Privacy Policy

1. Itemised List of Personal Data We Collect

In accordance with Rule 3 of the DPDP Rules, the following is an itemised description of every category of personal data we process, and the specific purpose for each.

We do not collect Aadhaar numbers, bank account details, card details, biometric data, health data, caste or religion, precise GPS location, or any special category of data.

2. Goods and Services Enabled by This Processing

Rule 3 requires us to itemise what you actually get in return for this data. Specifically:

• A verified trading account on the AgroMart marketplace
• Access to live district-wise makhana price discovery
• The ability to list produce (farmers) or place and track orders (buyers)
• Negotiation tools — ask-price requests and sample requests
• Order status tracking, including logistics partner and e-way bill details once dispatched
• Order summaries and invoices for your records
• Support and dispute mediation from our relationship team
• Account recovery if you lose access to your password

3. Legal Basis for Processing

We process your personal data on the following grounds recognised by the DPDP Act:

• Your consent (Section 6): Given at registration and, where applicable, at the point you supply optional data such as your address, email, or photographs.
• Certain legitimate uses (Section 7): Where you have voluntarily provided data for a specified purpose and have not indicated otherwise — for example, sharing your delivery address with the counterparty so your order can be fulfilled.
• Compliance with law: Retention of invoices, GSTIN and transaction records as required under Indian tax and company law.

Consent obtained by us is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.

4. Withdrawing Your Consent

• You may withdraw consent at any time, with comparable ease to how it was given, by writing to agromartfounders@gmail.com with the subject line "Withdraw Consent".
• You may remove optional data (address, email, photographs) yourself from your Profile page at any time.
• On withdrawal we will cease processing within a reasonable period and erase your personal data, unless retention is required by law or for the enforcement of legal claims.
• Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not undo completed transactions.
• Withdrawing consent for data that is essential to the Service (name, mobile number) will mean we can no longer provide you an account.

5. Your Rights as a Data Principal

Under Chapter III of the DPDP Act you have the following rights. To exercise any of them, email agromartfounders@gmail.com. We respond within 30 days.

• Right to access information (Section 11): A summary of the personal data we hold about you, the processing activities undertaken, and the identities of any other Data Fiduciaries or Processors with whom it has been shared. Much of this is already visible in your Profile and order history.
• Right to correction and erasure (Section 12): You can correct most fields yourself in Profile. For correction of locked fields (such as GSTIN) or for erasure of your account and data, contact us.
• Right of grievance redressal (Section 13): Raise a complaint with our Grievance Officer (details above). We will respond within 30 days.
• Right to nominate (Section 14): You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Send us the nominee's name and contact details in writing.

You also have duties under Section 15 — notably, not to furnish false particulars or impersonate another person, and not to raise frivolous complaints.

6. Escalating to the Data Protection Board

If you are not satisfied with our response, or we fail to respond within 30 days, you may lodge a complaint with the Data Protection Board of India established under the DPDP Act. You must ordinarily exhaust our internal grievance mechanism first.

7. Where and How Your Data Is Stored

• Location: Our application and database run on Amazon Web Services infrastructure in the Mumbai (ap-south-1) region, within India.
• Database: MySQL, running in an isolated container with a persistent encrypted volume.
• Passwords: Hashed with BCrypt. We cannot read or recover your password.
• In transit: All traffic is served over HTTPS with TLS. Plain HTTP is redirected.
• Sessions: JWTs signed with HMAC-SHA256, expiring 24 hours after issue.
• Access control: Role-based — farmers, buyers, relationship managers, post-sourcing agents and administrators each see only the data their role requires.
• Abuse controls: API rate limiting and a cap of 5 login attempts per 15 minutes.
• Audit logging: Changes to accounts, listings and orders are logged with the acting user and timestamp.

These are the reasonable security safeguards we maintain under Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules. No system is perfectly secure, and we continue to strengthen these measures over time.

8. Who Your Data Is Shared With

• Visible to all signed-in users: For farmers — your name, district, produce grade, listed price, available quantity and any photographs you upload. Your phone number and address are not shown publicly.
• Shared with your counterparty on a confirmed order: The buyer's name, phone number, GSTIN and delivery address are shared with the farmer; the farmer's name, phone number and location are shared with the buyer. This is necessary to fulfil the trade.
• Our relationship and sourcing teams: Staff assigned to your orders can view your contact details and order history to coordinate the trade and resolve disputes.
• Administrators: Platform administrators can access user, order and pricing records for operational, accounting and fraud-prevention purposes.
• Logistics partners: Where a shipment is arranged, the delivery address and consignee contact details are shared with the appointed logistics provider.
• Infrastructure provider: Amazon Web Services hosts our servers as a Data Processor. AWS does not use your data for its own purposes.
• We do not sell your personal data and do not share it with advertisers or data brokers.
• Legal disclosure: We may disclose data where compelled by a valid order of a court, tribunal, or authority empowered by law.

9. Cross-Border Transfer

Your personal data is stored and processed in India. We do not currently transfer personal data outside India. Should that change, any transfer will be limited to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we will update this Notice before doing so.

10. How Long We Keep Your Data

We retain personal data only for as long as the purpose requires, or as law obliges.

Before erasing data on account of dormancy, we will give you notice at least 48 hours in advance at your registered mobile number or email, so you can log in and retain your account if you wish.

11. If There Is a Data Breach

• We will notify every affected Data Principal without delay, describing the nature and extent of the breach, its likely consequences, the measures we have taken, and what you should do to protect yourself.
• We will report the breach to the Data Protection Board of India promptly, and provide the detailed report required under Rule 7 within 72 hours of becoming aware of it.

12. Cookies, Session and Local Storage

• sessionStorage holds your authentication token; it is cleared when you close the tab.
• localStorage holds saved delivery addresses, favourite-listing price snapshots and interface preferences, purely for your convenience. This stays on your device.
• We do not use third-party advertising cookies, cross-site trackers, or behavioural analytics.
• Clearing your browser storage removes all of the above.

13. Children and Persons with Disability

• AgroMart is a business-to-business platform intended solely for persons aged 18 or above.
• We do not knowingly process the personal data of a child. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
• Where we process the data of a child or of a person with a disability who has a lawful guardian, we will obtain verifiable consent from the parent or guardian as required by Section 9 and Rules 10 and 11.
• If you believe a minor has registered, write to us and we will verify and erase the account.

14. Automated Decision-Making

We do not make solely automated decisions that produce legal effects concerning you. Platform-fee calculation is rule-based and transparently shown to you before you confirm an order. Account suspension decisions involve human review.

15. Changes to This Notice

We may revise this Notice. Where a change materially affects how we process your personal data or the purposes for which we process it, we will give you notice through the platform or at your registered contact details before the change takes effect, and where the DPDP Act requires it, seek fresh consent. The "Last updated" date above always reflects the current version.

16. Contact

For any question, request or complaint concerning your personal data, or to exercise any right described above, contact our Grievance Officer:

• Email: agromartfounders@gmail.com
• Phone: +91 88267 84842
• Response time: Within 30 days of receiving your request

This Notice is available in English. On request we will provide it in Hindi or any other language listed in the Eighth Schedule to the Constitution of India, as required by Section 5(3) of the DPDP Act.