Privacy & DPDP Notice

01Who processes your data

The Data Fiduciary for all personal data described in this notice is Namami Traders (sole proprietorship of Saurav Gupta), trading as Namami B2G, of Old Katra, Prayagraj 211002, Uttar Pradesh, India, GSTIN 09BMLPG1564P1ZG, Udyam registration UDYAM-UP-03-0114498.

This notice is served under section 5 of the Digital Personal Data Protection Act, 2023. It is available in English on this page. If you would prefer it in Hindi or another language listed in the Eighth Schedule to the Constitution, write to support@namamib2g.com and we will provide it.

02What we collect

From every account holder: full name, email address, mobile number, firm name and firm address.

For onboarding and verification: GSTIN, PAN, Udyam registration number, GeM seller identifier, Director Identification Numbers where the firm is a company, and scanned copies of the KYC documents you upload — incorporation or registration certificate, GST certificate, Udyam certificate, cancelled cheque and authorised-signatory identity proof.

For service contracts only: EPF and ESI establishment codes, and the statutory return filings you upload as evidence.

From the public enquiry form: the name, email, phone number and message you type, together with a hashed form of your IP address used solely to detect automated abuse.

From the tender-alert sign-up: your email address; the state and tender category you choose; your mobile number, only if you tick the separate WhatsApp box; the date, time and wording version of each consent you give; the page and campaign tags that brought you to the form; a hashed form of your IP address used solely to detect automated abuse; and the date you unsubscribe.

Automatically: authentication session data, and server logs recording the pages requested and the time of the request.

We do not collect financial account numbers or card details. Payments are taken by Razorpay on its own infrastructure and we receive only the payment identifier and its status.

03Why we collect each item, and nothing more

Name, email and mobile number: to create and secure your account, to send transactional notices about your authorisations and invoices, and — where you have separately opted in — to send tender alerts by WhatsApp and email.

GSTIN, PAN, Udyam number, GeM seller identifier, DINs and uploaded KYC documents: to verify that your firm exists, is registered as it claims, and is eligible to be recorded as a channel partner, and to satisfy a manufacturer’s own vetting before it appoints you.

EPF and ESI establishment codes and return filings: to operate the statutory compliance calendar you have engaged us for.

Enquiry-form data: to reply to your enquiry.

Tender-alert sign-up data: to send the tender alerts you asked for and, where you ticked the WhatsApp box, to contact you on WhatsApp — as set out in the next section.

Session and log data: to keep the platform secure and to investigate faults.

We do not use any of this data for any other purpose, we do not sell it, and we do not disclose it for advertising.

04Tender alerts and WhatsApp communication

When you sign up for tender alerts, we use your email address and the state and category you choose for one purpose: to email you a regular digest of GeM and CPPP tenders that match those choices.

WhatsApp is a separate, optional consent. Only if you tick the WhatsApp box do we use your mobile number, and then only to send you tender alerts on WhatsApp and to contact you on WhatsApp about Namami B2G’s bid-support services. A number typed without that tick is not stored.

WhatsApp messages are sent only through the official WhatsApp Business Platform (Cloud API) operated by Meta Platforms. We do not use unofficial WhatsApp tools, automated personal WhatsApp accounts or bulk-messaging software.

You can stop at any time, and stopping is as easy as signing up. Every alert email carries an unsubscribe link: one click stops all tender alerts for that subscription — by email and by WhatsApp — with no login and no questions asked. On WhatsApp, reply STOP to any message from us and we will stop messaging that number. You can also write to the Grievance Officer named below.

We record the date and time of each consent you give, the version of the wording you agreed to, and the date you unsubscribe, so that we can show what you agreed to and when you withdrew it.

05Legal basis, and withdrawing consent

We process personal data on the basis of your consent, given when you create an account, upload a document, submit the enquiry form or subscribe to tender alerts. Where processing is necessary to perform a contract you have already entered into with us, we rely on that contract.

You may withdraw consent at any time by writing to support@namamib2g.com, and for tender alerts also by using the unsubscribe link in any alert email or by replying STOP on WhatsApp. Withdrawal is as easy as giving consent and costs nothing.

Withdrawing consent ends tender alerts, ends authorisation administration, and may make it impossible for us to continue an engagement. It does not affect processing already carried out, and it does not erase records we are required to retain under tax or company law.

06How long we keep it

Enquiry-form submissions: 24 months from submission.

Tender-alert subscriptions: for as long as you stay subscribed. After you unsubscribe we stop all alerts at once, and keep only your email address, the consent and unsubscribe dates and the consent wording version, for one year, solely to show the consent and its withdrawal; they are then erased on review.

Public authorisation-verification records: 180 days from the verification request.

Account, KYC and authorisation records: for the life of your engagement and for eight years afterwards, which is the period we are required to retain books and supporting records under Indian tax law.

Statutory compliance evidence for service contracts: for the retention period the relevant labour statute prescribes for those records.

These periods are recorded against each record in our database. Erasure today is carried out on your request and on periodic review by us; we do not currently run an automated deletion job, and we will not claim one until we do.

07Where your data is held, and who else touches it

Supabase, on Amazon Web Services in the ap-south-1 (Mumbai) region, hosts our database and the private storage bucket holding your uploaded documents.

Vercel hosts the website and the application. Request logs may be processed outside India.

Razorpay processes payments and receives the identity and contact details required to raise an invoice and complete a transaction.

Meta Platforms, through the WhatsApp Business Cloud API, receives your mobile number and the content of each message, only where you have ticked the WhatsApp box on the tender-alert form.

Brevo (Sendinblue SAS), our email-delivery provider, receives your email address and the content of each tender-alert email in order to deliver it. This processing may take place outside India.

Google, through Google Sheets and the Gemini API, and Groq, through its Llama 3 API, process enquiry-form data (name, email, phone number and message) to draft a first-touch reply for our marketing pipeline. These replies are staged for our review before anything is sent to you.

Each of these is engaged as a processor under a contract. We remain accountable to you for what they do with your data. We do not transfer personal data to any other third party except where compelled by law.

08Your rights, and how to use them

You have the right to obtain a summary of the personal data we hold about you and of how it is being processed; to have inaccurate or incomplete data corrected or completed; to have data erased where it is no longer needed for the purpose it was collected for and we are not required to keep it; to nominate another individual to exercise these rights if you die or become incapacitated; and to have a grievance addressed.

To exercise any of them, write to support@namamib2g.com from the email address on your account, stating which right you are exercising. We will acknowledge within 48 hours and respond substantively within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

09Grievance Officer

Grievance Officer: Saurav Gupta, Proprietor. Email: support@namamib2g.com. Address: Old Katra, Prayagraj 211002, Uttar Pradesh, India.

Grievances are acknowledged within 48 hours and answered within 30 days.

10How we protect it

Every database table enforces row-level security, so a signed-in user can read only the rows belonging to their own firm. Uploaded documents are held in a private bucket with per-user path policies and are never publicly addressable.

Data is encrypted in transit using TLS and encrypted at rest by the hosting provider. The database has point-in-time recovery enabled and is backed up daily.

Access to production data is limited to the proprietor. We do not hold your GeM password or your Digital Signature Certificate in this platform.

11If there is a breach

If personal data we hold is breached, we will notify the Data Protection Board of India and every affected person without undue delay and within the period the law prescribes, describing what happened, what data was involved, what we have done about it, and what you should do.

12Children

This service is for businesses and the people who run them. It is not directed at anyone under 18, and we do not knowingly collect personal data from a child. If you believe a child has given us personal data, write to support@namamib2g.com and we will erase it.

13Changes to this notice

The effective date at the top of this page is the date of the current version. Where a change materially affects how we use your personal data, we will notify you by email before it takes effect.