BidOnBuy — Privacy Policy
This Privacy Policy explains how Sarvatman Infotech (OPC) Private Limited ("Company", "we", "us"), which operates BidOnBuy, collects, uses, stores and protects your personal data. It is written to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules under them. It forms part of our Terms and Conditions, and words defined there (such as Queue, Top Bidder and strike) have the same meaning here.
In short
We collect your name, email, phone number, KYC verification status and, if you agree, your location. We also keep your bids, credits, chats and eligibility records. We use them only to run BidOnBuy and to prevent hacking, fraud and malpractice. We never sell your data. We do not store your Aadhaar number or documents. We do not handle payments between Buyers and Sellers.
Who We Are
Sarvatman Infotech (OPC) Private Limited, with its registered office at Kondhave Dhawade, Pune, Maharashtra 411023, India, is the "Data Fiduciary" for the personal data you give us on the BidOnBuy website and application (the "Platform").
Personal Data We Collect
2.1 Data you give us
- Account details: name, email address and phone number.
- Content you create: listings (titles, descriptions, photos), bids and the messages you send in the Platform chat.
- Support messages: anything you send us by email, including refund-error requests and strike appeals.
2.2 KYC verification status
We use DigiLocker to verify identity. We do not collect or store your Aadhaar number or any Aadhaar document or image. We receive and keep only your verification status (for example, verified or not verified).
2.3 Location
Because BidOnBuy runs in defined local areas, we may collect your location (such as city, pincode or device location) with your consent, to confirm you can take part in a given auction.
2.4 Data collected automatically
- Platform activity: bids placed, auctions viewed or joined, your Queue position, chat windows opened, and whether you responded in time. For BidOnBuy Listings we also count bidder activity (for example, the number of bidders and bids) to decide whether a winner can be selected.
- Credit records: credits bought, used, restored, earned and expired, with purchase and expiry dates, plus any fines and negative balance.
- Eligibility records: Timeouts, Non-Responses, strikes, fines, suspensions, bans and any appeals or claims.
- Technical data: IP address, device and browser type, log data, and cookies or similar technologies (Section 11).
2.5 Payment information
Payments for credits are processed by a third-party payment provider. We do not store your card or bank details. We receive only confirmation of payment (status, reference and amount). We do not receive, hold or process any payment between Buyers and Sellers, and we offer no escrow or payment protection for them.
How We Use Your Data
We use your personal data only to:
- create and manage your account and identify you as a User;
- run auctions, rank bids, build the Queue and show bid activity;
- issue, track, expire and restore credits under the Terms;
- open the Seller-Bidder chat, run the four-hour windows, move the Queue and record outcomes;
- apply and review eligibility decisions, strikes and fines, and handle claims raised within 90 days;
- send service messages such as outbid alerts, auction start and end notices, chat and window notices, credit expiry reminders and receipts;
- detect, investigate and prevent hacking, fraud, shill bidding, multiple or false accounts and other malpractice, and ban Users where the Terms allow;
- respond to support requests, including refund-error requests;
- comply with legal obligations and respond to lawful requests from authorities; and
- keep the Platform secure and working properly.
We do not sell, rent or trade your personal data, and we do not use it outside the Platform.
Consent
We collect and use your personal data with your consent, which we ask for clearly before or when we collect it, and for other uses the DPDP Act allows, such as complying with the law. You can withdraw consent at any time by emailing privacy@bidonbuy.com. Withdrawing consent does not affect what we did before. If you withdraw consent that is needed to run your account, such as identity verification, we may not be able to keep providing parts of the Platform, and unused credits are forfeited as stated in the Terms (Section 4.9).
Who Can See or Receive Your Data
5.1 Other Users
Other Users can see what the Platform shows, such as the first letter of your name and your bid activity on a listing. The person you are in a chat with can see your messages. If a Seller declines you or a window ends, you may be shown to them only as "not selected"; the reason is not shared with other Bidders. We do not show your email or phone number to other Users.
5.2 Service providers
We use trusted providers for hosting, databases, real-time infrastructure, payment processing, identity verification (DigiLocker) and email or SMS messages. They may handle your data only to provide their service to us, under duties of confidentiality and security.
5.3 Legal and safety reasons
We may disclose data where the law requires it, to answer a court order or government request, or where reasonably needed to investigate or prevent fraud, hacking or other harm, or to protect our rights.
5.4 Business changes
If our business is restructured, merged or sold, your data may pass to the new owner, who must keep protecting it under this Policy.
We do not share your personal data in any other way.
Where Your Data Is Stored
Your data is stored with cloud providers whose servers may be in India or elsewhere. We take reasonable steps to keep it protected wherever it is processed and follow the DPDP Act's rules on transfers outside India.
How Long We Keep Your Data
We keep personal data while your account is active and afterwards only as long as needed for the purposes in Section 3 and for legal reasons. Typical periods are:
| Data | How long we keep it |
|---|---|
| Account details and KYC status | While the account is active, then 12 months |
| Bids, Queue and auction records | 24 months after the auction closes |
| Chat messages | 12 months after the chat ends, or longer if a report, appeal or legal request is open |
| Credit purchase and tax records | 8 years, as tax law requires |
| Strikes and eligibility records | 24 months after the last strike |
| Banned accounts (name, email, phone, KYC status) | Kept so the person cannot simply return, and to support legal action, along with any unpaid fine or negative balance |
When we no longer need data, we delete or anonymise it.
How We Protect Your Data
We use reasonable security safeguards, including encrypted connections, access controls and limits on which team members can see personal data. No system is completely secure, so we cannot promise absolute security, and you should keep your login details private. If a personal data breach affects you, we will tell you and the authorities as the DPDP Act requires.
Your Rights
Under the DPDP Act you may:
- get a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to erase it, unless we must keep it for a legal reason or for the fraud-prevention purposes in Section 7;
- withdraw your consent (Section 4);
- have complaints handled through our grievance process (Section 13); and
- nominate another person to exercise your rights if you die or cannot act for yourself.
To use a right, email privacy@bidonbuy.com from your registered email address. We will reply within 15 days. If you delete your account or withdraw consent needed to run it, you lose any unused credits, and strike records may be kept for the period in Section 7 to prevent abuse.
Children
BidOnBuy is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.
Third-Party Services
DigiLocker and our payment provider have their own privacy policies for the data they handle. We are not responsible for their practices, and encourage you to read their policies.
Grievance Officer and Contact
For a question, a complaint or to use your rights, contact our Grievance Officer. We will acknowledge within 48 hours and aim to resolve within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India under the DPDP Act.
Grievance Officer: Tushar (Grievance & Compliance Officer)
Email: privacy@bidonbuy.com
Address: Kondhave Dhawade, Pune, Maharashtra 411023, India
Changes to This Policy
We may update this Policy. For a material change, we will tell you through the Platform or by email. If you keep using the Platform after a change takes effect, you accept the updated Policy, except where the law requires us to ask for your consent again.