Privacy Policy

We collect the following categories of data:

• Account data: Name, email address, mobile number, role, and account status provided at registration.
• Business profile data: Company name, GSTIN, PAN, Udyam/MSME registration number, business type, registered address, city, state, pincode, contact person name, and designation.
• Statutory documents: Files uploaded to your Document Vault (PAN Card, GST Certificate, DSC details, ITR, Balance Sheets, work orders, completion certificates, and other tender-related documents).
• Tender preferences: Categories, keywords, states, departments, and value ranges you configure for matching.
• Transaction data: Package purchases, payment amounts, GST components, gateway payment IDs, and invoice numbers. We do not store full card numbers or bank account credentials.
• Usage data: Pages visited, actions taken (tender selections, document uploads, status changes), IP address, browser type, and session timestamps.
• Support communications: Messages exchanged in support tickets.

Documents uploaded to your Vault are stored on encrypted cloud infrastructure. We apply the following controls:

• Files are encrypted at rest using AES-256 and in transit over TLS 1.2+.
• Access is restricted by role: only your assigned operator and authorised admin staff can view your documents during active filing tasks. No other client can access your data.
• All access events are logged with actor ID, timestamp, and IP address.
• We perform periodic security reviews and penetration tests. Discovered vulnerabilities are patched on a severity-based timeline.
• We do not share your uploaded documents with any third party except as required to complete the filing (e.g., submitting to the relevant government portal) or as compelled by law.

Your data is used exclusively to:

• Authenticate your account and personalise your dashboard experience.
• Match and surface relevant tenders based on your stated preferences.
• Enable operators to prepare, verify, and submit tender filings on your behalf.
• Generate GST-compliant invoices and process payments.
• Send transactional notifications (deadline alerts, status updates, document requests, payment receipts).
• Provide customer support and resolve disputes.
• Detect and prevent fraud, abuse, or unauthorised access.
• Comply with applicable Indian laws, regulatory requirements, and court orders.

We do not sell your personal or business data to third parties. We do not use your data for targeted advertising.

Payments are processed by our third-party payment gateway, PayU. When you make a payment you are subject to the gateway's own privacy policy and PCI-DSS compliance obligations.

• We receive from the gateway only: transaction status, gateway-assigned payment ID, and the last four digits of the instrument used (where provided by the gateway).
• Full card, UPI, or net banking credentials are entered on the gateway's secure interface and are never transmitted to or stored by our servers.

We use cookies and similar technologies to operate the platform:

• Strictly necessary cookies: Session management and CSRF protection. These cannot be disabled without breaking the Service.
• Functional cookies: Remembering your language and interface preferences.
• Analytics: Aggregated, anonymised usage data to improve platform performance. We do not use cookies to identify individual behaviour for advertising.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies does not affect core platform functionality.

We retain your data for as long as your account is active and for a period thereafter as follows:

• Account and profile data: Retained for 3 years after account closure to fulfil statutory obligations and respond to legal claims.
• Documents (Vault): Retained for 5 years after upload, in line with typical government procurement audit windows.
• Payment records and invoices: Retained for 8 years as required under the GST Act and Income Tax Act.
• Activity logs: Retained for 2 years, then automatically purged.
• Support tickets: Retained for 3 years after closure.

After the applicable retention period, data is securely deleted or anonymised.

Under applicable Indian data protection law and our internal policy, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request deletion of data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Portability: Receive your account and profile data in a structured, machine-readable format.
• Withdraw consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time.

To exercise any of these rights, submit a request to privacy@accuratetender.com. We will respond within 30 days.

In the event of a data breach that is likely to result in a risk to your rights, we will notify affected users within 72 hours of becoming aware of the breach, including a description of the nature of the breach, the data affected, and the steps we are taking to address it.

For any privacy-related questions, complaints, or requests, contact our designated Data Protection Officer:

• Email: privacy@accuratetender.com
• Post: Data Protection Officer, Uminber Designs, Ahmedabad, Gujarat, India

If your concern is not resolved within 30 days, you may escalate to the applicable regulatory authority.