Privacy & Data Protection Policy

Owned & Operated by Mantra Tech Fusion (Proprietor: Vikrant Saini), GSTIN: 06BLSPS8961E1ZD. This policy explains what personal and business data Bikwao collects, why we collect it, how we protect it, and your statutory rights under the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

Statutory Framework

This Privacy Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), as applicable.

8.1 Information We Collect

Category	Examples	Why We Collect It
Account Data	Name, mobile number, email, password (salted PBKDF2 hash), business name, city/location	To create, authenticate, and secure your account and verify user identity.
Listing Data	Item title, description, category, quantity, price, unit, photos, warehouse location	To publish and display your commercial surplus listings to verified buyers.
Communication Data	Messages between buyers and sellers, support queries, RFQ counter-bids	To enable trade inquiry routing, resolve disputes, and assist support requests.
Payment Data	Transaction ID, amount, timestamp, payment status (NO full card or UPI PIN stored)	To process payments via our RBI-authorized gateway partner and maintain tax records.
Technical Data	IP address, device/browser type, essential session cookies, access logs	Security, fraud prevention, server health, analytics, and platform optimization.
KYC Data (where applicable)	GSTIN registration, business documents, government ID proof	To verify identity for trade badges, prevent fraudulent stock lots, and comply with law.

8.2 How We Use Your Information

To operate, maintain, and improve the Platform and its B2B discovery features;
To enable direct communication and commercial negotiations between buyers and sellers;
To process membership payments through our authorised RBI-compliant payment gateway partner(s);
To verify User identity and prevent fraud, duplicate listings, spam, or violation of these Terms;
To send transactional notifications (OTPs, listing updates, RFQ responses);
To comply with applicable law, GST regulatory requests, or court orders;
To analyse usage patterns and improve platform performance (see Cookie Policy).

8.3 How We Share Your Information

We do NOT sell, rent, or trade your personal data to third-party marketing companies.

We may share limited, necessary information only with:

Other Users: Your business name, contact person, phone number, and city are shared with a buyer or seller when required to complete an enquiry, lead connection, or transaction you have initiated.
Payment Gateway Partners: To process online subscription payments securely over PCI-DSS compliant channels.
Service Providers: Cloud hosting, SMS/OTP, email delivery, and support vendors who process data solely on our instructions under confidentiality obligations.
Law Enforcement / Regulators: Where required by law, court order, or to protect the safety, property, or legal rights of Bikwao, our Users, or the public.
Successors: In the event of a merger, acquisition, or sale of business assets, with continued protection under this Policy.

8.4 Data Retention & Verification Documents

We retain personal data for as long as your account is active and for a reasonable period thereafter to comply with legal, tax, accounting, dispute-resolution, and regulatory record-keeping requirements, after which it is securely deleted or anonymised.

Statutory 180-Day Audit Log Retention: In compliance with Rule 3(1)(h) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, all user registration records, access logs, authentication timestamps, and transactional history are securely preserved for a mandatory minimum period of 180 days following account deactivation, cancellation, or withdrawal of consent, for cyber incident investigation and law enforcement coordination.

Business Verification Documents: Official registration certificates (GSTIN registration, Udyam / MSME certificate, trade licence, or firm PAN) submitted for seller verification are stored in secure private storage outside the public web root. These documents are accessed strictly by authorised administrators solely to verify business authenticity against official government portals. Such documents are retained for the duration of the member’s active registration. They will be permanently deleted upon written request from the account holder or upon account closure, except where preservation is mandatory under Indian taxation or anti-fraud laws.

8.5 Your Statutory Rights (DPDP Act, 2023)

Subject to applicable law, you have the right to:

Access the personal data we hold about you;
Request correction of inaccurate, outdated, or incomplete data;
Request deletion of your account and associated personal data, subject to statutory record-keeping obligations;
Withdraw consent for promotional/marketing communication at any time;
Raise a grievance with our Grievance Officer regarding any privacy concern.

8.6 Data Security

We implement industry-standard technical and organizational security measures, including SSL 256-bit encryption in transit (HTTPS/TLS), Salted PBKDF2 password hashing, brute-force rate-limiting, and strict database access controls, to protect your data against unauthorized access, alteration, disclosure, or destruction.

8.7 Children’s Privacy

Bikwao is a commercial B2B portal not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will immediately take steps to delete such information.

8.8 Subdomain Ecosystem (Property & Vehicle)

This Privacy Policy also applies to personal data, property specifications, fleet listings, and trade leads processed across our specialized service verticals: property.bikwao.com (commercial property clearance) and vehicle.bikwao.com (commercial vehicle exchange). All user accounts, billing records, and trade leads are administered centrally under Mantra Tech Fusion (bikwao.com).

Privacy Inquiries & Grievance Redressal

Data Fiduciary: Mantra Tech Fusion (Proprietor: Vikrant Saini)

GSTIN: 06BLSPS8961E1ZD

Grievance & Privacy Officer: Grievance Officer & Nodal Contact

Official Helpdesk & Grievance Email: info.bikwao@gmail.com

Helpline Phone: +91 90172 50070

Registered Address: No 26, Indira Colony, Model Town, Panipat, Haryana 132103, India

Seller identity documents

Everyone who lists on Bikwao, on bikwao.com or on any Bikwao portal (agri, business, property, rentals, resto and vehicle), on a free or a paid plan, uploads one personal or business document once, before the first listing goes live. The same document covers later listings made with the same mobile number.

Accepted documents: masked Aadhaar (only the last 4 digits visible; a full Aadhaar number is not accepted), PAN card, voter ID, driving licence, passport, Udyam certificate, shop or trade licence, GST certificate, FSSAI licence, company or LLP certificate, partnership deed, or another official document in the seller's or the business's name. A GST registration is never required to list.

Why we ask for it: Bikwao (operated by Mantra Tech Fusion) is an intermediary under Section 79 of the Information Technology Act, 2000. The document is a record of who placed each listing. We use it to deal with complaints and fraud, to settle disputes, to respond to lawful requests from courts and government agencies, and to meet our duties under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. We do not check documents through any government service, and having a document on file is not an endorsement of the seller or the listing.

How it is kept:

Files are encrypted (AES-256) and stored outside the public website. They are never shown to buyers or other users.
Photos are saved in WebP format. Of the document number we keep only the last 4 characters.
Only the Bikwao super administrator can open a document, and every opening is recorded with the date and time.
When you tick the consent box we record the date, time, IP address and the version of the consent text you accepted.

Replace, not delete: you can upload a newer document at any time, for example when it expires or your business details change. Earlier documents are kept, encrypted, as part of the record and are not deleted on request while they may be needed for the purposes above. We keep documents while your account or listings exist and after that for as long as the law requires or a legal claim may arise, and in any case for at least 180 days after the account is closed.

Sharing: we never sell documents or use them for marketing. We share them only when the law requires it, such as an order of a court or a lawful request from a government agency or the police.

Your rights under the Digital Personal Data Protection Act, 2023: you can ask what we hold about you and correct it by uploading a newer document. For questions or complaints write to our Grievance Officer at info.bikwao@gmail.com.