Privacy Policy

1 About Posttools

Posttools is operated by Xero Smart Enterprises.

Our business address is:
24, Shiv Gorakh Colony,
VP – Nindar, Via – VKI Area,
Jaipur, Rajasthan – 302013,
India

Posttools provides software tools intended to assist India Post franchise operators and franchise outlets with supported franchise, customer, postal booking, reporting and related operational activities.

Where Posttools determines the purpose and means of processing personal data collected directly through the service, Posttools/Xero Smart Enterprises is responsible for that processing in accordance with applicable law.

Where a franchise operator enters information relating to its own customers, senders, receivers or postal transactions, that franchise operator is responsible for ensuring that it is authorised to collect and process such information and to provide it to Posttools for the relevant service.

2 Who May Use Posttools

Posttools is a business utility intended for India Post franchise operators and franchise outlets.

The service is not intended for general consumer registration. Account holders must be at least 18 years of age.

By creating or operating a Posttools account, you represent that you are at least 18 years old and are using the service in connection with an India Post franchise or franchise outlet.

3 Information We Collect

3.1 Franchise Account Information

When a franchise account is created or maintained, we may collect:

• Franchise name
• Owner or authorised user's name
• Mobile number
• Email address
• Business or franchise address
• City
• State
• PIN code
• Account and registration information necessary to operate the service

3.2 Postal Booking and Customer Information

When a franchise operator uses Posttools for customer management, postal booking, article preparation, receipts, reporting or related functions, the information entered may include:

• Sender name and address
• Sender PIN code
• Sender mobile/contact information
• Receiver name and address
• Receiver PIN code
• Receiver mobile/contact information
• Destination or destination country
• Article number, tracking number or booking reference
• Article weight
• Postal service or article type
• Declared or order value
• Customs-related information where applicable
• HS code and description
• Tariff or postage information
• Other information necessary for the relevant postal transaction

Franchise operators must only enter personal data that they are lawfully permitted to process for the relevant postal or business purpose.

3.3 KYC and Aadhaar Information

Posttools may introduce identity verification or KYC functionality where required or permitted for a particular service.

If Aadhaar-based verification is introduced, any collection or processing of Aadhaar-related information will be subject to the applicable legal and regulatory requirements and the specific technical method used for verification.

Posttools will seek to limit KYC information to what is necessary for the relevant verification purpose and will not intentionally retain Aadhaar information beyond what is required or permitted for the applicable service.

3.4 Subscription and Payment Information

For subscriptions and payments, we may process:

• Selected subscription plan
• Subscription status
• Payment amount
• Transaction status
• Payment reference
• Payment gateway order or transaction identifiers
• Payment date

Payments are processed through Razorpay. Complete card numbers, CVV, UPI PIN, internet-banking passwords and similar payment authentication credentials are not intended to be stored directly by Posttools.

3.5 Technical and Security Information

When you access Posttools, limited technical information may be processed where reasonably necessary to operate and secure the service, including:

• IP address
• Browser and device information
• Date and time of access
• Authentication/session information
• Login and security events
• Request and error information
• Information necessary to detect misuse, unauthorised access or technical failures

4 How We Use Personal Data

Personal data may be used to:

• Create and manage franchise accounts
• Authenticate users and maintain secure sessions
• Provide postal booking and franchise-management functionality
• Maintain customer and booking records
• Generate booking files, receipts, labels, reports and other operational documents
• Calculate postal tariffs and retrieve postal information
• Facilitate subscription payments
• Send OTPs and service-related messages
• Provide customer and technical support
• Respond to account and privacy requests
• Prevent fraud, abuse and unauthorised access
• Maintain service security and reliability
• Maintain appropriate business, accounting, transaction and dispute records
• Comply with applicable legal or regulatory requirements

We do not intend to use personal data for materially unrelated purposes without an appropriate lawful basis or consent where required.

5 India Post Services and APIs

Posttools may interact with India Post-related services or interfaces to provide supported functionality such as:

• PIN code and post office information
• Postal tariff/postage calculations
• Other postal information required by a supported Posttools feature

Information sent to an external service will be limited to what is reasonably necessary to perform the requested function.

Use of India Post services remains subject to the applicable terms, policies, technical requirements and availability of those services.

6 SMS and OTP Services

Posttools uses Fast2SMS for certain SMS communications, which may include OTPs, authentication messages, account notifications or service-related communications.

When an SMS is required, information such as the relevant mobile number and message content necessary to provide the service may be transmitted to the SMS service provider.

Posttools does not provide mobile numbers to the SMS provider for unrelated advertising by Posttools.

7 Email Communications

Posttools may use email service providers to send account communications, service notifications, support responses, security notices, subscription/payment information and other operational communications.

Only information reasonably necessary to send and manage such communications should be shared with the relevant provider.

8 Payment Processing

Subscription and other supported payments may be processed through Razorpay.

When a payment is initiated, information required to create, process and reconcile the transaction may be exchanged with Razorpay.

Razorpay may independently process payment, transaction, device, fraud-prevention, regulatory and other information according to its own terms and privacy practices.

Posttools does not intend to directly store your complete card number, CVV, UPI PIN, internet-banking password or similar payment authentication credentials.

You may review Razorpay's Privacy Policy for information about Razorpay's own processing practices.

9 Sharing of Personal Data

Posttools does not sell personal data.

Personal data may be disclosed or made available where reasonably necessary to:

• Hosting and infrastructure providers
• Razorpay for payment processing
• Fast2SMS for SMS/OTP delivery
• Email service providers
• India Post-related APIs or systems when required for a requested postal function
• Professional advisers or service providers where necessary
• Government authorities, courts, regulators or law-enforcement agencies where disclosure is required by applicable law
• Another party where you have specifically authorised the disclosure

We seek to limit information provided to service providers to what is reasonably necessary for the relevant service.

10 Cookies, Browser Storage and Tracking

Posttools currently does not use Google Analytics, Meta Pixel, advertising trackers or similar third-party behavioural advertising technologies.

The Franchise Portal may use browser-based storage, including session storage, where necessary for authentication, session management, security and essential application functionality.

Posttools does not currently use non-essential advertising or analytics cookies.

If we introduce non-essential cookies, analytics, advertising technologies or materially different tracking technologies in the future, this policy and any required notice or consent mechanism will be updated.

Third-party services opened through Posttools, including payment services, may independently use cookies or similar technologies under their own policies.

11 Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining appropriate business and transaction records, resolving disputes, preventing fraud, maintaining security, and satisfying legal, accounting, contractual or regulatory requirements.

Different categories of information may have different retention periods.

When information is no longer reasonably required for the purpose for which it was collected and there is no legal or legitimate requirement to retain it, we will take reasonable steps to delete, anonymise or securely dispose of it.

An account deletion request does not necessarily require immediate deletion of information that Posttools is required or permitted to retain for transaction, accounting, security, fraud-prevention, dispute or statutory purposes.

12 Data Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information processed through Posttools.

Measures may include:

• Authenticated access to protected services
• Access and refresh-token mechanisms
• Access controls
• Secure communication using HTTPS
• Database access controls
• Server and application security measures
• Limiting access based on operational requirements
• Measures intended to prevent unauthorised access, alteration, disclosure or destruction of information

No internet-based service or storage system can guarantee absolute security. Users are also responsible for protecting access to their devices, accounts and authentication information.

If you believe your Posttools account or personal data may have been compromised, please contact us promptly.

13 Your Privacy Rights and Choices

Subject to applicable law and any permitted limitations, individuals may contact Posttools regarding their personal data, including to:

• Obtain information about personal data processed by Posttools
• Request correction of inaccurate or incomplete information
• Request updating of personal information
• Request deletion or erasure where applicable
• Withdraw consent where processing is based on consent
• Raise a concern about the handling of personal data
• Request assistance concerning applicable privacy rights

Withdrawal of consent will not ordinarily affect processing lawfully carried out before the withdrawal.

Certain information may need to be retained where required or permitted for security, accounting, fraud prevention, dispute resolution or other lawful purposes.

We may need to verify the identity or authority of the person making a privacy request before acting upon it.

14 Account Deletion

A franchise user may request deletion of their Posttools account by contacting us.

After verifying the request, we will take reasonable steps to close the account and delete or anonymise personal data that is no longer required.

Some information may continue to be retained where necessary to comply with legal obligations, maintain transaction or accounting records, investigate misuse, establish or defend legal claims, resolve disputes, or satisfy other lawful retention requirements.

15 Responsibilities of Franchise Operators

Posttools enables franchise operators to enter information belonging to senders, receivers, customers and other individuals.

Franchise operators are responsible for:

• Collecting information lawfully
• Providing any notice required to the individual
• Obtaining consent where consent is required
• Entering only information necessary for the relevant postal or business purpose
• Taking reasonable steps to ensure information entered is accurate
• Protecting access to the franchise account
• Avoiding unauthorised use, disclosure, downloading or sharing of customer information

Posttools should not be used to create unrelated databases of personal information or to process personal information for purposes unrelated to legitimate franchise or postal operations.

16 Children's Data

Posttools accounts are restricted to users aged 18 years or older.

The Franchise Portal is not intended for children to create or operate accounts.

Where information relating to a minor is legitimately required as part of a postal transaction or another permitted service, the franchise operator must ensure that such information is handled in accordance with applicable law and that any required authorisation or consent has been obtained from a parent, lawful guardian or other authorised person.

17 Marketing and Analytics

Posttools currently does not use Google Analytics, Meta Pixel or similar advertising analytics services.

We do not currently use personal data collected through the Franchise Portal for third-party behavioural advertising.

If these practices materially change, this Privacy Policy will be updated and any notice or consent mechanisms required by applicable law will be implemented.

18 Third-Party Websites and Services

Posttools may contain links to or integrate with third-party websites and services.

Once you access a third-party service, that provider may process information according to its own privacy policy and terms.

Posttools is not responsible for the independent privacy practices of third parties.

19 Digital Personal Data Protection

Posttools intends to handle digital personal data in accordance with applicable Indian data protection requirements, including the Digital Personal Data Protection Act, 2023 and applicable rules and provisions brought into force under it, as they apply to our operations.

Our approach includes seeking to:

• Provide appropriate notice regarding personal-data processing
• Limit processing to legitimate and disclosed purposes
• Collect only information reasonably necessary for those purposes
• Maintain reasonable safeguards
• Provide mechanisms for applicable correction, erasure, consent withdrawal and grievance requests
• Retain information only for an appropriate period
• Use service providers responsibly

The applicability of particular statutory requirements may depend on the nature of the processing and the commencement of the relevant legal provisions.

20 Privacy Complaints and Grievances

If you have a question, complaint or concern regarding privacy or the handling of personal data, please contact Posttools so that we can review and address the matter.

Please include sufficient information for us to understand and verify your request.

Where applicable, individuals may also exercise remedies available under Indian data protection law after following the applicable grievance process.

21 Legal Disclosures

We may preserve or disclose information where reasonably necessary to:

• Comply with applicable law or valid legal process
• Respond to a lawful request from a competent authority
• Protect the security and integrity of Posttools
• Investigate fraud, misuse or unauthorised activity
• Protect the rights or safety of Posttools, its users or others
• Establish, exercise or defend legal claims

We seek to limit such disclosure to information reasonably necessary under the circumstances.

22 Changes to This Privacy Policy

We may update this Privacy Policy when our services, technology, service providers, legal requirements or data-processing practices change.

The updated policy will be published with a revised Last Updated date.

Where a change materially affects how personal data is processed, we may provide additional notice or obtain consent where required by applicable law.

Users are encouraged to review this Privacy Policy periodically.

23 Contact Us

For privacy questions, account deletion, correction requests, consent withdrawal, grievances or other privacy-related matters, contact:

Posttools
Operated by Xero Smart Enterprises

24, Shiv Gorakh Colony
VP – Nindar, Via – VKI Area
Jaipur, Rajasthan – 302013
India