DATA GOVERNANCE PROTOCOL Effective: September 15, 2026
PRIVACY POLICY & DATA SOVEREIGNTY
BULLFORD is dedicated to safeguarding your personal data, ensuring complete transparency, and upholding the highest standards of digital privacy in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act).
DPDP Act 2023 Compliant
Fully aligned with India's Digital Personal Data Protection Act, 2023 and IT Act, 2000.
256-Bit SSL Encryption
All traffic, sessions, and transaction requests are secured with end-to-end TLS 1.3 cryptographic protocols.
Zero Data Sale Guarantee
We never sell, rent, monetize, or broker your personal information to third-party advertising brokers.
RBI Tokenized Payments
Card and UPI transactions are processed through RBI-licensed PCI-DSS Level 1 payment aggregators (Razorpay).
1. Data Fiduciary & Corporate Identity
Under Section 2(i) of the Digital Personal Data Protection Act, 2023, BULLFORD RETAIL PRIVATE LIMITED acts as the Data Fiduciary responsible for deciding the purpose and means of processing personal data collected through the online store (bullford.in) and physical atelier retail terminals.
Registered Store & Atelier: #185 Dr Vishnuvardhan Road Near RNSIT College, Channasandra Layout, Bengaluru - 560098, Karnataka, India
We collect only the minimum necessary data required to process orders, manufacture and fit garments, compute tax, and dispatch shipments:
Identity & Contact: Full name, 10-digit mobile phone number (used for passwordless SMS/WhatsApp OTP authentication), and optional email address.
Logistics & Delivery: Shipping destination address, landmark, city, state, and 6-digit Indian Postal PIN code for courier serviceability verification.
Transactions & Invoicing: Products ordered, garment sizes (S, M, L, XL), GST breakdown (CGST 2.5% + SGST 2.5% for garments under ₹1,000), payment mode, and digital tax invoice numbers.
Loyalty & Bull Coins: Lifetime expenditure ledger, tier status (STANDARD / VIP), and coin accumulation/redemption balances.
Payment Credentials (Tokenized): Payment is processed securely via Razorpay. BULLFORD never stores raw credit/debit card numbers, CVVs, or NetBanking PINs on our servers.
Technical & Telemetry: Device IP address, user agent, browser type, and anonymous session identifiers.
3. Purpose & Legal Basis of Processing
We process personal data strictly in accordance with consent and legitimate statutory purposes:
Contractual Fulfillment
Manufacturing, precision garment packing, dispatch from Bangalore Atelier, and 24-hour courier tracking.
Statutory Compliance
Issuing official GST tax invoices, audit trails in dual-entry stock ledgers, and E-Way bills.
Anti-Fraud & Anti-RTO
Verification of high-risk Cash on Delivery (COD) orders to protect warehouse inventory allocation.
BULLFORD uses local browser storage and minimal cookies to provide core shopping functionality:
Storage Key
Type
Purpose
Duration
bullford_web_cart_v1
LocalStorage
Stores your selected garments, sizes, and cart quantities across reloads.
Persistent
bullford_cookie_consent
LocalStorage
Records your preference to accept or decline analytics cookies.
1 Year
bullford_customer_session
Encrypted Cookie
JWT token preserving authentication state for order tracking and Bull Coins.
30 Days
You can adjust your cookie consent at any time by clicking the dedicated Cookie Icon positioned on the bottom-left corner of the screen.
5. Logistics & Third-Party Processing
We disclose personal data strictly on a need-to-know basis to authorized operational partners:
Courier & Delivery Partners:Delhivery Logistics, BlueDart Express, and Shiprocket receive only your name, phone number, and delivery address to fulfill courier routing and generate 4x6 thermal shipping labels.
Payment Aggregators:Razorpay Software Private Limited receives transaction IDs and order totals to authorize UPI, cards, and netbanking.
Communication Gateways: Meta WhatsApp Business API for automated order confirmation and live dispatch notifications.
Statutory Authorities: GST Network (GSTN) and Indian revenue authorities for tax invoice auditing as required by law.
6. Security Architecture & Data Safeguards
BULLFORD employs military-grade technical controls to protect data from unauthorized access, breach, or alteration:
Cryptographic Protocols: Mandatory TLS 1.3 encryption across all public web traffic and REST APIs.
Database Isolation: PostgreSQL 18 with row-level locks (FOR UPDATE) preventing race conditions, and cryptographic hashing for sensitive fields.
Dual-Ledger Auditing: Every stock mutation and coin balance change is recorded in an immutable append-only ledger.
7. Data Retention & Archival
We retain personal data only as long as necessary to satisfy the purpose for which it was collected. Under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, books of account and tax invoices containing customer billing addresses must be maintained for a statutory period of 72 months (6 years). Marketing contact permissions may be revoked at any time by opting out via SMS or email.
8. Your Rights Under India's DPDP Act, 2023
As a Data Principal under the DPDP Act, 2023, you hold the following statutory rights:
Right to Access
Request a summary of your personal data processed by BULLFORD.
Right to Correction
Correct inaccurate, incomplete, or outdated personal data.
Right to Erasure
Request deletion of data no longer required for legal obligations.
Right to Grievance Redressal
Direct recourse with our designated Data Protection Officer.
9. Grievance Officer & Regulatory Recourse
In compliance with the Information Technology Act, 2000 and Section 12 of the DPDP Act, 2023, the details of the designated Data Protection and Grievance Officer are set forth below:
Designation: Data Protection & Grievance Officer
Entity: BULLFORD RETAIL PRIVATE LIMITED
Address: #185 Dr Vishnuvardhan Road Near RNSIT College, Channasandra Layout, Bengaluru, Karnataka – 560098
