Privacy Policy & Digital Data Protection Framework

1. Legislative Scope & Legal Foundation

This Privacy Policy governs the collection, storage, processing, transfer, and deletion of personal data collected through the Kumaun Solar web portal (accessible at https://solar.kumaun.in and https://kumaun.in), physical site inspection forms, telephonic advisory consultations, and engineering communications.

Our data handling protocols are drafted in strict conformity with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (as amended), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and relevant renewable energy consumer guidelines promulgated by the Uttarakhand Electricity Regulatory Commission (UERC) and Uttarakhand Power Corporation Limited (UPCL).

2. Categories of Information We Collect

To deliver accurate solar engineering designs, accurate shadow loss assessments, and seamless government subsidy filings, Kumaun Solar collects the following distinct classes of data:

• Personal Identifiers: Full legal name, residential or commercial billing address, contact phone numbers, and official email addresses provided during solar inquiries, quote requests, or calculator consultations.
• Property & Structural Engineering Data: Rooftop area (square feet or square metres), roof type (RCC flat slab, sloped tin/sheet roof, tiled mountain structure, ground mount area), building height, geographic coordinates (latitude and longitude) for solar irradiance modeling, and photographic surveys of shadows or obstacles (water tanks, parapet walls, trees).
• Utility & Grid Connection Records: Uttarakhand Power Corporation Limited (UPCL) Service Connection Number / Consumer Account Number, sanctioned load in kilowatts (kW), phase configuration (Single-Phase 230V or Three-Phase 415V), distribution transformer rating, tariff category (Domestic RTS-1, Non-Domestic Commercial RTS-2, LT Industrial, Agriculture), and past 12-month electricity consumption history in kilowatt-hours (kWh/units).
• Government Subsidy Documentation (PM Surya Ghar / PM-KUSUM): Aadhaar number linkage status, electricity bill copy, property ownership proof, and canceled cheque / bank account details (Account Number, Bank Name, Branch, and IFSC Code) required solely for direct credit of the Central Government DBT subsidy into the consumer's verified bank account through the National Solar Portal.
• Technical Website Interaction Logs: Internet Protocol (IP) address, browser client architecture, operating system, referring URL, time spent per technology guide, and cookie identifiers used exclusively for server diagnostics and platform security monitoring.

3. Purpose Specification & Lawful Processing Grounds

Under Section 4 and Section 6 of the DPDP Act 2023, Kumaun Solar processes personal data exclusively on the basis of informed user consent and legitimate engineering use cases:

• Technical Feasibility Modeling: Calculating solar generation yield, selecting appropriate module wattage (e.g. 545W Mono PERC vs 580W TOPCon), matching string inverter MPPT voltage thresholds, and simulating winter sub-zero clipping losses in Himalayan districts.
• Statutory Net-Metering Documentation: Preparing standard UPCL Form-A applications, grid feasibility sanctions, test reports by certified 'A-Class' electrical contractors, and CEIG (Chief Electrical Inspector to Government) clearance dossiers for solar capacities exceeding 10 kW.
• Subsidy Application Processing: Assisting property owners with registration on the National Solar Portal (pmsuryaghar.gov.in), upload of joint commissioning reports (JCR), and DISCOM meter installation tracking.
• Turnkey EPC Execution & Warranty Administration: Registering serial numbers of Tier-1 solar panels and grid-tie inverters with original equipment manufacturers (OEMs) such as Tata Power Solar, Waaree, Adani Solar, and Vikram Solar to activate 10-to-12-year product warranties and 25-to-30-year linear performance warranties.
• Customer Support & Preventative Maintenance: Scheduling annual preventive maintenance (cleaning schedule reminders, thermal imaging scans, inverter firmware updates) and answering localized consumer queries across Kumaun and Garhwal divisions.

4. Information Disclosure & Third-Party Transfers

Kumaun Solar does not engage in data commercialization. We do not sell, rent, license, or exchange our customer database with external marketing aggregators, digital advertisers, or telemarketing agencies. Personal data is disclosed solely under the following defined circumstances:

• Regulated Electricity Distribution Entities: Submission of consumer account data, load test certificates, and equipment datasheets to Uttarakhand Power Corporation Limited (UPCL) division offices and sub-stations for bidirectional net-meter sanctioning.
• Government Regulatory & Subsidy Portals: Secure transmission of rooftop coordinates, solar capacity figures, and bank account proofs to the Ministry of New and Renewable Energy (MNRE), UREDA (Uttarakhand Renewable Energy Development Agency), and the National Solar Portal for DBT release.
• OEM Manufacturer Warranty Registration: Submission of inverter serial numbers and module barcode strings to authorized manufacturers for warranty certificate generation and cloud telematics access.
• Legal & Law Enforcement Mandates: Where disclosure is strictly compelled by a valid court order, statutory subpoena, or authorized directive issued by an Indian judicial authority with competent territorial jurisdiction.

5. Data Security Architecture & Storage Integrity

We enforce administrative, technical, and physical safeguards designed to protect personal and engineering information against accidental loss, unauthorized access, destruction, alteration, or unlawful compromise:

• Transport Layer Security: All client-server transmissions are encrypted using modern TLS 1.3 cryptographic suites with 256-bit asymmetric cipher keys.
• Database Access Controls: Database servers are secured behind enterprise firewalls with strict role-based access limits (RBAC). Administrative access requires multi-factor authentication (MFA) and is logged into immutable audit trails.
• Indian Sovereign Hosting: All website assets, database tables, and consumer records are hosted in tier-3/tier-4 data centers located physically within the sovereign territory of the Republic of India.
• Sanitized Telecommunications: In compliance with brand safety rules, consumer WhatsApp interactions are managed through official encrypted WhatsApp Business APIs, and private phone numbers are never embedded as raw plaintext across public HTML pages.

6. Consumer Rights Under DPDP Act 2023 (Data Principal Rights)

As a Data Principal under Indian law, you possess explicit statutory entitlements regarding your personal records held by Kumaun Solar:

• Right to Confirmation & Access: You may request a plain-language summary of your personal information held in our records, including processing activities and identities of any authorized third parties with whom data was shared.
• Right to Correction & Updating: You may correct inaccurate or obsolete personal data, update changed phone numbers, or revise property survey details at any time.
• Right to Erasure (Right to be Forgotten): You may request complete deletion of your personal records once your solar project installation, net-metering commissioning, and subsidy disbursement are successfully completed, subject only to statutory tax retention laws.
• Right of Grievance Redressal: You are entitled to prompt resolution of any complaints regarding data misuse or unfulfilled privacy requests by writing to our designated Data Protection Officer.
• Right to Nominate: You may nominate an authorized legal representative to exercise your data rights in the event of death or incapacity.

7. Data Retention & Disposal Schedules

Personal information collected for general quote inquiries that do not culminate in an active engineering contract is systematically purged after twenty-four (24) months. Records pertaining to completed solar installations—specifically warranty certificates, electrical single-line diagrams (SLD), structural design certifications, and net-metering agreements—are archived for the duration of the equipment warranty period (up to 25 years) to ensure ongoing technical assistance, spare parts availability, and warranty claims support.

8. Frequently Asked Questions Regarding Data Privacy