Privacy Policy

1. Who we are and what this notice covers

This Policy explains how Burbn Inc., trading as Burbn B2B, processes personal data in connection with https://b2b.scrolling.in and related B2B account, inquiry, ordering, support and supplier services. Our registered office is 503, A1 Tower, Sector 73, Noida, Uttar Pradesh 201301, India. Contact privacy@scrolling.in for privacy requests and the contacts in the Grievance Policy for formal complaints.

We act as the data fiduciary or controller when we determine the purposes and means of our own processing. A Supplier ordinarily acts separately for its own quotation, fulfilment, invoicing, warranty and legal obligations. A vendor processing solely on instructions is a processor; a bank, regulator or Supplier is not automatically our processor merely because we exchange data with it.

This notice covers personal data about proprietors, business representatives, employees, authorised users, Supplier contacts, delivery recipients, visitors and people who contact us. Business-related information can be personal data when it identifies an individual. An organisation's name alone may not identify a person; a proprietor's name, individual email, mobile number or identity document often does.

This notice does not replace an independent Supplier's or payment provider's notice for processing it controls. It also does not automatically apply every social or retail feature of scrolling.in to the B2B service.

The payment method for an Order is supplied in its final approved quotation. Where a payment provider processes information for that method, its identity and applicable notice must be available through the quotation or the associated payment interface before the relevant data is submitted. Only information needed for the payment, verification, refund or applicable legal obligation should be shared for that purpose.

2. Indian law and phased commencement

We comply with the Indian privacy and information-technology requirements applicable to our processing, including the Information Technology Act, 2000 and the sensitive-personal-data rules where applicable, and the Digital Personal Data Protection Act, 2023 and its rules as their relevant provisions come into force.

The DPDP framework has phased commencement. References in this notice to its rights, consent requirements or Board procedures apply as statutory requirements when those provisions are legally operative. To the extent we offer a privacy control before a provision commences, it is also our service commitment under this notice; it is not a representation that every DPDP provision is already in force.

Additional local requirements may apply where we target or serve an individual in another jurisdiction. Where a regional law applies, its mandatory rights and deadlines are preserved. A choice of Indian contract law does not remove those protections.

3. Information we process

Depending on the service used and the information provided, we process the following categories. A required field should be identified when requested; an optional permission is not a condition of unrelated services.

Do not send card security codes, banking passwords or one-time passwords to Burbn staff or in chat. Full card processing should occur within the authorised provider's interface. We do not require Aadhaar or another particular identity document for every B2B activity; any request must have a relevant lawful purpose and a suitable verification route.

4. Where information comes from

We receive data from you; your business administrator or authorised employer representative; the Buyer or Supplier you deal with; payment and verification providers; carriers and inspection providers; support reports; and technical interactions with the Platform. We may verify business-registration or licence facts against lawful public or authoritative sources.

If you provide another person's contact or delivery details, ensure you have the necessary authority and have informed them appropriately. Do not upload an end-customer database merely because one delivery address is needed.

If you use a shared Burbn sign-in, authentication identifiers and necessary account information may be exchanged with the relevant Burbn authentication service. Shared sign-in does not mean private B2B prices, drawings and Orders become public on other Burbn properties. Any additional cross-service use must have a disclosed purpose and lawful basis.

5. Purposes and legal grounds

We process data only for lawful, identified purposes and under a basis actually available in the applicable law. These purposes include account operation, business verification, the RFQ or Order you requested, delivery, payment, tax and recordkeeping duties, support, security, grievance handling and the exercise or defence of legal rights.

For India, we obtain consent where required, including for sensitive personal data under applicable rules and optional uses requiring consent. Where a specific DPDP legitimate use or exemption is available and operative, we rely on it only within its conditions—for example, data voluntarily provided by an individual for a specified purpose without indicating non-consent, where that provision applies. A business objective, a contract or a generic “legitimate interest” is not treated as a catch-all Indian statutory permission.

For processing subject to another jurisdiction's law, a ground such as contractual necessity, legal obligation, consent or a properly assessed legitimate interest may apply according to that law and the relevant notice. We do not import one jurisdiction's terminology as an unlimited basis everywhere.

If we wish to use identifiable data for a materially different purpose, we will give the appropriate new notice and obtain fresh consent where required. We do not treat a support request or an RFQ as permission to sell a person's contact details or send unrelated promotional messages.

6. Consent and optional choices

Where consent is the basis, the request will identify the data and purpose in clear language and permit a meaningful affirmative choice. Optional analytics, personalised advertising, marketing and device permissions must not be bundled into mandatory acceptance of the marketplace contract.

You may withdraw consent through the relevant feature, a communication's unsubscribe control, available cookie controls or privacy@scrolling.in. Revoking a device permission stops the associated access at device level. We will stop the consent-dependent processing within a reasonable period and instruct processors accordingly, subject to lawful retention or another independently available ground.

Withdrawal does not make earlier lawful processing unlawful. It may prevent a requested feature or future service that genuinely requires the data, but must not result in an unrelated penalty. We will explain any necessary consequence and retain only the information that another lawful purpose actually requires.

7. Who can receive information

We select and contract with processors according to their role, restrict instructed processing to its purposes, and require appropriate confidentiality, security, onward-processing controls and deletion or return arrangements. Independent recipients remain responsible for their own lawful processing. We remain responsible for disclosures and vendor oversight imposed on us by law.

If the business is reorganised or transferred, relevant data may be reviewed or transferred under safeguards and applicable law. The recipient must respect applicable obligations. A transaction is not permission to use data for an unrelated purpose without the required notice and basis.

8. Visibility of messages, listings and uploaded documents

Public profiles, listings and reviews are accessible to their intended public audience and may be indexed or copied by others. Do not include identity documents, bank details or private customer information in a public field.

Private communications and documents are accessible to their intended participants and to personnel or processors who need access for support, security, legal compliance or another disclosed service purpose. They must not be described as end-to-end encrypted or inaccessible to Burbn unless the actual feature supports that statement.

An organisation may retain legitimate procurement records when an employee leaves. An individual's unrelated personal information should not be retained merely because the organisation had an account. Contact us if you need to separate your personal access or request correction without destroying a business invoice.

9. Cookies and third-party media

The Cookie Policy explains browser storage, similar technologies, purposes and controls. A technology can process personal data without setting a cookie. For example, loading product media or an embedded resource from a third-party network can disclose an IP address and request information to that provider.

We will describe enabled optional technologies and seek the choice required by law. The Cookie Policy covers B2B browser storage, shared authentication and enabled third-party resources. Information about technologies on the retail site may differ; contact privacy@scrolling.in for the current details relevant to the B2B feature you use.

10. International access and transfers

An RFQ sent to an overseas Supplier, international delivery and use of a foreign service provider may involve access to data outside India. Share only the information needed for the transaction and disclose the recipient's role. We do not promise all B2B data remains in India unless a specific service actually provides that arrangement.

Transfers must comply with applicable restrictions, security requirements and contractual safeguards. Where the DPDP transfer provisions apply, any governmental restriction and applicable sector-specific requirement must be respected. Payment-data and other sectoral localisation duties are assessed separately; a general privacy clause does not override them.

Where another jurisdiction requires an adequacy mechanism or contractual transfer safeguard, we will use an available lawful mechanism before the relevant transfer. Contact privacy@scrolling.in for information about the recipient categories and transfer safeguards relevant to your data, subject to lawful confidentiality limits.

11. Retention and deletion

We retain personal data for the purpose for which it is needed, an applicable legal retention period or a justified dispute or investigation hold. Different records have different periods. Closing an account does not erase a tax invoice that must be preserved, and a tax obligation does not justify keeping unrelated marketing data.

The following is the standard retention framework. An operative legal minimum, a binding preservation order or a necessary documented legal hold takes priority; when that reason ends, the ordinary deletion process resumes.

Where an operative law requires retention of personal data and associated processing records for a minimum period, we retain the required subset even if an ordinary period above is shorter. The detailed record schedule will identify the legal requirement and its commencement. We will explain a material retention exception when responding to a request unless law prohibits disclosure.

Deletion means removal or effective irreversible anonymisation where suitable. Pseudonymised data, identifiers and matchable hashes can remain personal data and are not treated as anonymous merely because the original name is absent.

12. Security and incident response

We apply safeguards proportionate to the data and risk, including access restrictions, authentication and session protection, appropriate encryption, logging, secure development, vendor controls and review of material security incidents. These duties extend to staff and processors with access to personal data.

No internet service can promise absolute security. That fact does not remove our obligation to apply reasonable safeguards or comply with breach-notification law. We do not claim a specific certification, payment-security attestation or independent audit solely through this notice.

If a breach occurs, we will assess affected data and people, contain the event, preserve necessary evidence and provide notifications required by the applicable law. Reportable cyber incidents are reported to CERT-In within the applicable six-hour deadline. When operative DPDP breach rules apply, the required notice to affected individuals and initial Board notification must be made without delay, with the further Board information within 72 hours or a lawfully permitted extension. These are different reporting duties, not interchangeable deadlines.

Affected-person notices will include the information required by law, such as the nature and likely consequences, mitigation, suggested protective steps and a contact. Report suspected account compromise or exposure to privacy@scrolling.in and support@scrolling.in without sending additional sensitive data unnecessarily.

13. Automated tools and AI

Automated tools may assist search, translation, matching, fraud detection, security, moderation and support. Their outputs can be inaccurate. A translation or generated description must not silently alter an accepted product specification or create a binding Order without the prescribed approval.

You may request human review of a material account restriction, claim or payment decision through the grievance process. Applicable rights concerning automated decisions are preserved where the relevant law provides them.

Private RFQs, technical drawings, private negotiations and identity documents are not authorised for general-purpose model training simply by their upload. Any proposed separate training use requires a defined lawful basis, appropriate notice, rights and safeguards. Optional AI or camera features must provide a feature-specific notice before processing that exceeds ordinary document hosting or communication.

14. Marketing and business communications

Order confirmations, delivery updates, security warnings, necessary service notices and responses to your inquiry are distinct from promotional messages. We may need to send necessary transactional communications while performing the requested service.

Promotional email, SMS, messaging-app contact and advertising must follow applicable consent, telecom and preference requirements. Refusing promotional messages does not remove access to an Order or claim. Use the unsubscribe control or write to privacy@scrolling.in to stop promotional use. Do not assume acceptance of a WhatsApp support conversation authorises unrelated group marketing.

We do not sell personal data as a business-contact list. Where an advertising practice is legally defined as sale or sharing in an applicable jurisdiction, we will assess and provide the required disclosure and choice before enabling that practice; a contractual “no sale” label is not used to ignore its legal definition.

15. Your requests and choices

Subject to the applicable law and verification, you may request information about our processing; access to an appropriate summary or copy; correction, completion or updating; deletion where no lawful retention reason remains; withdrawal of consent; and grievance redressal. We also provide the applicable nomination route for death or incapacity when the DPDP provisions are operative and support an appropriate authorised representative.

Where another applicable law grants portability, restriction, objection, advertising opt-out or other additional rights, we will apply those rights according to that law. We do not suggest that the Indian DPDP Act itself grants every right found in another privacy regime.

Send a request to privacy@scrolling.in using the registered contact where possible. Identify the business account and request without including excessive personal documents. We may seek proportionate identity or authority evidence and will not use verification material for unrelated purposes. Requests may also concern information supplied by an employer or delivery sender, even if the individual has no account.

16. Response periods and escalation

We aim to provide a substantive privacy-request response within 30 calendar days. A shorter applicable statutory deadline takes priority. If the law permits an extension for a complex request, explain the reason and expected response date; an extension is not automatic. Where the operative DPDP grievance rules require publication of a response period no longer than 90 days, our stated 30-day standard remains the ordinary service period rather than an automatic 90-day extension.

There is no charge for ordinary privacy-rights requests. A refusal or partial refusal will explain the legal or factual basis where disclosure is allowed. We will not penalise a person merely for raising a good-faith privacy request.

You may escalate to the privacy contact or Grievance Officer in the Grievance Policy and then to the competent authority according to the applicable law. Access to the Data Protection Board's complaint mechanism depends on the operative provisions and any prerequisite, including first exhausting the available grievance-redressal opportunity where the Act requires it. Other statutory routes have their own conditions. The contract's arbitration clause does not waive non-excludable privacy remedies.

17. Children and authorised representatives

Burbn B2B is for adult business users and does not offer accounts or paid participation to children under 18. Do not provide a child's information for business verification or include it unnecessarily in uploaded material.

If we learn that an account or processing involves a child, we will restrict the affected activity and assess deletion, required reporting and any legally necessary preservation. We do not knowingly undertake targeted advertising or prohibited behavioural tracking of children. A report of child exploitation is treated urgently under the content and grievance policies.

Where a person has a lawfully authorised representative or guardian, we will assess appropriate authority and legal requirements. A disability alone is not a basis to presume that an adult cannot exercise their rights.

18. Changes and contact

We will update this notice when material processing changes. Give appropriate advance notice and seek fresh consent where required. A new notice does not retrospectively legitimise an undisclosed incompatible use.

Privacy questions and requests: privacy@scrolling.in. General support: support@scrolling.in. Formal complaints: grievance@scrolling.in. Legal requests: legal@scrolling.in. The current officer and address details are in the Grievance Redressal and Contact Policy. Language assistance and notices in legally required languages will be provided as applicable.