Privacy Policy

Last updated: 1 August 2026

1. Who we are

This website, chemistorder.co, and the ChemistOrder brand are owned and operated by Shivam Securities, a sole proprietorship having its principal place of business at 1st Floor, Sisodia Palace, East Boring Canal Road, Patna, Bihar – 800001, India, registered under the Bihar Goods and Services Tax Act, 2017 with GSTIN 10ACXPR3923L1Z5.

In this policy, "we", "us", "our" and "ChemistOrder" mean Shivam Securities. "You" means any individual whose personal data we handle — whether you contact us directly, or whether we contact you on behalf of a business you deal with.

We provide customer contact-centre, tele-calling, business-messaging and back-office support services. We do not sell, stock, dispense, distribute or advertise medicines, drugs, medical devices or any other regulated goods.

2. Our two roles — please read this first

We handle personal data in two quite different capacities, and your rights differ slightly depending on which applies.

• As a Data Fiduciary (controller) — for data about our own website visitors, business enquiries, clients, vendors and staff. We decide why and how this data is used, and this policy governs it in full.
• As a Data Processor — for data about the customers of our client businesses. When a pharmacy chain, grocery retailer or brand engages us to run their helpline or WhatsApp desk, the customer data belongs to that client. We process it only on their documented instruction, only for the purposes they specify, and we do not use it for anything of our own.

3. Personal data we collect

Data you give us directly

• Name, business name, designation, phone number and email address, when you enquire about our services
• The content of your enquiry, email or message to us
• Billing details, GSTIN, bank and payment references, if you become a client
• Applicant details, if you apply for a job with us

Data we handle on behalf of client businesses

• Customer name, phone number, and where relevant email address and delivery address
• Order, booking, delivery and payment reference information supplied by the client
• The content and outcome of calls and messages — including call recordings, chat transcripts, complaint details and disposition codes
• Consent and opt-out records — including when, where and how consent was given or withdrawn

Data collected automatically by this website

• Standard web-server logs: IP address, browser type, pages requested, date and time, referring page. These are used for security and to keep the site running, and are not used to profile you.

We do not knowingly collect financial account credentials, biometric data, or any special category of sensitive personal data. We do not collect, request or store prescriptions, diagnoses, medical records or any other health information, and our agents are instructed not to record such information if a customer volunteers it.

4. Why we use personal data

• To respond to your enquiry and provide the services you or our client has asked for
• To make and receive calls and messages relating to an order, booking, delivery, payment or complaint
• To send transactional and service notifications on behalf of a client business, to recipients who have opted in
• To record, investigate and resolve complaints
• For quality monitoring, agent training and service-level measurement
• To raise invoices, maintain accounting records and comply with tax law
• To comply with legal obligations and to establish, exercise or defend legal claims
• To keep our systems and this website secure

We do not sell, rent, trade or licence personal data to anyone. We do not use the customer data of one client for the benefit of another client, or for our own marketing.

5. Consent and opt-out

Where we send commercial or service messages, we do so only on the basis of a recorded opt-in obtained by the client business or by us on their behalf. We keep a record of when, where and how that consent was given.

You may withdraw consent at any time — free of charge and without giving a reason — by:

• Replying STOP to any WhatsApp or SMS message from us;
• Telling the agent during a call that you do not wish to be contacted again;
• Emailing grievance@chemistorder.co with the phone number or email address concerned.

Opt-outs are actioned immediately and the contact is suppressed permanently across the campaigns we run for that client. Withdrawing consent does not affect the lawfulness of anything done before it, and we may still contact you where strictly necessary to complete a transaction you have already entered into, or where law requires it.

6. Who we share personal data with

We share personal data only in these circumstances:

• With the client business whose customers we are supporting — this is the purpose of the engagement.
• With communication platforms we use to deliver the service — including Meta Platforms, Inc. and its affiliates for the WhatsApp Business Platform, telecom operators and licensed telemarketing/SMS providers, and our cloud hosting and email providers. These parties process data under their own terms and only to the extent needed to deliver the message or call.
• With professional advisers — our accountants and lawyers, under a duty of confidence.
• Where the law requires it — to a court, regulator, or law-enforcement authority acting under lawful authority.
• On a business transfer — if the business is sold or reorganised, subject to the buyer honouring this policy.

Every staff member and sub-contractor with access to personal data is bound by a written confidentiality undertaking.

7. WhatsApp, SMS and telephone calls

Where we operate a WhatsApp Business account for a client, that account belongs to the client business and every message identifies them as the sender. Messages are sent through the official WhatsApp Business Platform using templates approved by WhatsApp, and are governed by Meta's WhatsApp Business Messaging Policy and the WhatsApp Commerce Policy, in addition to this policy. WhatsApp's own handling of your data is governed by its privacy policy, not ours.

Outbound calling is carried out within permitted hours and in accordance with the TRAI Telecom Commercial Communications Customer Preference Regulations (DND). Calls may be recorded for quality and dispute-resolution purposes; where a call is recorded, you will be told at the start of the call.

We do not use WhatsApp, SMS or calls to promote, offer or facilitate the sale of medicines, drugs, medical devices or any other restricted or prohibited goods.

Our full messaging rules are set out separately in our WhatsApp Business Messaging Policy.

8. How we protect personal data

• Role-based access — agents see only the records needed for the account they work on
• Client data is logically segregated between accounts
• Encrypted transport (HTTPS/TLS) for this website and our systems
• Controlled workstations in a supervised operations floor; personal storage devices and personal messaging apps are not permitted at agent positions
• Written confidentiality undertakings from every employee and contractor
• Access reviewed and revoked promptly when a person leaves or changes role

No system is perfectly secure. If a personal data breach occurs that is likely to affect you, we will notify the affected individuals and the relevant authority as required by law, and we will inform the client business concerned without undue delay.

9. How long we keep personal data

• Enquiry and correspondence data — up to 3 years from last contact.
• Client customer data processed on instruction — for the duration of the engagement, and then returned to the client or securely deleted within 90 days of termination, unless the client instructs otherwise in writing or law requires longer.
• Call recordings and chat transcripts — normally 90 days, or the period agreed with the client, unless retained longer for an unresolved complaint or legal claim.
• Opt-out / suppression records — kept indefinitely. We must retain these so that we do not contact you again.
• Invoices, tax and accounting records — 8 years, as required under Indian tax law.

10. Your rights

Subject to the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you have the right to:

• Ask what personal data of yours we hold and how it is processed
• Have inaccurate or incomplete data corrected or updated
• Have your data erased, where we are not required to keep it
• Withdraw consent to being contacted, at any time
• Nominate another person to exercise these rights in the event of your death or incapacity
• Complain to our Grievance Officer, and thereafter to the Data Protection Board of India

To exercise any of these, email grievance@chemistorder.co from the email address or with the phone number concerned. We may ask for reasonable proof of identity before acting. We acknowledge requests within 48 hours and respond within 30 days.

11. Children

Our services are directed at businesses and adult customers. We do not knowingly collect personal data of children under 18. If we learn that we hold such data without verifiable parental consent, we will delete it.

12. Cookies and this website

This website does not set advertising or tracking cookies and does not run any analytics or advertising pixels. Our web server keeps standard access logs for security and troubleshooting. Web fonts are loaded from Google Fonts and the office map on our contact page is embedded from Google Maps; when those load, your browser contacts Google's servers and Google may log your IP address under its own privacy policy.

13. Where data is stored

Our systems and website are hosted on servers located in India (Asia Pacific — Mumbai region). Some of the communication platforms we use to deliver messages — including the WhatsApp Business Platform — may process data outside India under their own terms. We do not transfer personal data to any country restricted by the Government of India for such transfers.

14. Changes to this policy

We may update this policy from time to time. The current version is always published at chemistorder.co/privacy.html with the date of last update at the top. Material changes affecting client engagements will also be notified in writing to the client.

15. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023, the following officer may be contacted about anything in this policy, any complaint about how your data has been handled, or any request to stop contacting you: