Privacy Policy

Last updated 7 September 2026

This policy explains what personal data Goldman collects, why we hold it, how long we keep it, who we share it with, and how you can ask us to correct or delete it. It applies to this website and to the E‑Warranty system that issues and verifies warranty certificates.

We are a data fiduciary under India's Digital Personal Data Protection Act 2023 in respect of the data described below.

Who we are

Goldman Protection. You can reach us about anything in this policy at contact@goldmanprotection.com or on +919662994309.

What we collect

When a warranty is registered

A Goldman warranty is registered by the installer who fits the film, at the time of installation, using details you give them. We record:

• About you — your name, mobile number, and where supplied your email address, postal address, city and state.
• About your vehicle — make, model, variant, year of manufacture, colour, registration number, and where supplied the VIN or chassis number.
• About the installation — the film fitted, the area covered, the roll batch number, and the installation and expiry dates.
• About the transaction — the invoice number, invoice amount and payment method recorded by the installer.
• A record of your consent to the above being held.

The roll batch number matters to you as well as to us: without it a manufacturing fault cannot be traced back to the affected rolls, and a recall becomes impossible.

When you contact us or apply to become a dealer

• Your name, email address, and where supplied your phone number, city and state.
• The subject and content of your message.
• For dealer applications, your business name, the brands you currently carry, and your indicative monthly volume.
• The page you sent the enquiry from, and your IP address.

Automatically, when you use this site

• IP address and timestamp, recorded when you use the warranty verification form or when someone attempts to sign in to the administration area. This is used only to rate‑limit those two forms. Warranty numbers are issued in sequence, so without a limit anyone could work through the number space and harvest customers' names, mobiles and registrations.
• A session cookie, described below.
• Standard web server logs kept by our hosting provider.

Administrator activity

Actions taken inside the administration area — issuing, editing, cancelling or deleting a warranty — are logged with the administrator's username, IP address, browser identifier and a before-and-after record of what changed. This is an accountability record, and it is written before a record is deleted so that the deletion itself remains auditable.

Cookies, and what we do not do

This site sets one cookie: a session cookie, used to keep you signed in to the administration area and to protect forms against cross‑site request forgery. It is strictly necessary for the site to function, holds no personal data itself, and expires when your session ends.

We do not use analytics, advertising or social media tracking of any kind. There are no third‑party scripts on this website, no advertising identifiers, no profiling and no automated decision‑making. We do not sell personal data, and we do not share it for anyone else's marketing.

Why we hold it, and on what basis

• To issue and honour your warranty — to produce your certificate, deliver it to you, verify it when you or an installer checks it, and assess a claim. This is necessary to perform the warranty we have given you.
• To reach you about your warranty — for example if a batch is recalled.
• To answer your enquiry, where you have sent us one.
• To keep the system secure — the rate limiting and administrator logging described above.
• To meet our legal and accounting obligations.

Where we rely on your consent, you gave it when the warranty was registered, and you can withdraw it at any time using the contact details above. Withdrawing consent does not make our earlier use of the data unlawful, and we may still need to keep the record to administer a warranty that is still running.

Who we share it with

• Your certificate is emailed to you, where you have given an email address, through our email provider.
• Your installer may send your certificate link over WhatsApp, from their own device and their own WhatsApp account, if you ask them to.
• Our hosting provider stores the site and its database on our behalf.
• Professional advisers, or a public authority, where we are legally required to disclose.

We do not otherwise disclose your data to anyone, and we do not transfer it outside India except insofar as our hosting or email provider does so in the course of delivering the service.

Public verification, and what it reveals

Anyone can check a warranty at /verify, but only by entering the warranty number and the mobile number it was registered against — both must match the same record. The result is deliberately masked: the customer name, mobile and registration number are shown only in part, enough to confirm the certificate is genuine without exposing the customer's details to a stranger.

The certificate PDF itself is reachable only through a 48‑character token, which appears in the QR code on your certificate and in the link we send you. It cannot be guessed and it is not indexed by search engines. Treat that link as private.

How long we keep it

• Warranty records — for as long as the warranty runs, and afterwards, because a certificate must stay verifiable and a past warranty may still be relevant to a claim, a dispute or a recall. We delete a record earlier on request, unless we are required to keep it. We will review and reduce this period, and will update this policy when we do.
• Enquiries — until the enquiry is dealt with and for a reasonable period afterwards.
• Verification rate‑limit records — 7 days.
• Administrator sign‑in attempts — 90 days.
• Administrator activity logs — retained as an accountability record.
• Backups — 30 days, after which they are overwritten.

Your rights

Under the Digital Personal Data Protection Act 2023 you may:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct anything that is wrong or incomplete — a misspelt name or a wrong registration number on a certificate, for instance.
• Ask us to erase your data, where we no longer need it for the purpose it was collected for and no law requires us to keep it.
• Withdraw your consent.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and then to the Data Protection Board of India if we do not resolve it.

Write to contact@goldmanprotection.com and tell us what you want done. We may need to confirm your identity first — usually by checking the mobile number the warranty was registered against. We will respond as soon as we reasonably can.

Please note that erasing a warranty record deletes the certificate with it, and the warranty can no longer be verified. We will say so before we act on such a request.

Keeping it safe

Administrator passwords are stored hashed, never in readable form. Access to the administration area is limited to authorised staff, protected against repeated sign‑in attempts, and every action taken there is logged. Certificate PDFs are served only through a checked path, so a link cannot be manipulated to reach another file on the server. No system is perfectly secure, but if a breach affects your data we will notify you and the Data Protection Board as the Act requires.

Children

This site is not directed at children, and a warranty is registered against a motor vehicle by its owner. We do not knowingly collect data about anyone under 18. If you believe we have, tell us and we will delete it.

Changes to this policy

If we change how we handle personal data we will update this page and change the date below. Where a change is significant and we hold your email address, we will tell you directly.