ION EXCHANGE

Legal

Privacy Policy

Governing Legal Framework: Information Technology Act, 2000 (IT Act), Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Digital Personal Data Protection Act, 2023 (DPDPA 2023).

1. About Ion Exchange (India) Limited

1.1 Company overview & scope

Ion Exchange (India) Limited (“Ion Exchange”, “Company”, “We”, “Us”, or “Our”) is a public limited company incorporated under the Companies Act, 1956, having its registered office at 4th Floor, Ion House, Dr. E. Moses Road, Mahalaxmi, Mumbai 400011, Maharashtra, India. The Company is a premier provider of total water and environment management solutions under brands including ‘INDION’, ‘Hydramem’, ‘ZeroB’, and ‘Ion Resins’.

1.2 Covered digital properties

This Privacy Policy (“Policy”) governs the collection, storage, processing, transfer, disclosure, and erasure of personal data obtained through our websites, including www.ionexchangeglobal.com, www.hydramem.com, www.zerobonline.com, www.ionresins.com, www.ieiasiapacific.com, www.labwater.in, and our associated mobile applications and connected consumer IoT/smart devices (collectively, the “Platform”).

1.3 Roles under data protection law

The terms “You”, “Your”, or “Yourself” refer to any user of the Platform, including but not limited to sellers or buyers of Products on the Platform and any person who visits, accesses, or uses any data or information available on the Platform.

1.4 Integration with Terms of Use

This Privacy Policy is an integral part of and should be read in conjunction with the “Terms of Use” governing the Platform.

2. Purpose and applicability

2.1 Statutory basis

This Policy is published pursuant to Section 43A of the IT Act, 2000, Rule 4 of the SPDI Rules, 2011, and Section 5 of the DPDPA 2023 to inform Data Principals of our data handling practices.

2.2 Multilingual notice option

Pursuant to Section 5(3) of the DPDPA 2023, You have the option to access and review this Policy in English or in any of the 22 languages specified in the Eighth Schedule to the Constitution of India via the language selector on the Platform.

3. Acceptance and lawful basis for processing

3.1 Clear and affirmative consent

We process Your Personal Data only where You have given free, specific, informed, unconditional, and unambiguous consent through a clear affirmative action (e.g., ticking an unbundled opt-in box or clicking “Accept & Proceed”). In specific limited circumstances, we may process Personal Data for legitimate uses recognized under Section 7 of the DPDPA 2023 (such as responding to a voluntary inquiry or fulfilling an active commercial order).

3.2 Right to withdraw consent

You have the statutory right to withdraw Your consent at any time with the same ease with which it was provided (DPDPA 2023, s. 6(4)). You may exercise this right through Your account privacy dashboard or by writing to our Grievance Officer at ion.privacy@ionexchange.co.in. Upon receipt of withdrawal, Ion Exchange shall cease processing Your data unless required to retain it under applicable law.

3.3 Policy updates & material changes

Ion Exchange reserves the right to modify this Policy to reflect operational or regulatory changes. In the event of material modifications, We will provide prominent notice on the Platform or send direct electronic notifications prior to the effective date. Continued use of the Platform after notification constitutes acknowledgement of the updated terms.

4. Categories of personal data collected

Ion Exchange collects only such Personal Data as is strictly necessary and proportionate to fulfill the specified purposes:

  1. Identity & Contact Data: Name, postal/delivery address, billing address, telephone number, and email address.
  2. Transaction & Financial Data: Purchase history, product model/inquiry details, and payment transaction identifiers. Note: Sensitive payment card numbers, CVVs, and net-banking credentials are processed directly through RBI-authorized payment gateways and PCI-DSS compliant aggregators and are not retained on Ion Exchange servers.
  3. Technical & Device Data: IP address, browser type, operating system, device identifiers, and platform access logs.
  4. Device Telemetry & Smart Sensor Data: Where You connect smart water purifiers or IoT hardware via our Mobile Apps, sensor data (e.g., water output, cartridge life, filter metrics) is analyzed to provide operational updates and automated maintenance alerts.
  5. Communication & Feedback Records: Inquiries, survey responses, grievance submissions, and customer service call notes.

Ion Exchange may collect or receive Personal Data through the following modes:

  1. Directly from the User: Where the User voluntarily provides Personal Data through the Website, Mobile App, account registration, forms, or other Platform interfaces;
  2. Through use of the Platform: Through the User’s access to or use of the Website, Mobile App, or other Platform functionalities, including information generated through such use;
  3. From third parties: Where third parties who have lawfully collected Information relating to the User share such Information with Ion Exchange, subject to applicable law and the purposes specified in this Policy.

Users may also voluntarily provide Personal Data to Ion Exchange otherwise than through the Website or Mobile App, including through emails, logins, return forms, letters, telephone calls, feedback, or other communications. Such information may be used to respond to the User’s queries, provide the requested services, address grievances, and maintain appropriate records of feedback and communications received from the User.

5. Specific purposes of processing (purpose limitation)

In adherence to the statutory doctrine of purpose limitation (DPDPA 2023, s. 4 & s. 6), Personal Data is collected and processed solely for the following specified, lawful purposes:

  • Order Execution & Service Delivery: To process orders, facilitate product shipments, manage installations, provide warranties, and process payments.
  • Customer Support & Grievance Redressal: To address technical queries, schedule field engineer visits, and resolve complaints.
  • Service & Safety Communications: To send transaction confirmations, delivery updates, product recall notices, filter change reminders, and security alerts.
  • Platform Optimization & Fraud Prevention: To secure the Platform against cyber threats, unauthorized access, and fraudulent transactions.
  • Marketing & Promotional Communications (Strictly Opt-In): Where You have expressly consented to join our mailing list, to provide product updates, seasonal offers, and news. You may opt out at any time via the “Unsubscribe” link in any promotional email.

6. Protection of children’s personal data

Pursuant to Section 9 of the DPDPA 2023, Ion Exchange does not knowingly solicit or collect Personal Data from individuals under the age of 18 years (“Children”). If You are a parent or legal guardian and discover that Your child has provided Personal Data without verifiable parental consent, please notify our Grievance Officer immediately. Ion Exchange does not engage in behavioral tracking or targeted advertising directed at Children.

7. Disclosure and transfer of personal data

Ion Exchange treats customer information as a confidential custodian and does not sell, rent, or trade Personal Data to any third party.

Data is shared strictly on a need-to-know basis in the following circumstances:

  1. Authorized Data Processors & Service Providers: With third-party logistics partners, payment gateway providers, cloud hosting vendors, and technical maintenance teams under strict contractual confidentiality and data security obligations (DPDPA 2023, s. 8(2)).
  2. Corporate Transactions & Reorganization: In connection with a merger, acquisition, corporate restructuring, or asset transfer, provided the receiving entity agrees to handle Personal Data in compliance with this Policy and applicable law.
  3. Compliance with Legal Obligations: Disclosures mandated by law, binding court orders, or statutory notices issued by competent law enforcement or regulatory agencies under Indian law.

Note: Ion Exchange does not rely on deemed consent or silence to share data with third parties. Any voluntary third-party sharing is subject to explicit, affirmative consent.

8. Data security and retention standards

8.1 Reasonable security practices

Ion Exchange implements comprehensive technical, operational, and organizational security controls in compliance with Rule 8 of the SPDI Rules, 2011 and Section 8(5) of the DPDPA 2023. These measures include transport layer security (TLS/SSL encryption), role-based access controls, firewalls, and employee confidentiality agreements.

Access to Personal Data is restricted to authorized personnel on a need-to-know basis. Relevant employees, independent contractors, and agents are subject to appropriate confidentiality obligations and are provided with necessary training regarding the handling and security of Personal Data.

Ion Exchange follows reasonable security practices to protect Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction. However, users are responsible for maintaining the security and confidentiality of their account credentials, including usernames and passwords, where applicable.

8.2 Storage limitation & erasure

Personal Data is retained only for as long as necessary to fulfill the operational purposes for which it was collected or to satisfy statutory tax, accounting, or dispute resolution requirements (DPDPA 2023, s. 8(7)). Upon expiration of the retention period or upon a valid erasure request, data is securely destroyed, anonymized, or purged from production databases.

10. Statutory rights of data principals (DPDPA 2023)

As a Data Principal under the DPDPA 2023, You possess the following enforceable rights:

  • Right to Access Information: Right to obtain a summary of personal data processed, the processing activities undertaken, and the identities of third parties with whom data has been shared.
  • Right to Correction and Erasure: Right to request rectification of inaccurate or outdated data, completion of incomplete records, and erasure of data no longer necessary for the specified purpose. (Where Ion Exchange becomes aware of any inaccurate or outdated Personal Data, it shall take reasonable steps to verify and, where appropriate, correct or update such information and, where required, inform the relevant User of the correction or update.)
  • Right of Grievance Redressal: Right to register a grievance with the Data Fiduciary and receive a reasoned response within statutory timelines prior to escalating to the Data Protection Board of India.
  • Right to Nominate: Right to designate an individual who, in the event of Your death or incapacity, shall exercise Your data protection rights.

11. Grievance redressal mechanism

In compliance with Rule 5(9) of the SPDI Rules, 2011 and Section 8(2) of the DPDPA 2023, Ion Exchange has designated a formal Grievance Officer:

  • Designation: Data Protection & Grievance Officer
  • Official Address: Ion Exchange (India) Limited, 4th Floor, Ion House, Dr. E. Moses Road, Mahalaxmi, Mumbai 400011, Maharashtra, India
  • Email Address: ion.privacy@ionexchange.co.in, Grievance.Officer@IonExchange.co.in
  • Grievance Resolution Window: Acknowledgment within 48 hours; final resolution/reasoned response within 30 days of receipt.

Ion Exchange does not permit or knowingly facilitate the use of its Platform for sending unsolicited or unauthorized commercial communications (“Spam”). Any User who receives or becomes aware of Spam relating to Ion Exchange (India) Limited may report the same to Ion Exchange at ion.privacy@ionexchange.co.in.

12. Governing law and dispute jurisdiction

This Policy and any dispute arising hereunder shall be governed by and construed in accordance with the substantive laws of the Republic of India. Subject to statutory appeals before the Data Protection Board of India / TDSAT under the DPDPA 2023, the competent civil courts situated in Mumbai, Maharashtra shall exercise exclusive territorial jurisdiction over any judicial disputes.