This Privacy Policy explains how Gargi PaperKraft (“Company”, “we”, “us”, or “our”), operating under the commercial brand Papzo, collects, processes, stores, and safeguards personal and business data across our website, communication desks, and B2B checkout systems in accordance with the laws of India.
Gargi PaperKraft acts as the Data Fiduciary for all personal data collected through papzo.in and our operational channels. We process data strictly for specific, lawful purposes—primarily to execute paper bag supply contracts, fulfill physical consignments, furnish statutory GST tax invoices, and maintain transparent operations. You have defined rights under Indian law as a Data Principal, including rights of access, correction, erasure, and grievance redressal through our designated Grievance Officer.
The entity responsible for the collection and processing of your personal data is:
When you browse the Papzo catalogue, read manufacturing standards, or examine paper bag specifications, certain technical information is recorded automatically or via analytical telemetry:
| Data Category | Specific Fields Collected | Collection Method | Primary Purpose |
|---|---|---|---|
| Technical & Network | IP address, Internet Service Provider (ISP), approximate geographic region (City/State), browser user-agent, operating system, screen resolution. | HTTP Request Headers & Edge Server Logs | System security, bot mitigation, edge cache routing, DDOS defense. |
| Interaction Telemetry | Pages viewed, time spent per product, bag size toggled, quantity tier clicked (250/500/1000/5000+), referral sources, link clicks. | Google Analytics 4 (GA4) | Optimizing catalogue navigation, identifying demand for particular bag sizes, conversion analysis. |
| Embedded Map Data | IP address and standard Google cookie identifiers if you interact with the embedded plant location map on the Contact page. | Google Maps iFrame Embed | Displaying physical factory location and driving directions in Lucknow. |
* For granular details on cookies, browser beacons, and how to opt out of Google Analytics tracking, please read our dedicated Cookie Policy.
Because Papzo manufactures kraft paper packaging directly at our Lucknow facility, many business buyers reach out to our engineering desk before purchasing. When you contact us via WhatsApp, phone, or email:
+91 99182 80347 or emails to hello@papzo.in are logged in our internal customer relationship notes to coordinate production and quotes.When you proceed to purchase plain kraft paper bags, submit an order, or generate an authorized commercial transaction through Papzo, our database architecture records specific, authoritative datasets to complete your contract of sale:
+91XXXXXXXXXX). Essential for order confirmations, delivery rider calls, and SMS/WhatsApp dispatch alerts.^[0-9A-Z]{15}$ for issuing formal B2B e-invoices and enabling Input Tax Credit (ITC).^[1-9][0-9]{5}$) used for freight dispatch sorting.PZ-YYMM-XXXXX) for purchase verification.tracking_token) so public tracking links cannot be enumerated or guessed by third parties.Under Section 4 and Section 7 of the Digital Personal Data Protection Act, 2023 (DPDPA), we process your personal data exclusively under legitimate lawful grounds:
| Purpose of Processing | Data Used | Lawful Basis under DPDPA 2023 |
|---|---|---|
| Contract Execution & Bag Supply | Name, phone, delivery address, order items, invoice totals. | Performance of Contract (Sec. 7(b)) |
| Statutory GST & Tax Compliance | Business name, GSTIN, billing address, transaction amounts, CGST/SGST/IGST breakdown. | Compliance with Law (Sec. 7(c) / CGST Act) |
| Physical Delivery & Rider Booking | Delivery contact name, phone number, destination address, landmark, PIN code. | Performance of Contract (Sec. 7(b)) |
| Payment Reconciliation & Fraud Prevention | Razorpay payment ID, order ID, payment status, transaction amounts. | Legitimate Use & Financial Security (Sec. 7) |
| Customer Support & Grievance Redressal | Order number, conversation history, notes, timeline logs. | Consumer Protection Rules, 2020 Compliance |
Gargi PaperKraft is a registered manufacturing enterprise in Uttar Pradesh, India. When you transact with us as a commercial buyer:
Valid GST Invoicing: Under the Central Goods and Services Tax Act, 2017 (CGST Act) and Uttar Pradesh GST Act, we are required by law to record your GSTIN, registered trade name, and supply address on official tax invoices.
Input Tax Credit (ITC): The GST details you submit at checkout are transmitted to the Goods and Services Tax Network (GSTN) via our monthly statutory GSTR-1 returns, allowing your business to legally claim Input Tax Credit on packaging purchases.
E-Way Bills: Where consignments exceed statutory interstate or intrastate value thresholds, recipient delivery details are transmitted to the National Informatics Centre (NIC) E-Way Bill portal to generate mandatory transport passes.
Papzo and Gargi PaperKraft NEVER collect, store, view, or process your raw credit/debit card numbers, CVVs, card expiry dates, Net Banking passwords, or UPI MPINs on our servers.
All electronic payments are processed through Razorpay, an RBI-authorized Payment Aggregator complying with the Reserve Bank of India’s Card-on-File Tokenisation (CoFT) directives and PCI-DSS Level 1 certification:
gateway_order_id, gateway_payment_id, payment method category (e.g. “UPI” or “NETBANKING”), amount in integer paise, currency (strictly INR), and cryptographic webhook confirmation signatures.refunds audit table.To fulfill your physical paper bag shipments from our Lucknow factory floor to your premises, specific contact and address data is shared with third-party logistics providers:
For Lucknow PIN codes (226XXX), dispatch is arranged manually via on-demand logistics partners including Porter, Uber, Rapido, or local couriers. The assigned delivery rider receives your drop name, phone number, and address strictly for physical drop-off and route coordination.
Rider phone and vehicle registration numbers are logged in our internal delivery ledger for safety and transit verification.
For regional and national shipments across India, corrugated cartons are handed over to express surface cargo operators (e.g., VRL Logistics, TCI, Delhivery, or Blue Dart). Consignment Notes (Lorry Receipts / LR) and parcel tracking numbers are shared with you via email or WhatsApp.
Statutory Retention Mandate under Section 36 of the Central Goods and Services Tax Act, 2017:
Every registered taxable person is required by law to maintain true and correct accounts of goods manufactured, supplies made, invoices, and payments received for a period of 72 months (6 years) from the due date of furnishing the annual return for the relevant financial year.
Accordingly, our retention schedules are structured as follows:
Under the Digital Personal Data Protection Act, 2023, you have clear statutory rights regarding your personal data processed by Gargi PaperKraft:
You have the right to request a summary of the personal data we hold about you, the processing activities carried out, and the identities of third-party processors with whom it has been shared.
You may request the correction of inaccurate data, completion of incomplete records, or erasure of personal data that is no longer necessary for the purpose it was collected (subject to statutory GST tax retention obligations).
You have the right to readily available means of grievance redressal provided by our Data Fiduciary, with statutory escalation to the Data Protection Board of India.
You have the right to nominate another individual who, in the event of death or incapacity, shall exercise your data privacy rights.
To exercise any of these rights, submit a written request to our Grievance Redressal Officer using the contact details in Section 12 below.
In accordance with Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we implement strict technical safeguards:
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Consumer Protection (E-Commerce) Rules, 2020, and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are published below:
Statutory Response Timelines: