POLICY 17 — GLOBAL PRIVACY, ACCESSIBILITY & CONSUMER COMPLIANCE ADDENDUM
Effective: November 5, 2026 · Last updated: November 5, 2026
1.Purpose and relationship to the other policies
This addendum records how MHS Tools applies its privacy, consumer-protection, taxation and accessibility commitments to customers in the jurisdictions in which it sells. It is read together with the Privacy Policy, Terms of Service, Digital Licence, Refund Policy, Cookie Policy and Accessibility Statement.
Where a mandatory provision of local law gives a customer a stronger right than these policies, that provision prevails to the extent of the conflict. Nothing in these policies excludes a right that cannot lawfully be excluded.
MecHet Solutions is the operator of MHS Tools and the entity responsible for the personal data described in the Privacy Policy. Contact for all jurisdictions: info@mechetsolutions.com.
2.India — DPDP Act 2023, consumer and e-commerce law
For customers in India, MecHet Solutions handles personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable rules made under it.
Personal data is processed only for the lawful purposes described in the Privacy Policy, on the basis of the Data Principal's consent or another lawful basis recognised by the DPDPA. Consent is requested through clear, plain-language notices and can be withdrawn at any time with the same ease with which it was given.
- Right to access a summary of personal data processed, the purposes and the identities of parties with whom it has been shared.
- Right to correction, completion and updating of inaccurate or incomplete personal data.
- Right to erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to statutory retention.
- Right to grievance redressal through our Grievance Officer, and the right to nominate another individual to exercise rights in the event of death or incapacity.
- Right to complain to the Data Protection Board of India if a grievance is not resolved within the applicable period.
- Processing of children's data is not intentionally undertaken; MHS Tools is a professional engineering marketplace and is not directed to children under 18. Where a user is under 18, verifiable parental consent is required and behavioural advertising is disabled.
- Security safeguards include encryption in transit, access controls, least-privilege administration, audit logging and vendor due diligence. Personal data breaches that meet the statutory threshold are notified to the Data Protection Board and affected Data Principals without undue delay.
- Cross-border transfers are made only where permitted by the DPDPA and any notified restrictions, under contractual confidentiality and security obligations.
- Consumer sales are also subject to the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, including disclosure of seller identity, grievance contact, pricing, delivery timelines and refund terms. Grievances are acknowledged within 48 hours and resolved within one month of receipt.
3.European Economic Area and United Kingdom — GDPR and consumer law
For customers in the EEA, MecHet Solutions processes personal data in accordance with Regulation (EU) 2016/679 (GDPR); for customers in the United Kingdom, in accordance with the UK GDPR and the Data Protection Act 2018.
We rely on the following lawful bases as applicable: performance of a contract (account, order, licence and download delivery), compliance with a legal obligation (tax, accounting and fraud-prevention records), legitimate interests (security, service improvement and limited analytics) and consent (optional marketing and non-essential cookies). Consent can be withdrawn at any time.
- Rights of access, rectification, erasure, restriction, objection, and data portability, plus the right not to be subject to solely automated decisions with legal or significant effects.
- Requests are answered without undue delay and generally within one month, extendable where the law permits.
- International transfers outside the EEA or UK rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
- Customers may lodge a complaint with their local supervisory authority or the UK Information Commissioner's Office. We ask that you contact us first so that we can attempt to resolve the matter.
- For digital content and digital services, the withdrawal right under Directive 2011/83/EU and the UK Consumer Contracts Regulations 2013 may be lost once supply has begun with the consumer's prior express consent and acknowledgement that the right is lost. Checkout requests that acknowledgement before a paid order is completed.
- Consumer guarantees under the UK Consumer Rights Act 2015 and equivalent EEA national law are not affected by our refund or licence terms.
- The European Accessibility Act (Directive (EU) 2019/882) and its national implementing measures inform our WCAG 2.2 Level AA accessibility target and our remediation process.
4.Australia — Privacy Act 1988 and Australian Consumer Law
For customers in Australia, MecHet Solutions handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as updated by the Privacy and Other Legislation Amendment Act 2024.
We collect only personal information reasonably necessary for the purposes described in the Privacy Policy, and we take reasonable steps to ensure that information is accurate, secure and retained only as long as required.
- APP 1 — open and transparent management of personal information, including this policy and our privacy contact.
- APP 6 — use and disclosure limited to the primary purpose of collection or a permitted secondary purpose.
- APP 8 — cross-border disclosure: we take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.
- APP 11 — security of personal information, including technical and organisational safeguards and destruction or de-identification when no longer needed.
- APP 12 and APP 13 — access to, and correction of, personal information on request.
- Eligible data breaches are assessed and, where required, notified to the Office of the Australian Information Commissioner (OAIC) and affected individuals under the Notifiable Data Breaches scheme.
- The statutory tort for serious invasions of privacy introduced by the 2024 amendments is acknowledged; we do not intentionally collect, publish or trade personal information in a manner that would engage it.
- Complaints may be made to our privacy contact and, if unresolved, to the OAIC.
- Australian Consumer Law guarantees (acceptable quality, fitness for a disclosed purpose, and remedies for major or minor failures) apply and are not excluded. Digital products are supplied with the licence described on the product page, and refunds are handled consistently with those non-excludable guarantees.
- Prices displayed to Australian customers are shown in AUD where selected. GST treatment is disclosed in the order summary before payment; cross-border supplies are documented consistently with the seller's Indian GST export position.
5.United States — state privacy laws and ADA
For customers in US states with comprehensive privacy legislation (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states as their laws take effect), we honour the applicable rights and disclosures, including notice at collection, access, deletion, correction, portability and opt-out rights.
We do not sell personal information for monetary consideration, and we do not use or disclose sensitive personal information for purposes requiring a right to limit under the CPRA. Where a covered business relationship exists, we honour Global Privacy Control (GPC) signals as a valid opt-out of sale or sharing for the browser or device that sends the signal.
- California residents may exercise CCPA/CPRA rights, designate an authorised agent, and appeal a denied request through the route described in our response.
- Requests are verified using account authentication or, where no account exists, proportionate order-reference verification.
- We do not discriminate against a customer for exercising a privacy right; a product or service will not be refused solely because a right was exercised.
- MHS Tools is committed to ADA Title III accessibility for its public website and purchasing flow, using WCAG 2.2 Level AA as the technical benchmark. Accessibility requests and complaints are handled by the compliance desk.
- Where Section 508 applies to a public-sector customer's procurement, we will provide a reasonable accessibility conformance statement on request.
6.Canada — PIPEDA
For customers in Canada, personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation where applicable. We collect, use and disclose personal information only for purposes a reasonable person would consider appropriate, obtain consent where required, and provide access and correction rights on request.
7.Payments, taxation and export documentation
Indian domestic supplies are invoiced with GST at the applicable rate, shown in the order summary before payment. Supplies to customers outside India are treated as exports of services and are invoiced on a zero-rated basis under the seller's Letter of Undertaking (LUT), without payment of integrated tax, where the statutory conditions are met.
The LUT application reference number (ARN) is confidential filing information. It is retained internally for tax records and is not published on customer-facing screens, invoices, emails or receipts. Customer invoices state the zero-rated export treatment and the applicable HSN/SAC classification without disclosing the ARN.
Business customers may supply a GSTIN, VAT number, ABN or other tax identifier for invoice and input-credit documentation. Tax treatment is determined from the customer's billing country and status, not from the display currency.
Payment card data is processed by the payment provider and is not stored on MHS Tools servers. Payment confirmation is verified server-side before any licence or download entitlement is issued.
8.Processor engagement, retention and security
We use service providers for authentication, database hosting, file storage, payment processing, email delivery, error monitoring and analytics. These providers are bound by confidentiality and data-protection terms, process data only on documented instructions, and are subject to periodic review.
Retention periods are kept to the minimum required for the account relationship, the transaction, statutory tax and accounting obligations, fraud prevention and dispute resolution. Invoices and tax records are retained for the period required by applicable tax law; account data is deleted or de-identified after a verified deletion request subject to those exceptions.
Organisational and technical measures include encryption in transit, least-privilege administrative access, audit logging of privileged actions, dependency patching and documented incident response procedures. Specific controls are reviewed periodically and may be described to business customers on request under confidentiality.
9.Requests, timelines and complaints
Privacy, accessibility and consumer requests can be submitted through the Privacy Request Portal at /legal/privacy-requests or by email to info@mechetsolutions.com. Include your name, the email associated with your account, your jurisdiction and the right you wish to exercise.
- Acknowledgement: within 5 business days (48 hours for Indian consumer grievances).
- Substantive response: generally within 30 days, or the shorter period required by applicable law.
- Where an extension is permitted, we will explain the reason and the expected date.
- If a request is refused, we will explain the lawful basis and the available appeal or regulatory complaint route.
- Grievance Officer (India): Het Patel, Founder & Grievance Officer — info@mechetsolutions.com.
- Data protection contact (EEA/UK/Australia/US/Canada): info@mechetsolutions.com, marked for the Compliance Desk.
10.Review and version control
This addendum is reviewed at least annually and whenever a material change in law, processing activity, sub-processor or product architecture occurs. Each published version carries an effective date and a last-updated date, and material changes are notified to account holders where required by law. Previous versions are retained for audit purposes.