Privacy Policy

Last updated: [[CONFIRM date]]

This privacy policy explains how GDPM Enterprises Pvt Ltd collects, uses, stores, and protects personal data in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act).

1. Data Controller

GDPM Enterprises Pvt Ltd
CIN: U15549UP2019PTC120654
GSTIN: 09AAHCG9690G1Z1
Registered office:
Narahwa village, Kushinagar district, Uttar Pradesh
Contact: [[CONFIRM email]]

2. Data We Collect

• Registration data: name, email, phone, business name, GSTIN, role, state, district
• For recyclers: SPCB consent number and validity date
• Listing data: waste category, quantity, district (never full address publicly)
• Form submissions: vermicompost quotes, feedstock EOI, contact messages
• Payment data: processed by Razorpay (GDPM does not store card numbers)
• Technical data: IP address, browser type, pages visited (cookieless analytics only)

3. Purpose and Legal Basis

Under the DPDP Act 2023, we process personal data for: (a) performance of contract (marketplace services), (b) compliance with legal obligations (GST invoicing, record-keeping), (c) legitimate interests (platform security, fraud prevention). [[VERIFY against DPDP Act sections]]

4. Data Retention

Account data: retained while the account is active + 3 years after deletion. Financial records (invoices, payment records): retained for the period required under the CGST Act (currently 8 years from the relevant annual return). [[VERIFY retention period with CA]]

5. Your Rights

Under the DPDP Act 2023, you have the right to: (a) access your personal data, (b) correct inaccurate data, (c) erase your data (subject to legal retention requirements), (d) nominate a person to exercise your rights. [[VERIFY: no data portability right under DPDP Act 2023]]

6. Children's Data

The GDPM marketplace is intended for businesses and individuals aged 18+. We do not knowingly collect data from persons under 18. Verifiable parental consent is required for any user under 18 per Section 9 of the DPDP Act 2023.

7. Cookies and Tracking

GDPM uses cookieless, self-hosted analytics. We do not set tracking cookies. Session cookies are used only for login authentication and expire when you close your browser. No third-party tracking scripts are loaded.

8. Grievance Officer

Name:
Email:
Address:

9. Changes to This Policy

We will notify registered users of material changes via email. The updated policy will be posted here with the revision date.