associated with processing personal data.

Where applicable law requires notification of a personal-data breach to affected individuals or regulatory authorities, we will make such notifications in accordance with the applicable requirements.

14. CHILDREN’S DATA

Our website and services are primarily intended for adults and businesses.

We do not knowingly seek to collect personal data from children in circumstances where such collection is prohibited by applicable law.

Where applicable Indian law requires verifiable parental consent before processing a child’s personal data, we will apply the required safeguards.

Where the GDPR applies, we will comply with the GDPR’s requirements concerning children’s consent and the applicable age threshold in the relevant jurisdiction.

If you believe that a child has provided us with personal data in circumstances where such processing is not permitted, please contact us at [email protected].

15. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to websites, applications, payment services, social-media platforms, or other third-party services.

Those third parties operate under their own privacy policies and terms. DigiFabb is not responsible for the privacy practices of third-party websites or services that we do not control.

We encourage you to review the privacy policies of third parties before providing them with personal data.

16. THIRD-PARTY PROCESSORS AND SERVICE PROVIDERS

We may use third-party providers to operate our website and business.

Such providers may process personal data on our behalf for purposes such as hosting, payment processing, logistics, analytics, communications, customer support, security, and technology services.

Where required by applicable law, we will use appropriate contractual and organisational safeguards governing such processing.

Where required under applicable law, information about relevant categories of recipients or processors may be provided upon request.

17. DATA PROTECTION PRINCIPLES

We seek to follow the following principles when processing personal data:

Lawfulness and transparency: We process personal data in accordance with applicable law and provide appropriate information about our processing.
Purpose limitation: We collect and use personal data for specified and legitimate purposes.
Data minimisation: We seek to collect only data reasonably necessary for the relevant purposes.
Accuracy: We take reasonable steps to keep personal data accurate and up to date.
Storage limitation: We retain personal data only for as long as reasonably necessary or legally required.
Security and confidentiality: We use appropriate safeguards to protect personal data.
Accountability: We maintain appropriate measures and procedures to support compliance with applicable data-protection requirements.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices, or applicable legal requirements.

When we make changes, we will update the “Last Updated” date at the beginning of this Privacy Policy.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes that require such action.

We encourage you to review this Privacy Policy periodically.

19. CONTACT US

If you have questions about this Privacy Policy, our processing of personal data, or your privacy rights, please contact:

DOIT DIGIFABB INDIA PRIVATE LIMITED
Email: [email protected]
Website: https://digifabb.co.in

For privacy-rights requests and data-protection enquiries, please use the same email address and clearly indicate that your request concerns personal data or privacy.

If you are located in the EEA and the GDPR applies to you, you may also contact your competent Data Protection Authority regarding concerns about our processing of your personal data.

This Privacy Policy is intended to operate as a unified privacy notice. It does not limit any rights or protections that apply to an individual under mandatory applicable data-protection law.