Last Updated: 1 July 2025
Privacy Policy
AgroZap Private Limited ("AgroZap") is committed to protecting the privacy and security of personal and business data of all Users of its Platform at https://agrozap.in. This Privacy Policy is compliant with the Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology Act 2000, the IT (Reasonable Security Practices) Rules 2011, and the Consumer Protection (E-Commerce) Rules 2020.
By using the Platform, you consent to the collection and use of your data as described in this Policy.
1. Data We Collect
| Category | Specific Data | Purpose |
|---|---|---|
| Identity | Name, designation, Aadhaar (last 4 digits), PAN, Director DIN | KYC, account creation, fraud prevention |
| Business | Company name, CIN, GSTIN, trade license, pesticide license | Verification, invoicing, regulatory compliance |
| Contact | Mobile number, business email, registered address | Communication, OTP authentication, support |
| Financial | Bank account, IFSC, cancelled cheque | Payment settlement (future feature) |
| Transactional | Orders, enquiries, quotations, invoices, delivery records | Order management, dispute resolution, audit |
| Behavioural | Search history, pages viewed, time on platform, click patterns | Platform improvement, personalisation |
| Technical | IP address, browser type, device ID, OS, cookies | Security, fraud detection, analytics |
| Documents | GST certificate, PAN card, company incorporation documents, licenses | KYC verification, regulatory compliance |
2. Legal Basis for Processing
Under the DPDP Act 2023, AgroZap processes personal data on the following lawful bases:
- Consent: You provide explicit consent during registration.
- Contractual Necessity: Processing required to fulfil the Terms & Conditions you have accepted.
- Legal Obligation: Compliance with GST laws, Companies Act, IT Act, and other statutes requiring data retention.
- Legitimate Interest: Platform security, fraud prevention, and service improvement.
3. How We Use Your Data
- Account creation, KYC verification, and identity management.
- Facilitating B2B transactions between Buyers and Sellers.
- Sending transactional notifications (order updates, invoices, delivery alerts).
- Providing customer support and grievance redressal.
- Fraud detection, risk management, and platform security.
- Regulatory compliance, legal proceedings, and responding to government requests.
- Analytics and platform improvement (using anonymised/aggregated data).
- Communicating product updates, new features, and promotional offers (with opt-out option).
4. Data Sharing
AgroZap does not sell your personal data. Data may be shared with:
| Recipient | Purpose |
|---|---|
| Other registered Users | Your business name, GSTIN, and product catalogue (as needed for transactions) |
| KYC verification partners | Identity and document verification |
| Logistics partners | Delivery address, contact details for order fulfilment |
| Payment gateways / NBFCs | Financial transactions (future feature) |
| Cloud infrastructure providers | Data hosting and processing |
| Legal and regulatory authorities | Compliance with court orders, statutory requirements |
| Auditors and legal advisors | Compliance audits, legal defence |
All third-party data processors are contractually bound to process data only as instructed by AgroZap and to maintain appropriate security standards.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| KYC documents | 7 years from account closure (as per RBI/IT Act requirements) |
| Transaction records & invoices | 8 years (as per GST Act, Companies Act) |
| Account & profile data | Duration of account + 3 years after closure |
| Communication logs | 2 years |
| Website analytics data | 2 years (anonymised thereafter) |
6. Your Rights under DPDP Act 2023
As a Data Principal under the DPDP Act, you have the following rights:
- Right to Access: Request a summary of personal data processed by AgroZap.
- Right to Correction: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of data no longer necessary for the original purpose (subject to legal retention obligations).
- Right to Grievance Redressal: Lodge complaints regarding data processing with our Grievance Officer.
- Right to Nominate: Nominate a person to exercise rights on your behalf in case of death or incapacity.
- Right to Withdraw Consent: Withdraw consent at any time; however, this may affect your ability to use the Platform.
To exercise these rights, write to contact@agrozap.in. We will respond within 30 days.
7. Data Security
AgroZap implements reasonable security practices as required under the IT (Reasonable Security Practices and Procedures) Rules 2011, including:
- SSL/TLS encryption for data in transit.
- Encrypted storage for sensitive documents.
- Role-based access controls for internal staff.
- Regular security audits and penetration testing.
- Incident response procedures for data breaches.
In the event of a data breach affecting your personal data, AgroZap will notify you and the Data Protection Board of India as required under the DPDP Act.
8. Cookies
AgroZap uses cookies for session management, analytics, and functionality. For full details, refer to our Cookie Policy.
9. Cross-Border Data Transfers
Your data is primarily stored in India. If data is transferred outside India (e.g., to cloud infrastructure), AgroZap ensures such transfer complies with the DPDP Act and applicable data localisation requirements.
10. Children's Data
AgroZap is a B2B platform for businesses. We do not knowingly collect data from individuals under 18 years of age. If such data is discovered, it will be deleted immediately.
11. Contact — Data Protection
| Data Fiduciary | AgroZap Private Limited |
| Privacy Contact | contact@agrozap.in |
| Response Time | 30 days |