DPDP Act 2023
Data protection notice.
Last updated: 2026-10-15
Tukzo by Borncode Technologies LLP processes personal data as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023. This page sums up your rights and how to use them. The full privacy notice (also in മലയാളം) says what we collect, why, who sees it and how long we keep it.
Your rights under the DPDP Act
- Access: a summary of your personal data, how we process it, and who we shared it with.
- Correction and erasure: have your data corrected, completed, updated or erased.
- Nomination: name someone to use these rights for you if you die or cannot act.
- Grievance redressal: complain to us; we reply within 30 days.
- Withdraw consent at any time — for cookies with , for an enquiry by telling us. Withdrawal does not affect what was done before it.
How to make a request
Use the request form, or write to or call the Grievance Officer below. We may check it is really you, for example by calling the number you gave, and we reply within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Grievance Officer
Categories of data processed
- Enquiries: name, mobile number, business details you add, and how you found us
- Records shops keep in the Tukzo apps (bills, payments, stock, the customer details they enter)
- Website visit totals counted without cookies or identifiers (page, device type, how visitors arrived — no IP address)
- Notes of WhatsApp or call button taps, kept 7 days, with nothing about the person
- Cookie choices, recorded with a random id
- Requests about personal data, and what we did about them
- With the visitor's consent only: visit data received by Google Analytics, Google Ads, Meta and LinkedIn
Cross-border transfer
The website and its database run on servers we rent and control. With a visitor's consent, Google, Meta and LinkedIn process visit data on their own systems, which may be outside India; staff email alerts go through Google's Gmail. We do not transfer data to countries the Central Government has restricted.
Retention
Enquiries: until 24 months after our last contact (junk: 30 days after we close it). Cookie-choice records: 24 months. Data requests: 3 years after we close them. Website visit totals (no personal data): 25 months. Button-tap notes: 7 days. Backups: 30 days. See the privacy notice for copies outside this website.
Breach notification
If a breach affects personal data, we notify the Data Protection Board of India and the people affected, as the DPDP Rules require.
For anything else, contact us at tukzoudi@gmail.com.