TradeOn — Trade Operating Network ("TON", "we", "our", or "us"), a trade name of YantrAdhigam Labs Private Limited, is committed to protecting your privacy and complying with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and all applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our platform and services.
1. Information We Collect
1.1 Personal Information
When you register on TradeOn, we collect personal information including your name, email address, phone number, and designation within your organization. This information is necessary to create and manage your account and to verify your identity.
1.2 Business Information
We collect business-related information including your organization name, GST Identification Number (GSTIN), PAN, CIN/LLPIN, business address, warehouse locations, bank account details, and KYC documents (such as certificates of incorporation, GST registration certificates, and authorized signatory documentation). This information is required for GST-compliant invoicing, KYC verification, regulatory compliance, and trade operations on the platform.
1.3 Transaction Data
We collect information about your transactions on the Platform, including orders placed, order history, invoices, payment records, GRN submissions, credit terms, and trade relationship data.
1.4 Usage Data
We automatically collect information about how you interact with the platform, including pages visited, features used, search queries, login timestamps, IP addresses, browser type, operating system, device information, and referring URLs. This data helps us improve our services and ensure platform security.
1.5 Communication Data
If you contact us via email, support tickets, or other channels, we retain the content of your communications and any attachments for support and record-keeping purposes.
2. Legal Basis for Processing
Under the DPDP Act, 2023, we process your personal data on the following lawful bases:
- Consent: Where you have given clear, informed consent for us to process your personal data for specific purposes (e.g., marketing communications).
- Performance of contract: Where processing is necessary for the performance of a contract to which you are a party, including providing Platform services, processing subscriptions, and fulfilling transactions.
- Legal obligation: Where processing is necessary to comply with applicable laws, including GST compliance, tax reporting, anti-money laundering regulations, and lawful requests from government authorities.
- Legitimate use: Where processing is necessary for legitimate business purposes as specified under the DPDP Act, including fraud prevention, platform security, and service improvement.
3. How We Use Your Information
- Service delivery: Providing and maintaining the Platform, processing orders and transactions, generating GST-compliant invoices, managing subscriptions, verifying deliveries, and facilitating trade relationships.
- Identity verification: Conducting KYC checks, verifying GSTIN and PAN, and validating business credentials.
- Communication: Sending transactional notifications (order updates, invoice generation, GRN alerts, payment reminders), service announcements, and platform updates. You can opt out of non-essential communications.
- Security & fraud prevention: Detecting, preventing, and investigating fraud, unauthorized access, security breaches, and other illegal or suspicious activities.
- Improvement: Analyzing aggregated and anonymized usage data to improve platform performance, develop new features, and enhance user experience.
- Legal compliance: Complying with applicable laws, regulations, legal processes, and government requests.
- Dispute resolution: Investigating and resolving disputes between users, responding to complaints, and facilitating grievance redressal.
4. Information Sharing & Disclosure
We do not sell your personal or business information to third parties. We may share your information in the following limited circumstances:
- Trade counterparties: Limited business information (organization name, GSTIN, address) is shared with your trade partners as necessary to facilitate transactions.
- Service providers: Trusted third-party service providers who assist us in operating the platform, including Razorpay (payment processing), cloud infrastructure providers, email delivery services, and analytics providers. These providers are contractually bound to protect your data and use it only for the services they provide to us.
- Legal requirements: Government or regulatory agencies as mandated under statutory enactment, including income tax authorities, GST authorities, law enforcement, or courts of law, for verification of identity, investigation of offences, or as otherwise required by law.
- Corporate transactions: In connection with any merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity, subject to appropriate data protection safeguards.
- With your consent: For any purpose not covered above, we will seek your explicit consent before sharing your personal data.
5. Data Security
We implement industry-standard technical and organizational security measures to protect your information, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure server infrastructure with regular security audits and vulnerability assessments
- Role-based access controls limiting data access to authorized personnel on a need-to-know basis
- Regular monitoring for unauthorized access, data breaches, or suspicious activity
- Secure authentication mechanisms including password hashing and JWT-based session management
- Regular data backups with encrypted storage
While we strive to use commercially acceptable means to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
6. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:
- Account data: Retained for the duration of your account plus 6 months after account deletion or termination.
- Transaction records & invoices: Retained for a minimum of 8 years as required under the Income Tax Act, 1961 and GST regulations.
- KYC documents: Retained for 5 years after the end of the business relationship, in line with regulatory requirements.
- Usage logs & analytics: Retained in anonymized/aggregated form for up to 3 years for platform improvement.
- Communication records: Retained for 2 years for support and dispute resolution purposes.
After the applicable retention period, data is securely deleted or irreversibly anonymized.
7. Cookies & Tracking Technologies
We use cookies and similar technologies to maintain your session, remember your preferences, and improve your experience on the platform:
- Strictly necessary cookies: Essential for platform operation, authentication, and session management. These cannot be disabled.
- Functional cookies: Remember your preferences such as language, portal settings, and display options.
- Analytics cookies: Help us understand how users interact with the platform to improve performance and usability. These are anonymized.
We do not use third-party advertising or behavioral tracking cookies. Third-party services integrated into the Platform (such as payment gateways) may set their own cookies, which are governed by their respective privacy policies.
8. Cross-Border Data Transfers
Your data is primarily stored on servers located in India. In the course of providing our services, your data may be transferred to and processed in jurisdictions outside India (for example, by our cloud infrastructure or analytics providers). Such transfers are made in compliance with the DPDP Act and applicable regulations, ensuring appropriate safeguards are in place. We will not transfer your personal data to any country restricted by the Central Government under the DPDP Act.
9. Your Rights (Data Principal Rights)
Under the DPDP Act, 2023 and applicable data protection laws, you have the following rights:
- Right to Access: Request confirmation of whether we process your personal data and obtain a summary of such data.
- Right to Correction: Request correction of inaccurate, incomplete, or misleading personal data.
- Right to Erasure: Request deletion of your personal data, subject to legal and contractual retention obligations.
- Right to Withdraw Consent: Withdraw consent for processing at any time. Note that withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal, and may result in discontinuation of certain services.
- Right to Nominate: Nominate any other individual to exercise your rights in the event of your death or incapacity, as provided under the DPDP Act.
- Right to Grievance Redressal: File a complaint regarding our data processing practices with our Grievance Officer or, if unsatisfied, with the Data Protection Board of India.
To exercise any of these rights, please contact our Grievance Officer at info@tradeon.in. We will respond to your request within 30 days.
10. Children's Data
TradeOn is a B2B platform intended for use by businesses and their authorized adult representatives. We do not knowingly collect or process personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete such data.
11. Data Breach Notification
In the event of a personal data breach that is likely to cause harm to data principals, we will:
- Notify the Data Protection Board of India as required under the DPDP Act;
- Notify affected data principals without unreasonable delay;
- Take immediate remedial action to contain and mitigate the breach;
- Maintain a record of all data breaches and actions taken.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable laws. We will notify you of any material changes by posting the updated policy on the platform, sending an email notification, and updating the "Last updated" date. Your continued use of TradeOn after such changes constitutes acceptance of the updated policy.
13. Grievance Officer
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, we have appointed a Grievance Officer:
Grievance Officer
Email: info@tradeon.in
Address: YantrAdhigam Labs Private Limited, A 601, The Capital, Science City Road, Sola, Ahmedabad, Gujarat 380060, India
The Grievance Officer shall acknowledge complaints within 24 hours and resolve them within 15 days of receipt in accordance with applicable regulations.
14. Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
Email: info@tradeon.in
Address: YantrAdhigam Labs Private Limited, A 601, The Capital, Science City Road, Sola, Ahmedabad, Gujarat 380060, India