Privacy Policy & DPDP Notice

This notice explains what personal and business data BidChemz collects about you, why we collect it, who else handles it, how long we keep it, and the statutory rights you possess regarding your information. It is formulated in strict compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Digital Personal Data Protection Rules.

Blue Litmus Bizconnect operates the BidChemz marketplace and decides how and why your personal data is used. That makes Blue Litmus Bizconnect the Data Fiduciary for it under the Digital Personal Data Protection Act, 2023. You are the Data Principal — the individual or legal entity the data relates to.

1. Why We Use Your Data (Purposes of Processing)

We process your personal data only for specific, explicit, and lawful purposes under Section 6 of the DPDP Act. The first group represents core processing activities necessary for the chemical marketplace to function; the second group is optional and can be toggled on or off at any time from Your data & privacy in your profile.

• Running your account (Mandatory for Platform Use) — Creating your account, signing you in, keeping it secure, and letting you manage your listings and enquiries.
• Showing your business to the other side of a trade (Mandatory for Platform Use) — Publishing the listings or requirements you choose to post, and sharing your business contact details with a buyer or seller once you or they unlock an enquiry. Your contact details are not public — they are shown to a counterparty in a trade.
• Checking you are a real business (Mandatory for Platform Use) — Verifying your PAN, GST or business registration through authorised verification services so other members can trade with confidence. Sellers cannot list without this.
• Payments, invoices and tax records (Mandatory for Platform Use) — Taking payment for a plan or escrow settlement, issuing an invoice, and keeping the accounting and GST records Indian law requires us to keep.
• Messages you need to receive (Mandatory for Platform Use) — One-time passwords, alerts about your listings and bids, and notices about your plan expiring. These are not marketing and cannot be switched off while your account is open.
• Keeping the marketplace clean (Mandatory for Platform Use) — Checking images and documents you upload for unsafe content, chemical compliance, and matching listed products. Documents and images are screened by automated services and never used to train external models.
• AI help while you work (Optional / Freely Given) — The assistant, listing drafts, and market price analysis. Turning this off leaves the rest of the marketplace working normally.
• News and offers (Optional / Freely Given) — Occasional emails about new features, chemical market price bulletins, plans and offers. Nothing to do with running your account.

2. What Personal & Regulatory Data We Hold

We limit data collection strictly to what is relevant, necessary, and proportionate for B2B chemical trading:

• Who you are: Name, the business you represent, your role, and authorized signatory details
• How to reach you: Email address, mobile number, registered business address, manufacturing/dispatch facility address, city, state, pincode, country
• Account security: Password (stored only as a one-way hash, never readable), one-time passwords
• Business & regulatory identifiers: PAN, GSTIN, business registration certificate, and statutory chemical handling permits/licenses (PESO, Poison license, SPCB/CPCB Consent to Operate where applicable)
• What you trade: Listings, chemical specifications (CAS number, grade, packaging), requirements, bids, reverse auctions, counteroffers, enquiries, Certificates of Analysis (CoA), and platform messages
• Payments: Subscription plans, bank account details for escrow payouts/settlement, transaction references and tax invoices. Card/UPI payment details are handled directly by payment aggregators and never stored by us
• Technical records: IP address, browser type, device identifiers, and audit logs of sensitive actions such as revealing a trade contact or verifying chemical KYC
• What you upload: Product images, Safety Data Sheets (SDS), Certificates of Analysis (CoA), and business verification documents

Payment Security Note: We never store your payment card numbers, CVVs, or internet banking credentials on our servers. All payment transactions are handled directly through RBI-authorized Payment Aggregators (such as Razorpay and PayU) over 256-bit TLS encryption.

3. Who Else Processes Your Data (Data Processors)

We engage vetted service providers to run BidChemz infrastructure and fulfill chemical trade operations. Each provider processes data strictly under written contractual safeguards ensuring confidentiality and statutory compliance:

• Amazon Web Services (India) — Hosting, secure file storage, email and SMS delivery, and automated screening. Processing location: India (ap-south-1).
• ZeptoMail (Zoho) — Sending transactional email such as one-time passwords, critical trade alerts, and order confirmations. Processing location: India.
• Google — Sign-in with Google, where you choose to use it. Processing location: Global.
• Razorpay / PayU — Processing card, net banking and UPI payments. They collect payment credentials directly; we receive only the transaction result. Processing location: India.
• Cehpoint AI — The AI assistant, automated listing drafting, market price analysis and image relevance screening. Processing location: India.
• Alankit / Authorised KYC Providers — Verifying PAN, GSTIN and business registration against official government registries. Processing location: India.
• Google Analytics — Measuring page views and aggregated traffic patterns to improve site responsiveness. Processing location: Global.

Counterparty Trade Disclosure: In addition to infrastructure providers, your business contact details (name, company, verified phone number) are shared with an authorized counterparty only when you or they unlock an enquiry or finalize an auction contract. Your commercial credentials are never sold or broadcast to unauthorized third parties.

4. Data Retention & Storage Periods

We retain personal data only for as long as necessary to satisfy the purpose for which it was collected or to fulfill statutory obligations:

• Your account and everything on it: While your account is active
• An account left unused: Erased after 3 years without a sign-in or transaction. We notify you 48 hours before that happens, and signing in stops it
• Invoices, payments and tax records: 8 years after the financial year they belong to, as mandated by the Indian Income Tax Act and CGST Act. These survive an erasure request
• Audit logs of sensitive actions: 1 year
• One-time passwords (OTPs): Minutes — permanently deleted immediately upon use or expiration
• Everything else, after you ask for erasure: Removed or irreversibly anonymised within 30 days

5. Your Rights as a Data Principal

Under Chapter III of the Digital Personal Data Protection Act, 2023, you hold the following statutory rights:

• Ask what personal data we hold about you and who we have shared it with, and download a machine-readable copy.
• Have any inaccurate data corrected, any incomplete details completed, and any outdated information updated.
• Have your personal data erased when it is no longer required for the purpose for which you provided it.
• Name a nominee who can exercise your data privacy rights on your behalf in the event of death or incapacity.
• Lodge a grievance with our Grievance Officer and receive a formal reply within 30 days, or escalate to the Data Protection Board of India.

You can exercise all of these rights directly through the Your data & privacy console in your profile, including downloading an export of your account data, correcting contact details, naming a nominee, or submitting an erasure request.

6. Withdrawing Consent

You can withdraw an optional consent at any time from Your Data & Privacy in your profile — it takes one click, the same as giving it. Withdrawing a required consent that the marketplace cannot function without means closing your account, and we will clearly inform you before you confirm.

7. Minors & Children's Data

BidChemz is a specialized business-to-business marketplace strictly intended for registered business entities and commercial professionals. It is not intended for anyone under 18 years of age. We do not knowingly collect personal data from minors.

8. Security Safeguards & Breach Protocol

We employ industry-standard technical and organizational safeguards: passwords are cryptographically hashed using salted one-way algorithms; all web and API traffic is encrypted via TLS 1.3; role-based access controls limit internal staff permissions; and access to sensitive counterparty details is logged in immutable audit trails. In the unlikely event of a personal data breach, we will notify affected Data Principals and the Data Protection Board of India in accordance with the DPDP Act and regulatory timelines.

9. Grievance Redressal & Regulatory Escalation

If you have any questions, concerns, or grievances regarding the processing of your personal data, you may contact our designated Grievance Officer:

If our grievance resolution does not satisfy your complaint, you have the right under Section 13(3) of the DPDP Act to escalate your grievance to the Data Protection Board of India.

10. Notice Modifications & Updates

If we alter the purposes of processing, introduce new data categories, or onboard new data processors, we will notify you and present an updated notice for your consent. Minor administrative corrections will be reflected with an updated version timestamp on this page.