Privacy Policy
Version 0.1 (in-house draft) · Effective date: [publication date — fill on go-live]
Data Fiduciary: Nexsol Infotech Private Limited (CIN U62099MR2026PTC474666) (brand “Kaarobari”), registered office Plot No 34/35, Ashtavinayak Nagar, Deopur, Dhule, Maharashtra 424002. Legal basis: Digital Personal Data Protection Act, 2023 + DPDP Rules, 2025; IT (Intermediary Guidelines) Rules, 2021; Consumer Protection (E-Commerce) Rules, 2020.
यह पेज ONDC Network Policy Chapter 2.3.3(k) + 2.4.6(b) के तहत तैयार किया गया एक कार्यशील draft है। अंतिम wording हमारे counsel की मंज़ूरी और ONDC (network.policies@ondc.org) के fitness-check के बाद ही final होगी। Production में जाने पर effective date यहाँ भरी जाएगी।
Plain-language summary: We collect only the data we need to run the marketplace, tell you why, keep it safe, and let you exercise your rights. We store data in India and (for some files) Singapore. We never sell your data.
1. Who we are
Kaarobari is an ONDC Retail marketplace operated by Nexsol Infotech Private Limited. For the data we decide the purpose and means of, we are a Data Fiduciary under the DPDP Act, 2023.
2. Personal data we collect
From Sellers: legal name, display name, mobile, email, PAN, GSTIN / GST enrolment number, bank account details, Aadhaar last-4 digits only (masked), business address.
From Buyers (relayed to us by the Buyer App for an order): name, delivery and billing address, phone, email — used only to fulfil the order.
Automatically: device/usage logs, IP address, cookies (see our Cookie Policy).
We collect only what is needed. We do not collect or store full Aadhaar numbers or any biometric data.
3. Why we process your data (purpose limitation)
- Seller KYC & onboarding, compliance, and payouts.
- Listing products on ONDC Buyer Apps and processing orders.
- Fulfilment, delivery coordination, returns, refunds, and settlement.
- Tax compliance (GST TCS, TDS), grievance handling, fraud prevention, and legal obligations.
Aadhaar last-4 is used only to corroborate KYC identity, nothing else.
4. Legal basis
- Consent (DPDP §6) — for seller KYC and related processing; taken by clear, affirmative, un-bundled action at signup.
- Legitimate use / fulfilment necessity (DPDP §7) — for buyer order data relayed to us to complete an order.
5. How we share data
- ONDC Buyer Apps (BAPs) — to receive and fulfil orders.
- Logistics partners (LSPs) — to deliver orders (Path A on-network).
- Payment / payout partner — to settle seller payments (currently manual bank transfer by us; future automated payout partner).
- Cloud processors — AWS (Mumbai, India) for our application and database; Cloudflare R2 (Asia-Pacific / Singapore) for document/file storage; MSG91 for OTP/SMS.
We bind each processor by a data-processing agreement. We do not sell personal data.
6. Cross-border transfer
Some service providers store or process data outside India: KYC/files on Cloudflare R2 (Singapore region); our servers and database are in AWS Mumbai (India). By using Kaarobari you consent to this international storage and processing. We transfer abroad only as permitted by Indian law and not to any country the Government of India restricts. Aadhaar-linked KYC fields are kept in India. Payment data is handled per RBI requirements by our payment partner.
7. Your rights (DPDP §§11-14)
You may: access a summary of your data and who we shared it with; correct/complete/update; erase (subject to legal retention); grievance redressal; and nominate another person to exercise your rights. To exercise any right, contact our Grievance Officer (clause 13) or use the request option in your account. We respond within the timeline in clause 13.
8. Withdrawing consent
You can withdraw consent as easily as you gave it, via your account settings or by contacting us. Withdrawal does not affect prior lawful processing, and some processing may continue where the law requires (e.g., tax records).
9. Data retention
| Data | We keep it for | Why |
|---|---|---|
| Seller KYC (PAN, GST, Aadhaar last-4, bank) | 8 years after the relationship ends | GST/Income-tax record-keeping (overrides DPDP erase) |
| Order, invoice & settlement records | 8 years | GST §36 + Income-tax |
| Buyer contact (name/phone/email/address) | Kept within the order record for the order itself, any dispute, and tax/legal compliance; the invoice retains name, address and a masked phone. We delete or anonymise it on a valid erasure request, subject to legal retention. | Orders, dispute defence + GST/Income-tax |
| Processing/audit logs | Kept while needed for security and legal defence (at least 1 year per DPDP Rule 8); deleted when no longer required. | Security & legal defence |
| OTP / auth attempts | Kept while needed for security and fraud prevention; deleted when no longer required. | Security |
| Consent records | Life of processing + 3 years | Proof of lawful basis |
10. Security
We use reasonable security safeguards (DPDP §8(5), Rule 6): encryption in transit and at rest, access controls, logging and monitoring, and contractual security obligations on our processors.
11. Personal data breach
If a breach occurs, we will notify each affected user without undue delay — describing the breach, likely consequences, what we have done, steps you can take, and a contact — and we will notify the Data Protection Board of India without delay, with a detailed report within 72 hours.
12. Children
The Platform is not directed at children under 18. We do not knowingly process children’s data or use it for tracking or targeted advertising.
13. Grievance Officer & escalation
Grievance Officer: Harshal Bhapkar, Nexsol Infotech, operations@nexsolinfotech.com, +91 9545372020, A1 Gulmohar Park, Dattanagar, Pune.
We acknowledge requests/complaints within 24 hours and resolve within 7 days (and within 30 days at the outer limit per the Consumer Protection (E-Commerce) Rules, 2020).
If unresolved, you may escalate to the Data Protection Board of India (contact as published by the Board).
(If we are later notified as a Significant Data Fiduciary, we will appoint and publish a Data Protection Officer.)
14. Changes
We may update this policy and will post the new version with a fresh effective date; material changes get prior notice.
15. Contact
operations@nexsolinfotech.com · Nexsol Infotech Private Limited, Plot No 34/35, Ashtavinayak Nagar, Deopur, Dhule, Maharashtra 424002.