1. Who we are

Centre for Philately & Numismatics is a specialist dealership in rare coins, banknotes, postage stamps and covers, trading from Indore, Madhya Pradesh under proprietor Smt. Lata Lakshmi Kant Jain. This policy applies to the website at philatelynumismatic.com and any enquiry channels operated by the business.

2. Data we collect and why

2.1 Browsing the catalogue

We do not collect personally identifiable information when you browse the catalogue. The site does not use tracking pixels, advertising networks or cross-site analytics. Standard web-server logs (IP address, request path, timestamp) are retained for up to 30 days for security and performance purposes, then deleted.

2.2 Enquiries via WhatsApp or telephone

When you contact us via WhatsApp or telephone, any information you share — your name, contact details, or details of items you are interested in — is held within those platforms under their respective privacy policies and is used only to respond to your enquiry. We do not add you to any mailing list without explicit consent.

2.3 Valuation submissions (“Sell to Us”)

The valuation request form collects your name, contact details, and photographs and descriptions of items you wish to have valued. This information is:

• Stored in a private, access-controlled system not visible to the public.
• Used solely to prepare and communicate a valuation to you.
• Retained for six months after a valuation is provided, then deleted — unless you proceed to a sale, in which case a record is retained for seven years for accounting purposes.
• Never shared with third parties, forwarded, or used for any other purpose.

Valuation data is the highest-sensitivity data we handle. The page carrying this form carries no third-party analytics or marketing tags.

2.4 Want List registrations

If you register a Want List entry (specifying items you are seeking), we collect your name and contact details for the sole purpose of notifying you when matching stock arrives. You may withdraw your entry at any time by contacting us. Entries are deleted when you request removal or after 12 months of inactivity.

2.5 Staff sign-in

The website administration console uses Google OAuth for staff access only. No customer or visitor account is created. Staff sign-in data (email address, session token) is processed by Supabase in accordance with their privacy policy and is not used for any purpose other than authenticating authorised staff.

3. Legal basis for processing

Under the DPDP Act 2023, we process personal data on the basis of:

• Consent — for valuation submissions and Want List registrations, given at the point of submission.
• Legitimate interest — for security logging and responding to direct enquiries.
• Legal obligation — for accounting records where a transaction takes place.

4. Data sharing

We do not sell, rent or trade personal data. We use the following sub-processors, each under appropriate data-processing agreements:

• Supabase Inc. — database and authentication hosting.
• Cloudflare Inc. — image and asset storage.
• Vercel Inc. — website hosting and edge delivery.

These providers may process data outside India. Where they do, we rely on Standard Contractual Clauses or equivalent mechanisms as recognised under the DPDP Act.

5. Your rights

Under the DPDP Act 2023 you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Withdraw consent and request erasure, subject to legal retention requirements.
• Nominate a representative to exercise these rights on your behalf.
• File a complaint with the Data Protection Board of India.

To exercise any of these rights, contact the Grievance Officer listed below.

6. Cookies

The public catalogue uses no cookies. The administration console sets a single session cookie used only for staff authentication; it expires when the browser is closed or after 24 hours.

7. Data retention

8. Security

All data in transit is encrypted via TLS. Access to stored personal data is restricted to authenticated staff and enforced at the database level using row-level security policies. Valuation data is stored in a private bucket with no public URL and is accessible only via short-lived signed links generated on authorised request.

9. Grievance Officer

In accordance with §13 of the DPDP Act 2023, the designated Grievance Officer is:

Grievances will be acknowledged within 48 hours and resolved within 30 days of receipt.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Material changes will be noted on this page for at least 30 days.

Note: This policy was drafted by the website developer as a working basis. The client should have it reviewed by a qualified legal advocate before the site goes live. WebCraft Solutions offers no legal opinion.