Privacy Policy
Sumitomo Electric Hardmetal India Private Limited ("Sumitomo Electric Hardmetal India", "we", "us" or "our") operates the business-to-business online store at sumitomo-tools.com (the "Platform"). This Privacy Policy explains what personal data we collect through the Platform, why we collect it, who we share it with, how long we keep it, and the rights available to you.
We handle personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it as and when they come into force, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Effective date: 30 September 2026
1. Who we are
We are the Data Fiduciary for the personal data described in this policy. That means we decide why and how your personal data is processed.
| Legal entity | Sumitomo Electric Hardmetal India Private Limited |
| Registered office | B-Wing, Arihant Aura, Unit Nos. 1301 to 1303, Thane-Belapur Road, TTC Industrial Area, Turbhe MIDC, Turbhe, Navi Mumbai, Maharashtra 400703, India |
| CIN | U36999MH2022FTC386849 |
| ECsupport@shin.sei.co.jp |
2. Who this policy applies to
The Platform is a business-to-business store. Accounts are opened by companies, partnerships, limited liability partnerships and sole proprietors registered in India, and are used by the individual employees or representatives those businesses nominate.
This policy covers the personal data of those individuals — the person who registers, the people who place orders, and the people we correspond with. Information about a business itself, such as its GSTIN or its registered address, is company information rather than personal data, but where it is linked to a named individual we protect it under this policy in the same way.
If you register on behalf of a business, you confirm that you are authorized to do so and that you have told any colleague whose details you enter that their details have been given to us.
3. What personal data we collect
3.1 Data you give us
- Registration details: first and last name, company name, work email address, mobile telephone number, GSTIN, industry, and the company address used for invoicing and delivery.
- Account credentials: a password, which we never store in readable form (see section 10), and the one-time codes we send you by email.
- Additional addresses: any further delivery addresses you save in your address book.
- Order details: the products and quantities you order, your purchase order number where you supply one, delivery address, and order notes.
- Enquiries: the content of any quotation request, contact form, dealer enquiry or email you send us, including the product you were viewing when you sent it.
3.2 Data we generate or receive
- Transaction records: order numbers, tax invoices, invoice numbers, courier names and consignment tracking numbers. Invoice and shipping details are generated in our enterprise resource planning system and shown back to you in your account.
- Payment data: confirmation from the payment gateway that a payment succeeded or failed, together with a transaction reference. We do not collect or store your card number, CVV, UPI PIN, or net-banking credentials — these are entered on the payment provider's own secure page and never reach our systems.
- Technical data: IP address, browser and device type, operating system, referring page, the pages you view, and the date and time of your visit.
- Session data: a record that your browser is signed in, so that you are not asked to sign in again on every page.
3.3 Data we do not want
Please do not send us more personal data than an enquiry needs. We do not ask for, and ask you not to supply, information about health, religion, caste, sexual orientation, political affiliation, or biometric data. If you send such information to us anyway we will delete it.
4. Why we use your personal data
| Purpose | What this covers |
|---|---|
| Opening and running your account | Verifying your business, creating your account, signing you in, sending one-time codes, resetting your password, and keeping your profile and address book current |
| Showing you prices and stock | Prices, stock status and delivery estimates are only shown to signed-in registered buyers, so we need to know who you are before we display them |
| Fulfilling your orders | Accepting and processing orders, checking minimum order quantities and pack sizes, arranging dispatch and delivery, and handling returns, replacements and warranty claims |
| Statutory compliance | Issuing GST-compliant tax invoices and electronic invoices, keeping books of account, and meeting our obligations under tax, company and commercial law |
| Support and communication | Answering your questions, responding to quotation requests, and sending you service messages about your orders and your account |
| Security and prevention of misuse | Detecting and blocking automated sign-in attempts, fraud, scraping of our catalogue and pricing, and unauthorized access |
| Improving the Platform | Understanding which pages and products are used, and where the Platform is difficult to use |
| Marketing, only with your consent | Sending product news and offers, where you have separately agreed to receive them |
Under the DPDP Act we process your personal data on the basis of the consent you give when you register and when you place an order, and, where the Act permits, for the legitimate uses it recognizes, including complying with a legal obligation and performing the contract between us.
5. Consent, and how to withdraw it
You give consent when you tick the confirmation at registration, having been shown the notice required by the DPDP Act. You may withdraw that consent at any time by writing to ECsupport@shin.sei.co.jp.
Withdrawing consent is as easy as giving it, and it does not make anything we did beforehand unlawful. Please note what it means in practice: the Platform cannot operate an account without the registration data, so withdrawing consent for that data means closing your account and losing access to prices, stock and ordering. We will still keep the records that tax and company law require us to keep, as set out in section 8.
Withdrawing consent for marketing messages has no effect on your account. You can do that separately, at any time, using the unsubscribe link in any marketing email or by writing to us.
6. Who we share personal data with
We do not sell or rent personal data, and we do not share it for anyone else's marketing.
We share it with the following categories of recipient, each of which processes it only on our instructions and under contractual confidentiality and security obligations:
- Shopify Inc., which provides the e-commerce platform the store runs on.
- Cloud hosting and infrastructure providers. Our application servers and database are hosted in India, in the Asia Pacific (Mumbai) region.
- Transactional email providers, which deliver your one-time codes, password-reset messages and order notifications.
- The payment gateway, which processes your payment and confirms the result to us.
- Logistics and courier partners, which receive the delivery address and contact details needed to deliver your consignment.
- Analytics providers, which help us understand how the Platform is used.
- Our authorized distributors in India, where an enquiry or order needs to be handled through a distributor, and only to the extent needed.
We also share personal data:
- with Sumitomo Electric Industries, Ltd., Japan and other companies in the Sumitomo Electric group, for internal reporting, group compliance and product support;
- with professional advisers such as auditors and lawyers, under a duty of confidentiality;
- with courts, regulators, tax authorities and law-enforcement agencies, where we are required to do so by law or where it is necessary to establish, exercise or defend a legal claim.
7. Transfers outside India
Your personal data is stored in India. Some of the recipients listed in section 6 operate outside India, so a transfer outside India can take place — in particular to Sumitomo Electric Industries, Ltd., Japan, and to platform and infrastructure providers with operations abroad.
We make those transfers in accordance with section 16 of the DPDP Act, which permits transfer other than to a country restricted by the Central Government, and under contractual terms requiring the recipient to protect the data to the standard set out in this policy.
8. How long we keep personal data
| Category | Retention period |
|---|---|
| Books of account, invoices and supporting transaction records | At least eight financial years, as required by section 128 of the Companies Act, 2013 |
| GST records and returns | Seventy-two months from the due date of the annual return for the relevant year, as required by section 36 of the Central Goods and Services Tax Act, 2017 |
| Account and profile data | For as long as the account is active, and for two years after it is closed |
| One-time codes | Ten minutes, after which they expire and are discarded |
| Sign-in sessions | Twelve hours of inactivity, after which the session ends |
| Enquiries and support correspondence | Three years from the date the matter is closed |
| Server and security logs | Twelve months |
When a retention period ends we delete the personal data or anonymize it so that it can no longer be linked to you.
9. Cookies and similar technologies
The Platform uses a small number of cookies:
-
Essential cookies. A session cookie records that you are signed in. It is set with the
HttpOnlyandSecureattributes, so it cannot be read by scripts and is only ever sent over an encrypted connection. Without it you cannot stay signed in, see prices, or use the cart. - Cart and preference cookies, set by the e-commerce platform to keep your cart and your display preferences between pages.
- Analytics cookies, which count visits and tell us which pages and products are used. These are only set where you have agreed to them.
You can block or delete cookies in your browser settings. Blocking essential cookies will stop the Platform working: you will not be able to sign in, see prices, or place an order.
10. How we protect your personal data
We apply technical and organizational safeguards that are proportionate to the risk, including:
- all traffic between your browser and our systems encrypted in transit using TLS;
- passwords stored only as a salted one-way hash, never in readable form, so that nobody — including our own staff — can read your password;
- a one-time code sent to your registered email address on every sign-in, in addition to your password;
- sign-in sessions held server-side so that they can be revoked immediately, and revoked automatically across all your devices whenever your password changes;
- rate limiting and automated blocking of repeated failed sign-in attempts;
- access to personal data restricted to staff who need it for the purposes in section 4;
- prices, stock and the distributor directory served only to signed-in buyers rather than embedded in the public page.
No system can be guaranteed completely secure. If a personal data breach occurs we will report it to the Data Protection Board of India and notify each affected person, in the form and within the time the DPDP Act requires.
11. Your rights
As a Data Principal under the DPDP Act you may:
- Ask what we hold. Obtain a summary of the personal data we process about you, and of the processing activities we carry out.
- Ask who we shared it with. Obtain the identities of the Data Fiduciaries and Data Processors with whom your personal data has been shared, and a description of what was shared.
- Correct it. Have inaccurate or misleading data corrected, incomplete data completed, and out-of-date data updated. You can correct your own name, telephone number and addresses at any time in the Settings and Addresses areas of your account.
- Erase it. Have your personal data erased where we no longer need it for the purpose it was collected for and no law requires us to keep it.
- Nominate someone. Nominate another individual to exercise these rights on your behalf if you die or become incapable of exercising them.
- Complain. Raise a complaint about our handling of your personal data, as described in section 13.
Company name, GSTIN and industry are shown in your account as read-only, because they are master data shared with our enterprise system and used on your tax invoices. To change them, contact us and we will update both systems together.
To exercise any of these rights, write to ECsupport@shin.sei.co.jp from your registered email address. We will respond within the period prescribed under the DPDP Act, and in any event without undue delay.
Your duties. The DPDP Act also places duties on you. Please do not register using someone else's identity, do not supply false particulars — including a GSTIN that is not yours — and do not make a frivolous or false complaint. The Act provides for penalties for breaches of these duties.
12. Children
The Platform is intended for use by business buyers and is not directed at children. We do not knowingly process the personal data of anyone under the age of eighteen. If you believe a child has registered, tell us and we will delete the account and the associated data.
13. Complaints
If you are unhappy with how we have handled your personal data, write to ECsupport@shin.sei.co.jp. We will acknowledge your complaint and respond to it.
If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India in the manner provided under the DPDP Act.
14. Changes to this policy
We may update this policy as our services or the law change. The current version is always published on this page with its effective date. Where a change materially affects how we use your personal data, we will tell you by email or by a notice on the Platform before it takes effect.
15. Contact us
| Contact | ECsupport@shin.sei.co.jp |
| Post | Sumitomo Electric Hardmetal India Private Limited, B-Wing, Arihant Aura, Unit Nos. 1301 to 1303, Thane-Belapur Road, TTC Industrial Area, Turbhe MIDC, Turbhe, Navi Mumbai, Maharashtra 400703, India |