Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") outlines the privacy practices of Suncor India ("Company", "we", "our", or "us") regarding the collection, storage, processing, transfer, and protection of personal data gathered through the Suncor Commission Mobile Application (available on Android and iOS) and our partner management web portal hosted at suncorindia.in (collectively, the "Platform").

By downloading, installing, registering for, or using the Platform as an authorized distributor/dealer ("Vendor") or registered technician/electrician ("Service Partner"), you acknowledge that you have read, understood, and consented to the practices described in this Policy in compliance with the Indian Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Information We Collect

To provide authorized users with access to commission calculation, bill verification, and payout disbursement, we collect the following categories of information:

A. Identity and Contact Information

• Personal Particulars: Full legal name, profile display name, and avatar/profile photograph (if uploaded).
• Contact Details: Verified 10-digit Indian mobile telephone number (used as the primary account identifier) and email address.
• Business Particulars: Enterprise/store trade name, business classification, postal address, city, state, and PIN code.

B. Tax and Regulatory KYC Data

• GSTIN: Goods and Services Tax Identification Number (for registered vendors and wholesale entities).
• PAN Details: Permanent Account Number (PAN) required for statutory Tax Deducted at Source ("TDS") withholding and reporting under Sections 194H and 194R of the Indian Income Tax Act, 1961.

C. Financial and Settlement Information

• Bank Account Particulars: Bank name, account number, beneficiary account holder name, and Indian Financial System Code (IFSC) for electronic direct deposit (NEFT/RTGS/IMPS).
• UPI Identifier: Virtual Payment Address (VPA / UPI ID) where selected for instant digital incentive settlements.

D. Transaction and Verification Records

• Invoices and Bill Slips: Digital images and PDF documents of purchase invoices, tax bills, bill serial numbers, date of issue, billed amounts, and itemized product codes.
• Settlement Proofs: Payment transaction references, transaction UTR numbers, and bank transfer receipts uploaded to confirm incentive disbursement.

E. Device and Technical Information

• Device Identifiers: Operating system name and version (iOS / Android), device manufacturer and model, unique device identifiers, and network connection type.
• Log and Diagnostic Data: IP addresses, application crash logs, API response timings, and session timestamps for system stability and fraud prevention.

3. Mobile Device Permissions & Justification

The Suncor Commission mobile application explicitly requests only the minimum device permissions necessary to execute its business functions:

• Camera Permission (android.permission.CAMERA / NSCameraUsageDescription): Requested solely to allow users to take a real-time photograph of physical invoices, retail bills, or bank payment receipts directly inside the app. The camera is never accessed in the background.
• Photo Library & Storage (android.permission.READ_MEDIA_IMAGES / NSPhotoLibraryUsageDescription): Requested solely to permit users to select and attach existing invoice photos or PDF receipts from their gallery for claim submission. We do not access, scan, or index other personal photos or albums.
• Push Notifications (POST_NOTIFICATIONS): Used exclusively to dispatch transactional alerts concerning bill approval or rejection, commission credits, policy updates, and payout completion. Users can enable or disable push notifications at any time in their device settings.

4. Purpose of Data Processing

We process your personal information strictly for legitimate, program-related purposes:

1. User Authentication: Verifying user credentials and securing access to role-based portals (Vendor vs. Service Partner vs. Admin).
2. Claim Verification: Validating the authenticity of purchased and installed Suncor electrical products and preventing fraudulent, duplicate, or collusive submissions.
3. Commission Calculation: Computing real-time incentive earnings according to active sales slabs and product schemes.
4. Disbursement of Payouts: Transferring settled funds directly to authorized beneficiary bank accounts or UPI VPAs.
5. Tax & Statutory Compliance: Filing statutory TDS returns with the Income Tax Department of India and generating Form 16A TDS certificates.
6. Audit & Security: Maintaining an immutable financial ledger and detecting suspicious account behavior.

5. Information Sharing & Third-Party Disclosures

We share information only with the following authorized entities:

• Banking and Payment Processing Partners: Licensed scheduled commercial banks in India (e.g. ICICI, HDFC, SBI) for executing automated NEFT/RTGS/IMPS/UPI disbursements.
• Cloud Infrastructure Providers: ISO-certified, enterprise-grade cloud servers with encrypted data storage located in secure data centers.
• Legal & Regulatory Authorities: Government bodies, tax authorities (such as the Goods and Services Tax Network and Income Tax Department), or law enforcement agencies when compelled by a valid court order, summons, or statutory requirement under Indian law.

6. Data Retention Policy

We retain personal information for as long as your account remains active or as required to fulfill the purposes described in this Policy:

• Financial and Invoice Ledger Records: Retained for a mandatory statutory period of 8 (eight) financial years in accordance with Section 128 of the Indian Companies Act, 2013 and GST statutory preservation rules.
• Technical Session Logs: System and diagnostic logs are automatically purged or anonymized on a rolling 90-day retention schedule.
• Inactive Account Data: Upon account closure, all non-statutory personal identifiers are permanently scrubbed or irreversibly anonymized.

7. User Rights & Account Deletion Request

In alignment with the Digital Personal Data Protection Act, 2023, Google Play Console developer requirements, and Apple App Store Review Guideline 5.1.1(v), every user possesses the right to access, rectify, review, or request the permanent deletion of their account and associated personal data.

How to Request Account & Data Deletion:

1. In-App Self-Service: In the Suncor Commission mobile application, navigate to Profile → Account Settings → Request Account Deletion. Follow the on-screen confirmation prompts.
2. Email Deletion Request: Send an email from your registered email address to info@suncorindia.in with the subject line "Account Deletion Request - [Your Registered Mobile Number]".

Processing Timeline: Our compliance team will acknowledge your request within 48 hours and verify account ownership. Upon verification, any remaining undisputed commissions will be settled, the account will be deactivated immediately, and all personal data not required for statutory tax compliance will be permanently purged within 15 business days.

8. Data Security & Storage

We implement comprehensive technical and organizational security measures to protect your sensitive personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between the mobile application, web browser, and backend servers is encrypted using industry-standard TLS 1.3 / HTTPS protocols.
• Credential Security: User passwords and secret authentication tokens are hashed using salted cryptographic algorithms (Bcrypt with high work factors). Cleartext passwords are never stored or logged.
• Role-Based Access Controls (RBAC): Access to financial ledger data and identity records is strictly limited to authorized Suncor compliance and finance personnel on a least-privilege basis.

9. Children's Privacy

The Suncor Commission Program is strictly an enterprise and professional trade engagement platform. It is not intended for or directed at individuals under the age of 18 (eighteen) years. We do not knowingly collect personal data from minors. If we discover that a minor has registered, the account will be terminated immediately.

10. Updates to this Policy

We may revise this Privacy Policy periodically to reflect enhancements in application functionality, legal requirements, or regulatory guidance. Any material amendments will be announced via an in-app notice, push notification, or an updated effective date at the top of this document. Continued use of the Platform after the notification date constitutes acceptance of the amended terms.

11. Grievance Officer & Contact Details

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023, the details of the designated Grievance Officer for Suncor India are set forth below: