Privacy Policy

HDIL Ind Park Chandansar Co-op Societies Association Limited (“HDIL-IPCA”, “the Association”, “we”) is a registered co-operative societies association, Registration No. PLR/VSI/GNL/(O)/247/YEAR-2021, at Survey No. 139, Hissa No. 4, 5 (Part), Chandansar, Virar (East), Dist. Palghar, Maharashtra 401303.

For the purposes of the Digital Personal Data Protection Act, 2023 (“the DPDP Act”) we are the Data Fiduciary for the personal data described below, and you — our members, their staff, and visitors to this website — are the Data Principals.

This notice covers this website and the member portal at the same address. It does not cover any separate service you reach by following a link away from here.

Only what the Association needs to run its own affairs. In practice that is:

When you register as a member

• Your name, username, email address and phone number.
• Which building and gala you occupy, and whether you own or rent it.
• Your business name and type.
• Whether you hold a federation post (office bearer of a building, or committee member), and which.
• A password, which is stored only as a cryptographic hash — never as text anyone can read, including us.
• A profile photograph, if you choose to add one.

When you use the member portal

• Your business directory listing, if you create one: description, contact details, GST number, photographs and opening hours.
• Dues raised against you or against a building you are registered in, and the payment receipts and transaction references you upload to evidence payment.
• Grievances you file and the correspondence on them.
• Messages you send to other members, and any files attached to them.
• Poll responses, workshop and meeting registrations, and attendance.
• Job vacancies you post, and any applications and CVs sent to them.
• Notification preferences, and — if you enable them — the browser push subscription needed to deliver alerts to your device.

Automatically

• Security events: sign-ins by staff accounts, failed sign-in attempts, password changes and password resets, together with the IP address they came from. This is kept as a security record, not to profile anyone.
• Aggregate, cookieless website analytics — page views, referring site, country, device type. These are counts, not individuals; no identifier is stored on your device and you are not tracked between visits or across other websites.

If you contact us without an account

• The name, email address, phone number and message you submit on the contact form.

We do not collect financial account credentials, card numbers, biometric data, or location data, and we do not buy personal data from anyone else.

We do not use your personal data for advertising, we do not sell it, and we do not use it to make any automated decision that produces a legal or similarly significant effect on you.

We process your personal data on the basis of the consent you give when you register, and for the certain legitimate uses the DPDP Act permits — chiefly maintaining the Association’s own records and complying with the law.

You may withdraw your consent at any time by writing to hdilipcf@gmail.com. Withdrawing consent is as easy as giving it. Two honest consequences: withdrawal does not undo processing that was lawful before you withdrew, and because membership of the Association cannot be administered without the data listed in section 2, withdrawing consent in full means we can no longer maintain your member account.

You can also turn off individual channels without withdrawing consent altogether — push notifications from your browser or device settings, and email notices by asking the office.

Inside the Association, your data is visible to the office staff and committee members who need it for the purposes above. Two specific rules are worth stating plainly:

• Your business directory listing is visible to other signed-in members. That is its purpose, and you choose what goes in it.
• A bill raised against a building is visible either to that building's chairman, secretary and treasurer, or to every member registered in the building — whichever the office chose when raising it.

Outside the Association, we use a small number of service providers who process data strictly on our instructions (Data Processors under the DPDP Act):

The contact page embeds a Google map. It is not loaded until you click it, so Google receives nothing about your visit unless you choose to open the map.

We will disclose personal data to a public authority only where the law requires it, and we do not otherwise share, rent or sell it to anyone.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires — whichever is longer. In practice:

When a period ends, the data is deleted or irreversibly anonymised. Where a record must be kept for financial or legal reasons after you leave, we keep only that record and not your wider profile.

Under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it is being processed.
• Correction and completion — have inaccurate or incomplete data corrected. Most of it you can edit yourself from your profile.
• Erasure — ask us to delete your personal data, except where we are required to keep it (see section 6).
• Withdraw consent — at any time, as described in section 4.
• Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — complain to us first, and to the Data Protection Board of India if we do not resolve it.

To exercise any of these, write to hdilipcf@gmail.com from the email address on your account, or to the Grievance Officer below. We will respond within 30 days.

The Act also places a duty on you: the information you give us must be authentic, and you must not impersonate anyone else or file a false or frivolous complaint.

If you have a complaint about how your personal data has been handled, the Association’s Grievance Officer is:

We aim to acknowledge a complaint within 7 days and resolve it within 30. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India.

The safeguards actually in place on this system:

• All traffic is encrypted in transit (HTTPS), and the site instructs browsers never to connect over plain HTTP.
• Passwords are stored only as bcrypt hashes. Nobody at the Association can read your password.
• Changing your password immediately invalidates every existing sign-in session on every device.
• Password reset links are stored hashed and expire after one hour.
• Sign-in attempts are rate limited to frustrate password guessing, and failed attempts on real accounts are logged.
• Payment receipts and documents are served through short-lived signed links rather than public URLs, so holding a link is not enough to read one.
• Uploads are restricted to a fixed list of file types and sizes.
• Access is limited by role — a member cannot reach administrative functions, and administrative actions are recorded in an audit log.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected person, as the DPDP Act requires.

This website sets no advertising or tracking cookies, and does not track you across other websites. Our analytics are cookieless and count visits rather than people.

What we do store in your own browser, and only for the site to function:

You can clear all of this at any time from your browser settings. Doing so will sign you out of the member portal.

The member portal is intended for adults — the property owners, tenants and business operators of the estate — and accounts are created only after the Association approves an application. We do not knowingly collect the personal data of anyone under 18. The DPDP Act requires verifiable parental consent before processing a child’s data, and prohibits tracking or targeted advertising directed at children; we do neither.

If you believe a child’s data has reached us, please tell the Grievance Officer and we will delete it.

If we change how we handle personal data, we will update this page and change the “Last updated” date at the top. Where a change materially affects your rights, we will tell members directly through the portal rather than relying on you to notice.

This notice is published in English. If you would prefer it in Hindi or Marathi, write to hdilipcf@gmail.com and we will provide it.