PUBLIC | Version 2.1 | 28 October 2026
1. Purpose, scope and who we are
This Privacy Policy explains how Anchanto Services Pvt. Ltd. (India) and Anchanto Pte. Ltd. (Singapore), collectively “Anchanto”, “we”, “us” or “our”, collect, use, disclose, transfer, retain and protect personal data when individuals use our websites or interact with our software platforms.
1.1 Services covered
| Service | Coverage | Individuals covered |
| Website | anchanto.com, regional sites and subdomains, forms, events, newsletters and marketing communications | Visitors, prospects, subscribers, event participants and job applicants |
| Applications | Warehouse Management System (WMS), Order Management System (OMS), Operations Experience Management (OXM), Control Tower (CT), Parcel Tracking (PT) | Authorised customer users and individuals whose data customers process through the applications |
For customer-controlled personal data processed through our applications, this Policy supplements the applicable Master Service Agreement and Data Processing Agreement (“DPA”). If there is a conflict concerning customer-controlled personal data, the DPA will prevail.
1.2 Exclusions
- Third-party websites, marketplaces, storefronts or services linked to or integrated with our services. Their own privacy notices apply.
- Personal data of Anchanto employees and contractors, which is addressed through internal notices and policies.
- Detailed cookie inventories, which are provided in the applicable Cookie Policy or consent manager.
1.3 Responsible Anchanto entity
The Anchanto entity responsible for personal data depends on the service, the individual’s location and the relationship with Anchanto. For website data and data used for Anchanto’s own account administration, security, support and business operations, the relevant Anchanto entity acts as controller or data fiduciary. For customer-controlled operational data processed in the applications, the customer generally determines the purposes and essential means of processing and Anchanto generally acts as processor or data processor.
1.4 Representatives in the European Union and the United Kingdom
Anchanto Services Pvt. Ltd. and Anchanto Pte. Ltd. are not established in the European Union or the United Kingdom. In accordance with Article 27 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Article 27 of the UK GDPR, Anchanto has appointed the following representatives.
EU Representative:
Ametros Ltd Coliemore House, Coliemore Road, Dalkey, Dublin, Ireland
Email: gdpr@ametrosgroup.com
Website: www.ametrosgroup.com
UK Representative
Ametros Group Ltd Broadway House, 32–35 Broadstreet, Hereford, England
Email: gdpr@ametrosgroup.com
Website: www.ametrosgroup.com
Individuals in the European Economic Area or the United Kingdom, and the competent supervisory authorities, may contact the relevant representative, in addition to or instead of Anchanto, on any matter relating to the processing of personal data for which Anchanto is a controller, including requests to exercise the rights described in Section 11. The representative will forward requests to Anchanto and support communication with the relevant authorities.
The representatives act only for processing for which Anchanto is controller. Where Anchanto processes personal data as a processor on behalf of a customer, individuals should contact that customer, as explained in Section 11.3.
2. Our privacy roles
| Data category | Anchanto role | Explanation |
| Website enquiries, marketing preferences, recruitment submissions | Controller / Data Fiduciary | Anchanto decides why and how this data is used. |
| Application account, access, authentication and security data | Controller / Data Fiduciary, subject to the relevant arrangement | Used to administer accounts, protect services and meet Anchanto obligations. |
| Application usage, diagnostic and service telemetry | Controller / Data Fiduciary where used for Anchanto’s service operations; otherwise processor | Role depends on the purpose, configuration and customer agreement. |
| Support interactions | Controller for Anchanto support administration; processor for customer-controlled data included in a case | Roles may differ within the same interaction. |
| Orders, inventory, consignee, shipping, returns and marketplace-synchronised data | Processor / Data Processor | Processed on the customer’s documented instructions and under the DPA. |
Our legal role is determined by the actual processing activity and applicable law, not only by labels in this Policy. Customers are responsible for their own notices, lawful basis and instructions for personal data they submit to or process through the applications.
3. Personal data we collect
We seek to collect personal data that is relevant and reasonably necessary for the purposes described in this Policy. We receive data directly from individuals, automatically through use of our services, and from customers, connected marketplaces, storefronts, service providers and authorised business partners.
3.1 Website and business interactions
- Identity and contact information, such as name, business email, phone number, company, job title and country.
- Interaction information, such as enquiries, demo requests, event registrations, support questions, preferences and communication history.
- Recruitment information, such as CV, qualifications, work history and information voluntarily submitted for a role.
- Technical and usage information, such as IP address, browser, device, operating system, approximate location derived from IP, pages viewed, referring pages, timestamps and interactions with emails or website content.
3.2 Applications
When our customers and authorized users’ access or use Anchanto’s WMS, OMS, OXM, CT, PT or associated web and mobile applications, we may process the following categories of information:
- User account and profile information: Name, business email address, employee or user ID, assigned role, site or location assignment, permissions, and other account-related information.
- Authentication and access information: Username, hashed password, multi-factor authentication details, session tokens, login history, access logs, and security-related records.
- Operational and activity information: User activities performed within the platforms, including pick, pack, putaway, scan, inventory, order-processing, fulfilment, return, refund, and other operational events. This information may be associated with a particular user account for operational tracking, security, compliance, and audit purposes.
- Order and delivery information: Customer or end-customer name, delivery and billing address, phone number, email address, order details, delivery status, payment reference number, return and refund records, and customer-service notes. Anchanto does not store full payment-card numbers or sensitive authentication data within these application platforms.
- Marketplace and storefront information: Information synchronised from marketplaces, storefronts, carriers, or other systems connected by the customer, including buyer information, order data, messages, reviews, marketplace identifiers, and integration-related information.
- Integration and configuration information: Marketplace or storefront connection details, API credentials, access tokens, integration identifiers, and other configuration information required to connect and operate customer-authorised third-party services. Such credentials are protected and used only for the authorised integration and related service purposes.
- Support and communication information: Information included in support tickets, email communications, chat transcripts, issue descriptions, screenshots, diagnostic attachments, and call recordings where recording is lawfully enabled and appropriately notified.
- Usage, device, and telemetry information: Feature usage, in-application events, device and browser information, IP address, error logs, diagnostic records, performance information, session activity, and other technical information processed as necessary to provide, operate, maintain, secure, monitor, and troubleshoot the platforms and related services.
- Customer-controlled operational data is processed by Anchanto on behalf of the relevant customer and in accordance with the customer’s documented instructions, applicable agreement, and Data Processing Agreement.
3.3 Sensitive data and production data use
We do not ask individuals to submit sensitive or special-category personal data through general website forms. Customers must avoid placing such data in free-text fields unless necessary, lawful and permitted by the relevant agreement. For development and testing, Anchanto seeks to use synthetic, masked or otherwise de-identified data instead of identifiable production data, where reasonably practicable.
4. Why we process personal data
| Purpose | Service | GDPR / UK GDPR basis |
| Respond to enquiries, demonstrations and requests | Website | Steps before entering a contract and legitimate interests |
| Provide newsletters, product updates and permitted marketing | Website | Consent, or legitimate interests where law permits |
| Operate consent-based analytics and targeted advertising | Website | Consent |
| Process job applications | Website | Steps before entering a contract, legal obligations and legitimate interests |
| Create accounts and provide, administer and support services | Applications | Contract and legitimate interests |
| Secure services, detect misuse, investigate incidents and prevent fraud | Website and Applications | Legitimate interests and legal obligations |
| Monitor reliability, troubleshoot and improve usability and performance | Website and Applications | Legitimate interests; consent where required for non-essential tracking |
| Comply with legal, regulatory, audit and contractual duties | Website and Applications | Legal obligations and contract |
| Process customer operational data | Applications | Basis determined by the customer; Anchanto acts under the DPA and documented instructions |
4.1 Singapore
Where Singapore’s Personal Data Protection Act 2012 applies, Anchanto collects, uses and discloses personal data with consent, deemed consent or another permitted basis, and for purposes that a reasonable person would consider appropriate in the circumstances. Individuals may withdraw consent with reasonable notice, subject to legal and contractual consequences.
4.2 India
Where India’s Digital Personal Data Protection Act, 2023 and applicable rules apply, Anchanto processes digital personal data on consent or another lawful legitimate use available under the law. Notices and consent requests will describe the personal data and specified purpose in clear language. Consent may be withdrawn through the method described at collection or by contacting us, subject to legal and contractual consequences.
Until the relevant substantive provisions of the DPDP Act become effective, Anchanto will continue to process applicable personal information in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), where applicable.
4.3 Automated decision-making
Anchanto does not make decisions about website visitors or application users that produce legal or similarly significant effects based solely on automated processing. If this practice changes, we will provide any notice and safeguards required by applicable law.
4.4 Other jurisdictions
Anchanto provides services to customers and interacts with individuals across multiple jurisdictions, including the Asia-Pacific region, the Middle East, and Europe.
Where another national, regional, or local data protection law applies to Anchanto’s processing, Anchanto will process personal data in accordance with that law and this Privacy Policy.
If applicable local law provides individuals with additional rights, imposes additional obligations, or offers a higher level of protection than this Policy, the applicable local law will prevail to the extent of the inconsistency.
The availability of particular rights, legal bases, and complaint mechanisms may therefore vary depending on:
- the individual’s location;
- the Anchanto entity responsible for the processing;
- the nature of the relationship with Anchanto;
- whether Anchanto acts as controller, Data Fiduciary, processor, or Data Processor; and
- the specific data protection law applicable to the processing.
5. Cookies and similar technologies
We use cookies, pixels, web beacons and similar technologies. Strictly necessary technologies support security, authentication, preferences and core functionality. Where required, analytical, personalisation and advertising technologies operate only after the individual’s choice through our consent manager.
- Website users can accept, reject or manage non-essential categories and can revisit their choices through the cookie settings link.
- Application users may receive a separate consent or preference interface where non-essential technologies are used.
- Marketing messages include an unsubscribe mechanism. Opting out of marketing does not prevent operational, security, service or legally required communications.
- Cookie providers, purposes and retention periods are described in the applicable Cookie Policy and consent interface.
Cookie Policy: https://anchanto.com/cookies-policy/
6. Disclosure and service providers
Anchanto does not sell personal data. We may disclose personal data only where appropriate for the purposes described in this Policy, including to:
- Affiliates supporting the relevant service or business function.
- Service providers and sub-processors supporting hosting, communications, analytics, CRM, customer support, monitoring, logging, security operations and professional services.
- Professional advisers, auditors, insurers, regulators and competent authorities.
- A buyer, investor, successor or adviser in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality controls.
- Law-enforcement bodies, courts or other authorities where disclosure is required or permitted by law.
For customer-controlled data, sub-processors are governed by the applicable DPA. Information about current sub-processors and change notifications is provided through the mechanism stated in the DPA or on request, as applicable.
7. International transfers
Personal data may be processed outside the country in which it was collected, including in Singapore, India, customer-selected hosting regions and locations from which authorised support is provided. We apply transfer safeguards required by applicable law.
- For transfers subject to the GDPR, we may use adequacy decisions, the European Commission Standard Contractual Clauses and supplementary measures where required.
- For transfers subject to the UK GDPR, we may use adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, and supplementary measures where required.
- For transfers from Singapore, we take appropriate steps to ensure recipients are bound to provide a standard of protection comparable to the PDPA.
- For transfers governed by India’s DPDP framework, we comply with applicable restrictions and requirements in force at the relevant time.
8. Retention
We retain personal data only for as long as reasonably necessary for the stated purposes, including to provide services, maintain security and audit records, resolve disputes, enforce agreements and meet legal obligations. Retention may vary by record, jurisdiction, customer instruction and contractual requirement.
| Data category | Retention approach |
| Website enquiry and demonstration data | Normally up to 24 months from the last meaningful interaction, unless a business relationship begins or a longer period is required. |
| Marketing preferences and suppression records | Until withdrawal or opt-out; limited suppression information may be retained to honour the choice. |
| Recruitment data | For the recruitment process and a limited period afterward as permitted or required by law and the recruitment notice. |
| Account, authentication and security records | For the account lifecycle and a limited period afterward for security, audit, dispute and legal purposes. |
| Support records | Under the applicable support retention schedule and customer agreement. |
| Customer-controlled operational data | For the customer relationship and then returned or deleted under the DPA, subject to lawful retention and backup cycles. |
Where required by law or contract, data is deleted, anonymised or returned when the purpose ends, consent is validly withdrawn, or the service terminates. Backup copies may remain for a limited period and are protected from ordinary use until overwritten or securely deleted.
9. Security
Anchanto uses technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, destruction and other misuse. Depending on the service and risk, measures may include:
- Encryption in transit and at rest where appropriate.
- Role-based access, least privilege and multi-factor authentication for privileged access.
- Security logging, monitoring, alerting and incident response.
- Vulnerability management, security testing and remediation processes.
- Supplier due diligence and contractual data-protection requirements.
- Data masking or synthetic data for non-production use where reasonably practicable.
- Privacy and security awareness training.
No security measure can eliminate every risk. Questions about security may be sent to infosec@anchanto.com.
10. Personal data breaches
Anchanto maintains processes to identify, contain, investigate, remediate and document personal data breaches. Where Anchanto acts as controller or data fiduciary, we notify regulators and affected individuals when required by applicable law. Where Anchanto acts as processor, we notify and assist the affected customer in accordance with the DPA. Contract-specific notification periods apply only where stated in the relevant agreement.
11. Individual rights
Depending on applicable law and the circumstances, individuals may have rights to request access, correction, completion, erasure, restriction, objection, portability, consent withdrawal, grievance redressal or nomination. Some rights are subject to conditions, exceptions and verification requirements.
Depending on applicable law and the circumstances, you may have rights over your personal data. Some rights apply only in certain situations and are subject to conditions, exceptions and identity verification. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.
11.1 Your rights under the GDPR and UK GDPR
If you are in the European Economic Area or the United Kingdom and Anchanto is the controller of your personal data, you have the following rights.
- Right to be informed. You have the right to clear information about how we collect and use your personal data. This Privacy Policy, and any notice given at the point of collection, provides that information.
- Right of access. You may ask us to confirm whether we process your personal data and to receive a copy of it, together with information about the purposes, recipients, retention and source of the data.
- Right to rectification. You may ask us to correct inaccurate personal data and to complete incomplete personal data.
- Right to erasure. You may ask us to delete your personal data where, for example, it is no longer needed for the purpose collected, you withdraw consent, or you successfully object to processing. We may retain data where the law requires it or where it is needed for legal claims.
- Right to restrict processing. You may ask us to limit how we use your personal data, for example while we verify its accuracy or assess an objection.
- Right to data portability. Where processing is based on your consent or on a contract and is carried out by automated means, you may ask to receive the personal data you provided in a structured, commonly used, machine-readable format, or to have it sent directly to another controller where technically feasible.
- Right to object. See the separate notice below.
- Rights related to automated decision-making, including profiling. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. As stated in Section 4.3, Anchanto does not currently make such decisions.
In addition, where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing carried out before it. You also have the right to lodge a complaint with a supervisory authority (Section 11.4).
Your right to object You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object at any time to the use of your personal data for direct marketing, including related profiling. When you do, we will stop using your personal data for that purpose. You can use the unsubscribe link in any marketing email or contact us using the details in Section 11.3.
We respond to GDPR and UK GDPR requests within one month of receipt. Where a request is complex or we receive many requests, we may extend this by up to two further months and will tell you within the first month.
| Jurisdiction | Key rights addressed by this Policy |
| EEA / United Kingdom | Access, correction, erasure, restriction, objection, portability, consent withdrawal, complaint and safeguards relating to qualifying automated decisions. |
| India | Access to prescribed information, correction, completion, updating, erasure, grievance redressal, consent withdrawal and nomination, to the extent applicable and in force. |
| Singapore | Access, correction and consent withdrawal. Any data-portability right will apply only when the relevant statutory provisions and implementing requirements are in force. |
11.2 How to submit a request
- Website visitors, prospects and other direct contacts: email infosec@anchanto.com.
- Individuals in the EEA or the UK: you may also contact our EU or UK representative (Section 1.4) at gdpr@ametrosgroup.com.
- Authorised application users: contact the customer organisation’s administrator for customer-managed records, or contact Anchanto for records for which Anchanto is responsible.
- Shoppers, consignees and other individuals whose information appears in customer orders: contact the retailer, brand or other Anchanto customer that controls the order data. Anchanto assists customers as required by the DPA.
We may request information reasonably necessary to verify identity, authority and scope before acting. We may refuse or limit a request where permitted by law and will explain the reason where required. We respond within the period required by applicable law; where no statutory period applies, we aim to respond without undue delay.
11.3 Complaints
Contact our Data Protection Officer first so that we can review the concern. Individuals may also complain to the competent authority where the law permits. Depending on location, this may include:
- an EEA supervisory authority
- the UK Information Commissioner’s Office
- the Data Protection Board of India
- Singapore’s Personal Data Protection Commission
- Malaysia’s Personal Data Protection Commissioner
- Thailand’s Personal Data Protection Committee
- the Philippines National Privacy Commission
- Korea’s Personal Information Protection Commission
- the Saudi Data & AI Authority (SDAIA)
- the UAE Data Office
- the relevant authority in Indonesia or Vietnam
12. Children
Our websites and applications are business services and are not intentionally directed to children. We do not knowingly seek personal data from children through general website forms. Customers must not use the applications to process children’s personal data unless they have a lawful basis, provide required notices, obtain verifiable parental or guardian consent where required, and comply with applicable restrictions. If we learn that we collected children’s personal data contrary to applicable requirements, we will take appropriate steps to delete or otherwise address it.
13. Changes to this Policy
We may update this Policy to reflect changes to our services, practices, service providers, contracts or applicable law. The version and effective date identify the current publication. Where required, we will provide additional notice of material changes. Changes affecting customer-controlled processing are managed under the applicable DPA and customer communication channel.
14. Contact us
| Contact | Details |
| Privacy enquiries and rights requests | infosec@anchanto.com |
| Data Protection Officer | Julien Juttet, julien.juttet@anchanto.com |
| Security enquiries | infosec@anchanto.com |
| EU Representative (GDPR Art. 27) | Ametros Ltd, Coliemore House, Coliemore Road, Dalkey, Dublin, Ireland · gdpr@ametrosgroup.com · www.ametrosgroup.com |
| UK Representative (UK GDPR Art. 27) | Ametros Group Ltd, Broadway House, 32–35 Broadstreet, Hereford, England · gdpr@ametrosgroup.com · www.ametrosgroup.com |
| Anchanto Services Pvt. Ltd. | 9th Floor, Malpani Agile, Pan Card Club Rd, Baner, Pune, Maharashtra 411069 |
| Anchanto Pte. Ltd. | 30 Raffles Pl, #12-01 Anchanto, Singapore |
Appendix A: Publication validation checklist
- Complete all bracketed fields, dates and addresses.
- Confirm the responsible Anchanto entity for each geography and processing activity.
- Validate the controller/processor classification for account data, telemetry, support and security logs against actual practices and contracts.
- Reconcile the cookie section with the deployed website and in-application consent tools, vendors and retention periods.
- Confirm that marketing consent, opt-out and suppression workflows match the statement.
- Validate the 24-month enquiry retention period and all referenced schedules.
- Confirm actual hosting and support locations, transfer mechanisms and sub-processor process.
- Use certification language only if certification is current and the public claim accurately states scope.
- Align breach language with DPAs and incident-response procedures.
- Have privacy counsel validate applicability and commencement status of statutory requirements before approval.
Appendix B: Legal and drafting references
This draft was reviewed against publicly available materials including:
- Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025, including their phased commencement.
- Singapore Personal Data Protection Act 2012, Personal Data Protection Regulations 2021 and PDPC guidance on data-protection obligations.
- GDPR and UK GDPR principles concerning transparency, controller and processor roles, rights and international transfers.