Privacy policy

1. Who we are

RISO INTELLIGENCE LLP operates BidSaarthi by RISO Intelligence. Our registered office is C/O Rama Ch Behuranua Pada, Madhupatna, Cuttack, Cuttack Sadar, 753010, Odisha, India, and our GSTIN is 21ABFFR1919P1ZZ.

For the purposes of the Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the Data Fiduciary for the personal data described in this policy. If you are an individual whose data we hold, the Act calls you a Data Principal.

This policy covers this website, the BidSaarthi client console, and the partner platform.

2. What we collect, and why

2.1 When you enquire through this website

The enquiry form asks for your name, company, email address, phone number, what your enquiry is about, and anything you choose to write in the message box.

Why: so that we, or a partner in your region, can call you back about your enquiry. Our basis: your consent, given by submitting the form. How long: up to twenty-four months from your last contact with us, unless you become a client or ask us to erase it sooner.

2.2 When your company is a client

We hold, for the individuals you name as users:

• Name, work email address, phone number and role;
• Sign-in records and activity in the console, so accounts stay secure and auditable;
• Whatever your organisation uploads about itself: turnover figures, completed works, registrations and certifications. This is mostly company information, but documents of this kind often contain the names, signatures and identifiers of directors, partners and authorised signatories.

Why: to provide the service your company has contracted for, to invoice it, and to support it. Our basis: performance of our contract with your organisation, and our legitimate uses under the DPDP Act.

2.3 When you are a partner

Partners give us the information needed to enrol them and to pay them, which includes identity and tax details such as PAN, and bank account details.

Why: to verify who we are contracting with, to pay commission, and to meet our tax obligations, including TDS. How long: for the life of the relationship and then for as long as tax and company law require us to keep the records, currently eight years from the end of the relevant financial year.

Identity and bank details are encrypted at rest, with access restricted to the people who need them to make payments.

2.4 Sign-in through Google

If you sign in with a Google account, Google tells us your name, email address and profile picture, and confirms that you control that account. We use this only to authenticate you and to create or match your user record. We do not read your Gmail, your Drive or your contacts, and we ask for no permission that would let us.

2.5 Payments

Payments are handled by our payment gateway. We never see or store your full card number, CVV, UPI PIN or net-banking credentials; those go directly to the gateway. We receive the outcome of the transaction, a reference, and the details needed to raise your tax invoice.

2.6 This website

This site is deliberately plain. We do not set advertising cookies, we do not run third-party trackers, and we do not build profiles of visitors. Our hosting provider keeps standard server logs, including IP addresses, for security and diagnostics.

3. What we do not do

• We do not sell personal data. Not to advertisers, not to data brokers, not to anyone.
• We do not use one client’s information to advise another client bidding for the same tender.
• We do not send marketing to people who did not ask for it, and every message we do send can be stopped by replying to it.

4. Who else sees it

We share personal data only with parties who need it to run the service, and only for that purpose:

Each of these is bound by contract to use the data only on our instructions and to protect it.

5. Where it is kept

We keep data in India wherever we can, including our transactional email, which runs through an Indian data centre. Where a service provider processes data outside India, we do so only as permitted by the DPDP Act and any restrictions notified by the Central Government.

6. How we protect it

• Encryption in transit for every connection to our services;
• Encryption at rest for identity and financial fields such as PAN and bank details;
• Access limited to the people whose work requires it, with sign-in records kept;
• Regular backups, held encrypted;
• Security review of the platform before significant releases.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal as the DPDP Act requires, and we will tell you what happened and what we are doing about it rather than issue a statement about our commitment to security.

7. How long we keep it

When a retention period ends we delete the data or anonymise it so that it can no longer identify anyone.

8. Your rights under the DPDP Act

As a Data Principal you have the right to:

• Access: a summary of the personal data we hold about you and how we process it;
• Correction and completion: to have inaccurate or incomplete data put right;
• Erasure: to have your data deleted where we are not required to keep it by law;
• Withdraw consent: as easily as you gave it, where consent is our basis for processing;
• Grievance redressal: to complain to us and receive a reasoned answer;
• Nominate: to name someone to exercise your rights if you die or become incapacitated.

To exercise any of these, write to support@bidsaarthi.in. We will respond within thirty days. We may need to confirm your identity first; that is to stop someone else exercising your rights, not to delay you.

Where the data belongs to your employer’s account rather than to you personally, we may need to direct your request through your organisation’s administrator, and we will tell you if so.

9. Questions and complaints

Write to support@bidsaarthi.in with “Privacy” in the subject line, or call +91 90786 73599 between 10:00 and 19:00 IST, Monday to Saturday. The same address handles a question about the service, an invoice or a payment, so there is only one door to knock on.

We acknowledge within three working days and aim to resolve within thirty days. You get a reasoned answer in writing whichever way it goes. If our answer does not satisfy you, you may complain to the Data Protection Board of India. Nothing in this policy takes away a right you have under Indian law.

10. Children

BidSaarthi is a business service and is not directed at children. We do not knowingly collect the personal data of anyone under eighteen. If you believe we have, tell us and we will delete it.

11. Changes to this policy

We will post any change on this page and update the version note at the top. Where a change materially affects how we use your data, we will tell you directly before it takes effect.

This policy should be read with our terms of service and our refund & cancellation policy.