Privacy Policy · <PENDING FROM USER>

This policy is issued under the Digital Personal Data Protection Act, 2023 and Rule 4 of the Information Technology (Reasonable Security Practices) Rules, 2011.

1. Data we collect

Account data: name, email, phone, encrypted password, profile photo.
Buyer data: delivery addresses, saved products, order history, review/comment content.
Seller data: business name, GSTIN, PAN, business address, bank account details for payouts, uploaded documents.
Payment data: transactions are processed by our RBI-regulated gateway partners (Razorpay/Cashfree). SociMart stores only the gateway order_id, payment_id, amount, and status. We do not store full card numbers or CVV.
Device/log data: IP address, browser, device type, timestamps, referring URL — used for security and abuse prevention.
Cookies: essential (auth session), analytics (usage patterns), and preferences (theme, viewed items).

2. Lawful basis

We process personal data on the basis of: (a) your consent, obtained via the sign-up flow and cookie banner; (b) performance of a contract (delivering the marketplace to you); and (c) legal obligations under Indian law.

3. Third-party sharing

We share the minimum data necessary with: payment gateways (transaction fields only), logistics partners you or the seller nominate (name, phone, delivery address), the requested inspector for an inspection booking (product location + your first name), and our cloud hosting provider (encrypted data at rest).

We do not sell personal data to any third party.

4. Your rights

You have the right to: access the personal data we hold on you; correct inaccuracies; delete your account and associated data (subject to legal retention obligations); withdraw consent at any time; and grieve with our Grievance Officer.

We respond to all rights requests within 30 calendar days.

5. Data retention

Account data is retained while the account is active. On deletion, we retain minimal transactional records for eight (8) years to comply with tax, GST, and dispute-resolution obligations, then delete or fully anonymize them.

6. Security

All secrets (payment gateway keys, SMTP passwords, seller bank details) are encrypted at rest using Fernet symmetric encryption.
All traffic to the platform is served over TLS 1.2+.
Access to production data is restricted, logged in an audit trail, and reviewed monthly.

7. Children's privacy

The platform is not directed to individuals under the age of 16. We do not knowingly collect data from users under 16. If you believe a minor has created an account, please write to support@socimart.com and we will delete it.

8. International transfers

Our primary infrastructure is India-hosted. If we ever transfer data outside India, we do so only to countries notified as adequate by the Government of India, or under contractual clauses that mirror Indian DPDP protections.

9. Grievance Officer (IT Rules 2021)

Name:
Email: support@socimart.com
Response SLA: 15 days from receipt of a written grievance.

10. Changes

We publish material changes to this policy in-app and by email at least seven (7) days before they take effect.