Privacy & Data Protection Policy

At Bid Auctioneers (accessible at www.bidauctioneers.com), safeguarding the proprietary commercial data of buying organizations and the confidential quotes of suppliers is our foundational priority. This Privacy Policy details our operational protocols for collecting, storing, processing, and safeguarding business data in full alignment with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

1. Scope & Enterprise Commitment

This policy applies to all registered enterprises, procurement officers, asset disposition managers, participating vendors, bidders, and visitors across our public web portal, specialized SaaS bidding consoles, customer ERP connectors, and mobile-optimized interfaces.

2. Categories of Information Collected

We collect only the essential business information necessary to execute secure, legally enforceable e-auctions:

• Corporate Registration & KYC Information: Entity name, registered address, Goods and Services Tax Identification Number (GSTIN), Permanent Account Number (PAN), corporate identity numbers (CIN), authorized signatory names, corporate email addresses, and phone numbers.
• Banking & Financial Settlement Data: Bank account numbers, IFSC codes, cancelled cheques, and RTGS payment receipts provided solely for Earnest Money Deposit (EMD) verification and refund processing.
• Commercial Auction Records: Dynamic bid submissions, ceiling/reserve benchmarks, baseline prices, RFQ technical questionnaires, bill of materials (BOM), and digital negotiation transcripts.
• Technical Telemetry & Audit Logs: Timestamped IP addresses, network port information, browser signatures, operating system characteristics, and connection latency records recorded to verify anti-collusion integrity.

3. Non-Disclosure & Confidentiality of Live Bids

We recognize that live pricing information represents vital trade secrets for both buyers and competing suppliers:

Post-event audit reports disclosing full commercial bid histories are delivered exclusively to the authorized Host enterprise who organized the event.

4. Purpose and Legal Basis for Processing

All data processed by Bid Auctioneers is executed under lawful contractual and commercial mandates, specifically:

• To configure, host, and calculate live forward auctions, reverse auctions, and sealed-bid RFQ rounds.
• To enforce strict mathematical bid decrement and increment validation rules with real-time server synchronization.
• To generate tamper-evident audit trails and analytical post-auction summary reports for enterprise compliance committees.
• To verify corporate KYC documentation, validate bidder eligibility, and process Earnest Money Deposit (EMD) refunds.
• To transmit critical event notifications, password reset tokens, and dynamic overtime alerts via SMS, WhatsApp, and encrypted email.

5. Data Security, 256-Bit SSL & Encryption

Bid Auctioneers maintains rigorous technical, administrative, and physical security measures:

• In-Transit Encryption: All communications between user web browsers and our bidding engine are protected using modern TLS 1.3 / 256-bit SSL encryption protocols.
• Data at Rest: Database records, including passwords, authorization tokens, and bank account credentials, are protected using salted cryptographic hashes (e.g. bcrypt/SHA-256) and AES-256 database-level encryption.
• Role-Based Access Control (RBAC): Administrative access to client database instances is strictly segregated and restricted to vetted engineering personnel on a least-privilege, need-to-know basis.
• Real-Time Disaster Recovery: Automated geo-redundant database backups ensure zero data loss in the event of local infrastructure disruptions.

6. Cloud Infrastructure & Sub-Processors

Our cloud infrastructure is hosted in premier, SOC 2 and ISO 27001 certified data center facilities located within the territory of India to guarantee digital data sovereignty. When integrating with external enterprise systems (such as SAP, Oracle, Microsoft Dynamics) or SMS/Email delivery gateways, all payload transmissions are authenticated via secure API keys and bearer tokens.

7. Data Retention & Archival Policies

Commercial auction logs, submitted bid histories, and KYC records are retained for a minimum period of 7 (seven) years in compliance with Indian corporate record-keeping, GST audits, and statutory tax obligations. Following the expiration of statutory retention windows, archived logs are permanently shredded or cryptographically scrubbed from active storage.

8. Rights under Digital Personal Data Protection Act, 2023

In accordance with the DPDP Act 2023, data principals (individual contacts representing corporate entities) possess the following rights:

• Right to Access & Summary: Request an overview of personal identification data retained in our system.
• Right to Correction & Updating: Request the correction of inaccurate contact numbers, email addresses, or bank details.
• Right of Grievance Redressal: Submit privacy concerns directly to our designated Grievance Officer for expedited review within statutory deadlines.

9. Cookie Policy & System Telemetry

We utilize strictly necessary session cookies to maintain authenticated login sessions, track dynamic countdown latency, and prevent Cross-Site Request Forgery (CSRF). We do not deploy third-party advertising cookies or cross-site tracking pixels that profile your activities outside our bidding ecosystem.

10. Grievance Redressal Officer Contact Details

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act 2023, the details of our designated Grievance Redressal Officer are as follows: