Privacy policy

This website and the BARREL portals are operated by Bharat Atom Renewable Resources Energy Limited ("BARREL", "we", "us"), a company registered in India. For the personal data described in this policy, BARREL is the data fiduciary under the Digital Personal Data Protection Act, 2023.

This policy covers www.barrel.energy and the BARREL portals that use the same sign-in, such as BARREL Shop and BARREL OS. It explains what personal data we collect, why we collect it, how long we keep it and what you can ask us to do with it.

It does not cover websites of other organisations that we link to. Their own policies apply to them.

We do not ask for sensitive information such as health data, financial account passwords or government identity numbers through the contact form. Please do not include such information in your message.

• To read and reply to your enquiry, and to send you an acknowledgement by email.
• To pass your enquiry to the team at BARREL that handles the topic you selected.
• To sign you in to a portal and keep you signed in.
• To provide the portal services you have registered for.
• To protect the website and portals against misuse, for example by limiting the number of enquiries and one-time codes from one source.
• To meet legal, tax and regulatory obligations that apply to us.

We process personal data on the basis of your consent, or for the purpose for which you have voluntarily given it to us — for example, when you send an enquiry so that we can reply to you. We may also process personal data where the law requires or permits it.

You may withdraw your consent at any time by writing to the contact given on this page. Withdrawal does not affect processing that took place before it, and we may need to keep some records where the law requires us to.

The public website www.barrel.energy does not set cookies and does not use analytics, advertising or tracking tools. The portals set one session cookie after you sign in. Details are in the cookie notice.

We do not sell personal data. We share it only as follows:

• Service providers who process data for us: our hosting provider, our email delivery provider (Brevo) and our SMS delivery provider (MSG91). They receive only what is needed to deliver the service.
• People inside BARREL who need the information to respond to you or to provide the service.
• Courts, regulators and government authorities, where the law requires it.
• On the portals, other parties to a transaction you take part in, to the extent the portal describes at that point.

Some service providers may process data on servers outside India. Where that happens, we do so in line with applicable Indian law.

When data is no longer needed for the purpose and no law requires us to keep it, we erase it.

• The website and portals are served over HTTPS.
• One-time codes and session tokens are stored only in hashed form.
• The session cookie cannot be read by scripts in the browser.
• Access to enquiries and records inside BARREL is limited by role and permission.
• No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• ask for a summary of the personal data we hold about you and how we have processed it;
• ask us to correct, complete or update your personal data;
• ask us to erase personal data that is no longer needed, unless a law requires us to keep it;
• withdraw consent you have given;
• nominate another person to exercise your rights in the event of death or incapacity;
• have a grievance addressed by us, and to approach the Data Protection Board of India if you are not satisfied with our response.

To use any of these rights, write to us at the contact below from the email address or mobile number linked to your data, so that we can confirm the request is yours.

The website and portals are meant for businesses and professionals. They are not directed at persons under 18 years of age, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please write to us and we will erase it.

For any question, request or complaint about personal data, write to us with the subject "Privacy". We will acknowledge your message and respond within the time the law allows.

We may update this policy when our services or the law change. The date at the top of the page shows when it was last updated. Please also read our terms of use.