Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) explains how BioTradX, owned and operated by BioPlanet Green Technologies Pvt. Ltd. (“Company”, “we”, “us”, or “our”), collects, uses, stores, discloses, and protects personal data when you access or use our website (www.biotradx.com), web application, mobile application, or any related services through which buyers, sellers, manufacturers and affiliates trade used cooking oil, used engine oil, biomass, biofuel feedstock and other circular-resource materials (collectively, the “Service”).

This Policy is drafted to be consistent with:

• the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”); and
• the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and rules issued thereunder from time to time.

This Policy operates alongside our Terms & Conditions. Where this Policy addresses the handling of personal data specifically, it prevails over any general statement in the Terms & Conditions on the same point.

2. Your Consent

We process personal data only for lawful purposes, including providing the Service you request, verifying your identity, preventing fraud, ensuring platform security, meeting legal obligations, and other uses permitted under the DPDP Act. We will seek your consent, through a clear affirmative action (such as ticking a box, clicking “I agree”, or otherwise), before collecting or processing personal data for which consent is the applicable legal basis, and this Policy, together with the notice shown at the point of collection, constitutes the notice required under Section 5 of the DPDP Act.

By creating an Account, providing personal data, or otherwise using the Service, you confirm that you have read and understood this Policy. Where consent is the basis for processing, you may withdraw it at any time through your Account settings or by writing to support@biotradx.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may limit or end your ability to use features of the Service that depend on that data.

3. Definitions

4. Personal Data We Collect

4.1 Information you provide

• Name, mobile number and email address
• Business name, GST number and business address
• PAN and Aadhaar-linked verification details, collected only for KYC purposes as described in Section 8
• Bank account details and/or UPI ID, for payment settlement and escrow-based transactions
• Address details and precise or approximate location, where you permit it, for buyer-seller discovery, logistics and delivery tracking
• RFQ details, listing details, specifications, pricing and quality terms you enter on the Service
• Content of in-app chat or negotiation messages exchanged with counterparties through the Service
• Referral, onboarding and payout information, where you register as an Affiliate

4.2 Information collected automatically (Usage Data)

• Device IP address, browser type and version, device identifiers and operating system
• Location data, where permitted, obtained via the Google Maps API
• Pages and features visited, time and duration of visits, and other diagnostic data
• For mobile access: device type, unique device ID, mobile operating system and mobile browser type

4.3 Information generated through platform activity

• Trade, transaction and dispatch/delivery history
• Escrow payment status and settlement records
• Aggregated figures used to generate CO₂ reduction estimates and other ESG/impact insights linked to your trades (see Section 13)

5. Third-Party Services Involved in Collection and Processing

We work with the following categories of Service Providers, who process personal data on our instructions and only to the extent necessary to perform their function:

• KYC/verification providers: verify PAN, GST and Aadhaar-linked details; only masked or tokenised information is processed, and full Aadhaar or PAN numbers are not retained by the Company (see Section 8).
• Payment gateway and escrow provider: process transaction amount, UPI/bank reference and counterparty details to hold and release funds on trade completion. Card and full bank credentials are handled by the gateway/escrow provider directly and are not stored by us.
• Logistics and delivery partners: receive name, contact number, address and dispatch/delivery status needed to fulfil a trade.
• SMS/OTP and communication providers: deliver authentication codes and service notifications.
• Cloud hosting provider (AWS): stores platform data as described in Section 10.
• Maps and location provider (Google Maps API): supports location-based discovery and logistics, only where you permit location access.

We may appoint or change Service Providers from time to time. Each Service Provider receives only the data necessary to perform its function and is contractually required to protect it in line with applicable law.

6. Legal Basis for Processing

We process personal data on one or more of the following bases recognised under the DPDP Act:

• Consent: where you have given specific, informed consent for a stated purpose (for example, precise location access or promotional communications).
• Voluntary provision for a specified purpose: where you voluntarily provide data for a purpose and have not indicated that you do not consent to its use – for example, submitting an RFQ or listing.
• Performance of a contract: to create and manage your Account, execute trades, process escrow payments and fulfil deliveries.
• Compliance with law: for KYC, tax, GST, accounting and other statutory obligations, and to respond to lawful requests from government or judicial authorities.
• Legitimate uses permitted under Section 7 of the DPDP Act: including fraud prevention, platform and network security, and responding to a medical emergency or a threat to life, where applicable.

7. How We Use Personal Data

• To provide, operate and maintain the Service, including Account management and registration
• To process RFQs, listings, negotiations, trade execution, escrow payments and delivery/dispatch tracking
• To perform KYC/verification and meet regulatory, tax and audit obligations
• To communicate with you by email, call, SMS or in-app notification about your Account, trades or Service updates
• To send promotional or marketing communications, only where permitted by law or with your consent, and always with an opt-out (see Section 15)
• To detect, investigate and prevent fraud, and to maintain platform security
• To generate aggregated trade, pricing and CO₂/ESG impact insights (see Section 13)
• To manage Affiliate referrals, tracking and payouts
• To analyse usage trends and improve the Service
• In connection with a merger, acquisition or asset sale (see Section 11)

8. Aadhaar and Sensitive Financial Information

PAN, GST and Aadhaar-linked details fall within “sensitive personal data or information” under the SPDI Rules and are subject to additional safeguards:

• We collect Aadhaar-linked information only for identity verification through a licensed KYC/verification partner, and only to the extent that partner's authorisation permits.
• The Company does not store full Aadhaar numbers or PAN numbers in its own databases. Only a verification status, masked reference (e.g. last 4 digits) and/or a non-reversible reference token are retained, as permitted by law.
• Aadhaar data is handled in accordance with the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and applicable UIDAI circulars, including restrictions on which entities may collect, store or use Aadhaar numbers.
• Sensitive card and full bank account data are collected and stored solely by our payment gateway/escrow provider, not by the Company.

9. Sharing and Disclosure of Personal Data

We may share personal data with:

• Service Providers: as listed in Section 5.
• Counterparties: Buyers, Sellers and Manufacturers receive the data necessary to negotiate and execute a trade with each other (e.g. business name, contact details, delivery address, trade terms).
• Government and regulatory authorities: where required by law, regulation, or a valid court or governmental order.
• With your consent: for any other specific purpose you have agreed to.
• Business transfers: in connection with a merger, acquisition, financing or asset sale, subject to Section 11.

10. Data Storage, Hosting and Retention

10.1 Hosting

Platform data is stored on secure servers hosted by Amazon Web Services (AWS). Where technically and operationally feasible, data is stored within the India region, consistent with applicable data localisation expectations.

10.2 Sensitive data

As set out in Section 8, Aadhaar, PAN and GST details are used only for verification and are not retained in our databases beyond a verification status and masked reference.

10.3 Transactional and financial records

Invoices, payment records, trade history, contracts and financial documents are retained for seven (7) to eight (8) years, in line with the Companies Act, 2013, the Income Tax Act, 1961, and GST law.

10.4 Deletion, anonymisation and withdrawal of consent

Data no longer required for its original purpose, or for which consent has been withdrawn, is deleted, anonymised, or securely archived, except where retention is required by law (e.g. financial or compliance records), in which case it is kept in a restricted-access environment until the retention period expires.

10.5 Cross-border transfer

Where data is processed outside India by a global Service Provider, the transfer will comply with the DPDP Act (including any country-specific restrictions notified by the Central Government), contractual safeguards, and industry-standard security measures.

11. Disclosure in Business Transactions and to Law Enforcement

11.1 Business transactions

If the Company is involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction. We will give notice before your data is transferred and becomes subject to a different privacy policy.

11.2 Law enforcement and other legal requirements

We may disclose personal data where required to comply with a legal obligation, to protect the Company’s rights or property, to investigate possible wrongdoing connected with the Service, to protect the personal safety of users or the public, or to defend against legal liability.

12. Data Security Measures

• Encryption: SSL/TLS for data in transit and AES-256 for data at rest.
• Access control: Role-Based Access Control (RBAC) so only authorised personnel access specific categories of data.
• Network and infrastructure security: firewalls, secure login protocols, intrusion detection and AWS cloud security controls.
• Monitoring and audits: regular security audits, vulnerability assessments and penetration testing.

No method of transmission or electronic storage is completely secure, and while we apply industry-standard safeguards, the Company cannot guarantee absolute security of data.

13. Automated Processing and Impact Analytics

The Service uses automated features to support buyer-seller matching, pricing visibility, quality/verification signals, and to generate CO₂ reduction and other ESG impact estimates from your trade data. These features support your use of the Service and inform the figures shown on your dashboard; they do not make legally or similarly significant decisions about you (such as denying your Account) without the ability to contact us for a review at support@biotradx.com.

14. Your Rights as a Data Principal

• Right to access: request a summary of the personal data we hold about you and the processing activities carried out.
• Right to rectification: request correction or completion of inaccurate or incomplete data.
• Right to erasure: request deletion of data that is no longer necessary for the purpose it was collected for, subject to our legal retention obligations.
• Right to withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to nominate: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to grievance redressal: raise a complaint about how we handle your personal data (see Section 17).

You may exercise these rights by writing to privacy@biotradx.com. We will acknowledge your request and aim to respond within the timelines prescribed under applicable law.

15. Cookies, Tracking and Marketing Communications

15.1 Cookies

• Authentication and session management (login, Account access)
• Preference storage (language settings, saved filters)
• Analytics and performance monitoring (traffic, interaction, error trends)

You may disable cookies through your browser settings; doing so may limit some functionality of the Service.

15.2 Marketing communications

We send promotional or marketing messages only where permitted by law or with your consent, and in a manner consistent with TRAI's Telecom Commercial Communications Customer Preference Regulations, including honouring National Do Not Disturb (DND) registrations where applicable. You may opt out of promotional communications at any time through your Account settings or by writing to support@biotradx.com.

16. Data Breach Notification

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, describing the nature of the breach, its likely consequences, and the measures taken or proposed to address it and mitigate any adverse impact.

17. Grievance Redressal and Data Protection Officer

In line with Rule 5(9) of the SPDI Rules and Section 13 of the DPDP Act, the Company has appointed the following Grievance Officer:

Grievances relating to data processing or privacy will be acknowledged and resolved within the timelines prescribed under applicable law.

18. Children's Privacy

The Service is intended for individuals aged 18 years and above. We do not knowingly collect, process, or store personal data of individuals under 18. If you believe a minor has provided personal data to us, please contact us so we can arrange prompt deletion.

19. Governing Law and Changes to This Policy

This Policy is governed by the laws of India, and courts at Hyderabad, Telangana shall have exclusive jurisdiction over any dispute arising from it, without prejudice to any dispute resolution mechanism set out in our Terms & Conditions.

We may modify or update this Policy at any time to reflect changes in law, technology, or business practice. Updates will be posted on the website and/or mobile application with a revised “Last Updated” date. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

20. Contact Us