Privacy Policy

1. Introduction

This Privacy Policy is published by Sourcerightnow E-commerce Pvt Ltd (CIN: U47912DL2026PTC463285), having its registered office at A-56, Naraina Industrial Area, Phase - 1, New Delhi - 110028 ("Company", "we", "us", or "our"). It describes how we collect, use, share, and protect personal data when you access or use the sourcerightnow.com platform ("Platform"). This policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (to the extent in force).

2. Information We Collect

We collect information you provide directly, such as your name, email address, phone number, company name, GSTIN, and business address when you create an account. When you make a payment, we collect billing details such as your billing address and the payment method selected (e.g., credit/debit card type, last four digits of card number, UPI ID, or net banking provider). We do not store full card numbers, expiry dates, or CVV — these are processed and tokenized by our payment partners (see Section 5). We also collect information automatically when you use the Platform, including your IP address, browser type, device information, pages visited, and interactions with the Platform. If you are a seller, we collect product listing data, pricing information, and business verification documents.

3. How We Use Your Information

We use your information to: (a) provide, maintain, and improve the Platform; (b) process transactions and facilitate communication between buyers and sellers; (c) verify your identity and business credentials; (d) send you transactional notifications, such as quote updates, order confirmations, and account alerts; (e) analyze usage patterns to improve user experience; (f) detect and prevent fraud, abuse, and security incidents; and (g) comply with legal obligations, including GST and tax reporting requirements.

4. Information Sharing

We do not sell your personal information. We may share your information with: (a) other Platform users as necessary to facilitate transactions (e.g., sharing seller contact details with a buyer who has placed an order); (b) payment processors, including Razorpay and PayPal, to process your transactions (see Section 5 for details); (c) other service providers who assist us in operating the Platform, such as hosting and analytics partners; (d) law enforcement, regulatory authorities, or the Reserve Bank of India when required by law; and (e) professional advisors such as auditors, lawyers, or accountants. All third-party service providers are bound by data processing agreements.

5. Payment Processing

We use third-party payment processors to handle transactions on the Platform. Your payment data is subject to the following:

• Razorpay: Razorpay Solutions Pvt Ltd acts as our payment aggregator for domestic transactions. When you make a payment, your card and payment details are collected and processed directly by Razorpay under its PCI DSS-compliant infrastructure. We do not receive or store your full card number, expiry date, or CVV. Card data is tokenized in accordance with the Reserve Bank of India's guidelines on card-on-file tokenization. Razorpay's processing of your data is governed by Razorpay's Privacy Policy.
• PayPal: For certain transactions, PayPal (PayPal Pte. Ltd. and its affiliates) processes your payment. PayPal is an independent data controller for personal data it processes in connection with providing payment services. You may learn more about PayPal's data practices and exercise your data subject rights in connection with PayPal's payment processing by reviewing the PayPal Privacy Statement.
• No card data storage: In compliance with RBI regulations, we do not store full card numbers, expiry dates, or CVV/CVC codes on our servers. All sensitive payment data is handled exclusively by our PCI DSS-compliant payment partners in tokenized form.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. Specific retention periods include: user account data is retained until you request deletion; chat messages are retained for 90 days then archived; search and activity logs are retained for 30-90 days then deleted; quote and order documents are retained for 7 years to comply with tax requirements; OTP codes expire after 5 minutes; and session data expires after 24 hours. After the retention period, data is either deleted or anonymized.

7. Your Rights

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023 (to the extent in force), you have the following rights regarding your personal data:

• Right to Access: Request a summary of your personal data and the processing activities related to it.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw your consent to processing at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
• Right to Nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, as provided under the DPDP Act.

To exercise any of these rights, contact us at support@sourcerightnow.com. We will acknowledge your request within 2 working days and respond within 30 days.

8. Data Security

We implement appropriate technical and organizational security measures to protect your data, including: encryption of data in transit (TLS) and at rest; password hashing using bcrypt; role-based access controls; regular security audits; and monitoring for suspicious activity. Phone numbers are masked in public APIs and visible only in active conversations. Email addresses are not exposed publicly. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. International Transfers

Your personal data is primarily stored on servers located in India (Mumbai region), in compliance with Indian data localization requirements. Some data may be processed by service providers located outside India for purposes such as CDN caching (read-only cached assets), disaster recovery (encrypted replicas), and analytics (anonymized data only). Where data is transferred outside India, we ensure appropriate safeguards are in place.

10. Children's Privacy

The Platform is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact us immediately.

11. Grievance Redressal

If you have any grievance regarding the processing of your personal data, you may contact us using the details below. We will acknowledge your grievance within 2 working days and endeavour to resolve it within 10 business days.

If your grievance is not resolved to your satisfaction, you may file a complaint with the Data Protection Board of India (once constituted under the DPDP Act, 2023) or approach the appropriate consumer forum or court of competent jurisdiction.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in Delhi, India.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Contact

For privacy-related inquiries, please contact us at: