Privacy Policy

1. Overview

Trionova Ventures Pvt Ltd (“Trionova“, “we“, “us“) values your privacy. This Privacy Policy is published in accordance with:

Section 43A of the Information Technology Act, 2000 read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules“);
Rule 3 and Rule 4 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
The Digital Personal Data Protection Act, 2023 (“DPDPA“) as and when notified in force;
Applicable Reserve Bank of India (“RBI“) guidelines, including Card-on-File Tokenisation, Storage of Payment System Data, and Payment Aggregator norms;
The Consumer Protection (E-Commerce) Rules, 2020.

2. Scope & Applicability

This Policy applies to all users of the Trionova website, mobile applications, APIs, and any related services (collectively, the “Platform“), including Buyers, Vendors, and visitors.

3. Key Definitions

Personal Data means any information relating to an identified or identifiable natural person.
Sensitive Personal Data or Information (SPDI) as defined under Rule 3 of the SPDI Rules includes passwords, financial information such as bank account or card details, physical, physiological and mental health condition, biometric information, etc.
Data Fiduciary and Data Principal shall have the meanings ascribed to them in the DPDPA.

4. Information We Collect

We collect the following categories of information:

Identity data: name and, where voluntarily provided, gender and date of birth.
Contact data: email address, mobile number, shipping / billing address.
Account credentials: hashed password (never stored in plain text; hashed using bcrypt).
Vendor KYC data: PAN, GSTIN, business incorporation documents, bank account & IFSC, address proof.
Transaction data: orders, order status, payment method (COD / online), invoices.
Payment data: handled and stored solely by our RBI-authorised Payment Aggregator. Trionova does not store card numbers, CVV, UPI PIN, or bank passwords on its servers.
Device & usage data: IP address, browser type, device identifiers, session logs, pages visited (for analytics and fraud prevention).
Location data: pincode / city for serviceability checks (grocery, shipping).

5. Purpose of Collection

We use your Personal Data for the following purposes:

To create and manage your account and provide the Platform’s features.
To process orders, payments, invoices, shipping, returns, and refunds.
To perform Vendor KYC and comply with Prevention of Money Laundering Act, 2002 (PMLA) and RBI KYC Master Directions where applicable.
To detect, prevent, and investigate fraud, security incidents, and prohibited activities.
To respond to customer support and grievance requests.
To send transactional and, with consent, promotional communications.
To comply with legal, tax (GST/TCS), and regulatory obligations.

6. Legal Basis for Processing

Where the DPDPA is in force, we process your Personal Data on the following legal bases:

Your consent, which may be withdrawn at any time in accordance with applicable law;
Performance of a contract to which you are a party;
Compliance with a legal obligation; and
For certain legitimate uses permitted under Section 7 of the DPDPA.

7. Cookies & Tracking Technologies

We use strictly necessary cookies for authentication (HttpOnly, Secure) and analytics cookies to improve the Platform. You can control cookies through your browser settings. Disabling essential cookies may impair functionality such as login and checkout.

8. Data Sharing & Disclosure

We share Personal Data only with:

Vendors: Buyer’s name, shipping address, and phone number are shared with the fulfilling Vendor solely for order processing.
Payment Aggregators & Banks: for processing payments and refunds in accordance with RBI norms.
Logistics & Courier partners: shipping address, phone number, and order details for delivery.
Regulatory / Government authorities: where required under applicable law, court order, or lawful request.
Technology sub-processors: cloud hosting, email, SMS, WhatsApp providers, bound by strict confidentiality obligations.

We do not sell your Personal Data to any third party.

Section 8A — Marketplace & Vendor Data Responsibility

Trionova operates a marketplace platform connecting Buyers and independent Vendors. Vendors receive limited Buyer information strictly for order fulfilment, delivery, customer support, returns, refunds, and compliance purposes. Vendors are contractually required to:

use Buyer data only for authorised transaction-related purposes;
maintain appropriate security safeguards;
not disclose Buyer data to unauthorised third parties;
comply with applicable data protection and consumer protection laws; and
delete or anonymise Buyer data when no longer required for lawful purposes.

Trionova is not responsible for a Vendor’s independent misuse of Personal Data beyond the scope authorised by the Platform, provided Trionova has implemented reasonable contractual and technical safeguards.

9. Payment Data — RBI & PCI-DSS

Trionova uses RBI-authorised Payment Aggregators. In compliance with the RBI Circular on Storage of Payment System Data dated 6 April 2018, all payment data pertaining to Indian users is stored on servers located within India.

In compliance with the RBI Guidelines on Restrictions on Storage of Actual Card Data and the Card-on-File (CoF) Tokenisation Framework, we do not store actual card numbers or CVV on our systems. Where you choose to save a card, only a tokenised representation issued by the card network is retained, encrypted, and processed by the Payment Aggregator.

Our Payment Aggregator is PCI-DSS Level 1 certified. Payment data in transit is protected by TLS 1.2 or higher.

9A. Refunds, Chargebacks & Payment Disputes

When a Buyer initiates a chargeback, payment dispute, reversal request, or bank investigation, Trionova may share relevant transaction records, invoices, shipment details, delivery confirmation, customer communications, and KYC information with the payment gateway, bank, card network, UPI service provider, or competent authority for investigation and dispute resolution.

Disputed transaction amounts may be temporarily withheld from Vendor settlements until the payment dispute is resolved. Trionova will process refunds and chargeback outcomes in accordance with the decision of the relevant payment service provider, bank, card network, RBI regulations, and applicable law.

Trionova does not receive, process, store, or retain CVV, PIN, full card number, magnetic stripe data, or other prohibited payment credentials on its own infrastructure at any stage of the transaction flow.

10. Data Retention

We retain Personal Data only for as long as necessary for the purposes set out above or as required under applicable law, including:

Invoices & tax records: 8 years (Section 36 CGST Act, 2017).
Vendor KYC: for the duration of the relationship plus 5 years thereafter (PMLA).
Transaction logs: minimum 180 days (Rule 3(1)(g) IT Rules 2021).
Marketing preferences: until withdrawal of consent.

10A. Account Deletion & Data Deletion Requests

Users may request deletion of their account by contacting support@trionovashop.in. Upon verification of the request, Trionova will delete or anonymise Personal Data that is no longer required for legal, tax, accounting, fraud prevention, dispute resolution, or regulatory compliance purposes. Certain records may be retained for mandatory statutory retention periods described in Section 10.

11. Security Practices

We implement “reasonable security practices and procedures” as required under Section 43A of the IT Act and Rule 8 of the SPDI Rules, including:

Passwords stored only as bcrypt salted hashes.
TLS 1.2+ encryption in transit.
Role-based access control and audit logging.
Regular vulnerability assessments and penetration testing.
Despite these measures, no method of transmission over the Internet is 100% secure. In the event of a cyber security incident affecting our information systems, Trionova will comply with the Indian Computer Emergency Response Team (CERT-In) Directions dated 28 April 2022, including reporting notifiable cyber incidents to CERT-In within the prescribed time period, and will notify affected users where required by applicable law.

Despite these measures, no method of transmission over the Internet is 100% secure. In the event of a data breach affecting your Personal Data, we will notify the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of becoming aware, in line with CERT-In Directions dated 28 April 2022, and notify affected users promptly.

11A. Automated Fraud Prevention & Profiling

Trionova may use automated tools to detect suspicious transactions, unusual account activity, payment fraud, bot traffic, abuse of promotional offers, and security threats. Such processing is used solely for fraud prevention, platform security, and risk management and may result in temporary transaction review, payment verification, account restrictions, or additional identity checks. Users may contact us for manual review of significant account actions.

12. Your Rights

Subject to applicable law, you have the following rights:

Right to access your Personal Data.
Right to correction and erasure of inaccurate or unnecessary data.
Right to grievance redressal via our Grievance Officer.
Right to nominate another individual to exercise rights in the event of your death or incapacity (DPDPA).
Right to withdraw consent at any time; withdrawal will not affect the lawfulness of processing based on prior consent.

To exercise your rights, write to privacy@trionovashop.in.

13. Children’s Privacy

The Platform is not intended for individuals under the age of eighteen (18). We do not knowingly collect Personal Data from minors. If we become aware of such collection, we will promptly delete the data.

14. Cross-Border Transfers

Payment data is stored within India per RBI guidelines. Certain non-payment data may be processed by sub-processors located outside India; in such cases, transfers occur only to jurisdictions notified by the Central Government under Section 16 of the DPDPA or under contractual safeguards.

14A. International Users

The Platform is intended primarily for users located in India. If you access the Platform from outside India, you acknowledge that your Personal Data may be collected, transferred to, stored in, and processed in India in accordance with this Privacy Policy and applicable Indian law.

15. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for their privacy practices. Please review their policies separately.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified through email or on-Platform notice. Continued use of the Platform after the effective date constitutes acceptance.

17. Grievance Officer

Under Rule 5(9) of the SPDI Rules and Rule 3(2) of the IT Rules 2021:

Name: Mr. Dipankar Roy

Company: Trionova Ventures Private Limited

Email: support@trionovashop.in

Phone: +91 8420634313

Address: 37 Dr Abani Dutta Road, Salkia, Howrah, Bamangachi, Bally Jagachha, Howrah – 711106, West Bengal, India.

Acknowledgement: within 48 hours ·

Resolution: within 15 days

18. Contact Us

For any privacy-related queries: support@trionovashop.in · General support: support@trionovashop.in · +91 8420634313

18A. Consent Management & Marketing Communications

Where required by applicable law, Trionova will obtain your consent before sending promotional emails, SMS, WhatsApp messages, or other marketing communications. You may opt out of marketing communications at any time by using the unsubscribe link in the communication, updating your account preferences, or contacting us at support@trionovashop.in. Transactional communications relating to orders, payments, security, legal notices, and account administration may continue even if marketing consent is withdrawn.