Privacy Policy | Mining Mandi

1. Data we collect

Category	Examples
Account details	Name, phone number, email, preferred language, contact preference
Verification (KYC)	PAN number, GSTIN (if applicable), one government ID document (Aadhaar, Driving Licence, or Voter ID), company name and address
Transaction data	Listings, enquiries, orders, escrow and payout records, GST invoices
Uploaded files	Sample photos/videos, lab/assay reports, KYC documents — stored via our media provider (Cloudinary)
Operational data	For mining owners/supervisors: fuel, worker, machine, attendance, and petty-cash records entered into the ERP tools
Technical data	Log-in timestamps, device/browser information, and cookies described in our Cookie Policy

2. Why we collect it

To create and verify your account (KYC is mandatory before you can list, buy, or receive payouts).
To operate the marketplace — matching enquiries to suppliers, publishing verified listings, processing orders and payments.
To generate GST-compliant invoices for completed orders.
To contact you about your account, an enquiry, or an order — including by WhatsApp, where you or admin have provided a number for that purpose.
To meet our own legal and tax obligations as a registered business.

3. Who we share data with

We do not sell personal data. We share it only where necessary to run the platform:

Razorpay — to process payments and refunds for orders placed through the platform.
Cloudinary — to store uploaded photos, videos, reports, and KYC documents.
Email/WhatsApp providers (e.g. Brevo, AiSensy) — to deliver account notifications and, where enabled, automated WhatsApp messages about a matched enquiry.
Other users, selectively — a buyer's enquiry is shared with the seller(s) admin routes it to; a seller's public listing details are shown to buyers. KYC documents themselves are never shown to other users — only our verification team sees them.
Law enforcement or regulators, where required by law.

4. How long we keep it

We retain account and transaction data for as long as your account is active and for a reasonable period after (typically up to 7 years) to meet tax, accounting, and dispute-resolution obligations under Indian law. KYC documents are retained for the same period and are accessible only to our KYC review team and platform administrators. You may request earlier deletion of specific documents — see Section 6.

5. How we protect it

Access to KYC documents and personal data is restricted to authorised roles (KYC reviewers, platform admins) on a need-to-know basis. Passwords are never stored in plain text. Payment card and UPI details are handled entirely by Razorpay — Mining Mandi does not store your payment instrument details.

6. Your rights

Under the DPDP Act, you have the right to:

access a copy of the personal data we hold about you;
correct inaccurate or incomplete data;
request erasure of your data, subject to our legal/tax retention obligations above;
withdraw consent for optional communications (e.g. marketing messages) at any time; and
lodge a complaint with our Grievance Officer — see our Grievance Redressal page.

7. Contact

For any question about this policy or to exercise a right above, contact us via WhatsApp from our About & Trust page, or reach our Grievance Officer directly — details on the Grievance Redressal page.