Privacy Policy
Scope and the data fiduciary
This Policy governs personal data processed in connection with the ebrc.in website, the workspace at app.ebrc.in, and the associated API (together the "Services" or the "Platform", an Eximfiles product), operated by Dreamfuel Technologies Private Limited, AshaYog Unit 104, Vijaya Nagar Colony, Pune 411030, India, together with its affiliate Eximtech Inc. (collectively "Eximfiles", "we"). For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the data fiduciary is Dreamfuel Technologies Private Limited. Capitalised terms not defined here have the meaning given in the Terms of Service, including "Government Portal" and "User Instruction". In this Policy "eBRC" refers generically to an Electronic Bank Realisation Certificate, the government-issued document, and not to the Platform.
Consent, and our record of it
We process personal data on the basis of the consent you give when you accept the Terms of Service at sign-up, when you connect a Government Portal account, and when you voluntarily submit information to us, and, where applicable, for legitimate uses recognised by the DPDP Act. We maintain records of the date, time, and manner of each consent, and those records stand as evidence of it. You may withdraw consent at any time as described under "Your rights"; withdrawal operates prospectively and does not affect processing already lawfully performed, nor records we are required to retain.
What we collect
- Account data: name, email address, mobile number, company name, and sign-in records.
- Business identity data: trade registrations and identifiers you provide, including IEC, PAN, and bank and branch identifiers.
- Portal credentials: the sign-in details you provide so that the Services can act on your User Instructions. They are encrypted at rest, are never displayed back after entry, and are used solely to operate the connected account under the mandate you grant in the Terms of Service.
- Filing data: remittance records, bill and invoice references, mappings, submissions, and resulting certificates, whether provided by you or retrieved from a Government Portal on your instruction.
- Support and contact data: what you send through the contact form or by email, including the optional mobile number and, if you tick the box, your permission to reach you on WhatsApp or by call about that enquiry.
- Technical data: device, browser, IP address, and security logs generated in operating the Services.
Purposes of processing
Personal data is processed only to:
- perform the Services you instruct: retrieving your records, preparing and transmitting the filings you approve, and returning the resulting documents;
- secure the Services: authentication, fraud and abuse prevention, and audit trails of consents and User Instructions;
- respond to your enquiries and grievances;
- send you service and transactional communications concerning your account, your filings, your support requests, and documents awaiting your signature; we do not send marketing newsletters;
- comply with legal obligations, including record-keeping applicable to regulatory filings; and
- develop, test, and improve the Services and new features and offerings, using aggregated or de-identified information that cannot identify you.
We do not sell personal data and do not use your filing data for advertising.
Security
Credentials and sensitive data are encrypted at rest and in transit. Access within Eximfiles is limited to personnel and systems that require it to operate the Services, under role-based controls and logging, on hardened cloud infrastructure. When you update stored credentials, the stored secret is replaced, not revealed. No system is absolutely secure, and you are responsible for safeguarding your own account access; we will notify you and the authorities of personal data breaches as the DPDP Act requires.
Disclosures
Personal data is disclosed only to:
- Government Authorities and their portals, to the extent necessary to perform the filings and retrievals you instruct;
- infrastructure processors (hosting, email delivery) bound to act only on our documented instructions;
- authorities and courts, where disclosure is required by law;
- professional advisers, such as auditors and legal counsel, bound by duties of confidence, where needed to run the business; and
- a successor in interest, in a merger, acquisition, or asset transfer, under protections no less than this Policy.
Processing may occur on infrastructure of our affiliate or processors outside India to the extent permitted by applicable law; protections equivalent to this Policy follow the data.
Retention
Account and filing data are retained while your account is active. Records of regulatory submissions, consents, and instructions may be retained after closure for as long as applicable law requires or as needed for the establishment or defence of legal claims, after which data is deleted or irreversibly anonymised. You may export your filing data at any time while your account is open.
Your rights
Under the DPDP Act you may:
- access a summary of your personal data and its processing;
- seek correction or completion of inaccurate data;
- seek erasure, subject to retention required by law;
- withdraw consent, including by disconnecting a connected account, with prospective effect;
- nominate an individual to exercise your rights in case of death or incapacity; and
- raise a grievance with us and, thereafter, with the Data Protection Board of India.
Your duties as a data principal
The DPDP Act also places duties on you: not to impersonate another person, not to suppress material information or furnish false particulars, not to register false or frivolous grievances or complaints, and to provide only authentic information when exercising your rights. Breach of these duties may attract penalties under the Act, and processing we perform in reliance on information you provided remains your responsibility to the extent that information was inaccurate, incomplete, or supplied without authority.
Platform and enterprise accounts
Where a platform or enterprise account connects other exporter entities, the account holder is responsible for the personal data it transmits about its end customers and their personnel: it warrants that it has given the notices and obtained the consents the DPDP Act requires before that data reaches us, and we process such data to operate the Services for the connected entity under the mandate that entity has granted. End customers may exercise their rights either through the platform that onboarded them or directly with us as described in "Your rights".
Children
The Services are for business use and are not directed at children; we do not knowingly process children's personal data.
Changes
We may amend this Policy by posting a revised version with a new date, with notice through the Services or by email for material changes. Continued use after the effective date constitutes acceptance.
Grievance officer
Grievance Officer: Amin Naik, amin@eximfiles.io. Privacy grievances are ordinarily acknowledged within 48 hours and resolved within 30 days; you may thereafter approach the Data Protection Board of India.