Last updated: 1 January 2026 · Version: v2026.2
This Privacy Policy describes how Bael Trade (“we”, “us”, “our”, “Company”) collects, uses, stores, and processes your personal data in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act), the IT Act 2000 (Section 79), Consumer Protection (E-Commerce) Rules 2020, and UIDAI Aadhaar guidelines.
By using our platform you confirm that you have read and agree to this policy. This policy applies to all users — Sellers, Buyers, and visitors.
| Category | Data Points | Legal Basis (DPDP) |
|---|---|---|
| Identity | Name, email, mobile, password hash | §7(a) — Contract performance |
| Business (Seller) | GST Number, PAN, IEC, Udyam, company name | §7(b) — Legal obligation (GST Act, FEMA) |
| Aadhaar | Last 4 digits ONLY — full Aadhaar never stored | UIDAI circular — minimal data principle |
| KYC Documents | Photos/scans of certificates (encrypted at rest) | §7(b) — Legal obligation (PMLA 2002) |
| Transaction | Orders, payments, invoices, wallet balance | §7(b) — Legal obligation (IT Act, GST Act) |
| Usage | Pages visited, search queries, click events | §6 — Explicit consent (Analytics) |
| Communications | Messages, enquiries, support tickets | §7(a) — Contract performance |
| Technical | IP address, device type, browser, session tokens | §7(a) — Essential for security |
§11 — Right to Information
Know what data we hold about you and how it is used.
§12 — Right to Correction
Correct inaccurate or incomplete personal data.
§12 — Right to Portability
Download a copy of all your data as JSON.
§13 — Right to Erasure
Delete your account and anonymize personal data (financial records retained per GST law).
§6 — Right to Withdraw Consent
Withdraw non-essential consents at any time.
§13 — Right to Grievance
Lodge complaints with our Grievance Officer (72h SLA).
We do not sell your personal data. We share data only in the following circumstances:
Cross-Border Data Transfer (DPDP Act §16): Our primary database is hosted with Supabase on AWS infrastructure in Singapore (ap-southeast-1 region). Uploaded files (product images, KYC documents, invoices) are stored on Cloudflare R2, served via a global CDN edge network. Under §16 of the DPDP Act 2023, personal data may be transferred outside India to any country except those specifically restricted by the Central Government — no such restriction currently applies to Singapore. All data in transit is encrypted (TLS 1.3) and PII fields are encrypted at rest (AES-256-GCM) regardless of storage location.
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Account / Profile PII | Until deletion request, then anonymized | DPDP Act §13 |
| Financial records (invoices, GST) | 7 years from transaction date | GST Act §36, IT Act |
| KYC documents (raw scans) | Until account deletion, then hard-deleted | UIDAI guidelines |
| Audit logs | 7 years | IT Act §7A |
| Consent records | Lifetime of account + 3 years | DPDP Act §6 |
| Session tokens | Until logout or 7 days, whichever first | Security requirement |
| Analytics data (anonymized) | 2 years, fully aggregated | With explicit consent |
Our platform is intended for businesses only. We do not knowingly collect personal data from individuals under 18 years of age. If you are under 18, please do not use this platform or provide any personal information.
We may update this policy to reflect changes in law or our practices. Material changes will be notified via email and in-app notification at least 15 days before they take effect. Your continued use after the effective date constitutes acceptance.
Appointed under the Digital Personal Data Protection Act 2023. You may approach the Grievance Officer for any complaint or query regarding your personal data. A response will be provided within 72 hours as mandated by law.
Suresh
Grievance Officer
+91 88070 06649
Bael Trade, 1/412A, Annai Kavitha Illam, Krishnagiri — 635206, Tamil Nadu, India