Privacy Policy

B2BforIndia (b2bforindia.com) is a business-to-business marketplace operated by ExporterHubs Private Limited, with its registered office at S-49 Shakarpur Sunder Block, 110092("we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.

The platform connects buyers with suppliers. We do not buy or sell goods ourselves and are not a party to deals between users.

When you create an account: your name, username, email address, mobile number, password and role (buyer or supplier). Your password is stored only as a one-way cryptographic hash — we cannot read it.

Business details: company name, city, country, profile photo and business description. Suppliers must provide their GSTIN and PAN; buyers may optionally provide a GSTIN.

When you use the marketplace: products you list (titles, prices, images, specifications), inquiries you send or receive, requests for quotation (RFQs), quotations, and your messages and replies within these.

Without an account: if you send an inquiry or post an RFQ as a guest, we collect the name, email, mobile number, company and optional GSTIN you enter, and create a basic buyer account for you so the request can be handled.

Payments: the plan you buy, billing period, amount, and the order and payment reference numbers from our payment gateway. See section 4.

Records we keep: the date and time you accepted these policies and the version you accepted.

Technical data: your IP address is used briefly to limit repeated GST lookups and to protect the service from abuse; our hosting provider may keep standard server logs. We do not use advertising or analytics trackers.

To keep the marketplace trustworthy, we check GSTINs and PANs against government records using our verification partner, Surepass Technologies. When you click "Verify" or register with a GSTIN or PAN, that number is sent to Surepass, which returns details from official records:

• From GST records: legal name, trade name, registration status, registration (and any cancellation) date, constitution of business, taxpayer type, nature of business and principal place of business address.
• From PAN records (suppliers only): the name on the PAN and the PAN category (for example, company or individual).

We store these results with your account. Your verified trade or legal name and city may be shown on your public supplier profile, together with a "GST Verified" badge. If verification fails or cannot be completed, your account is reviewed manually by our team. Verification confirms registration details only — it is not a guarantee of a business's quality or conduct.

Paid plans are processed by Razorpay Software Private Limited. Your card, UPI, net-banking or wallet details are entered directly on Razorpay's secure checkout and are never received or stored by us. Razorpay shares with us only the payment status and reference numbers, which we keep as a record of your purchase. Razorpay's own privacy policy applies to the data it processes.

• To create and manage your account and let you log in securely.
• To show your supplier profile and products to buyers, and to route inquiries and RFQs between buyers and suppliers.
• To verify GST and PAN details and keep fake or inactive businesses off the platform.
• To process plan payments, activate plans and keep billing records.
• To provide support, respond to complaints and enforce our Terms of Use.
• To meet legal, tax and regulatory obligations and respond to lawful requests from authorities.

We process your data on the basis of the consent you give when you register or submit a form, and for the legitimate uses permitted under the DPDP Act (such as complying with law). We do not sell your personal data.

• Everyone: supplier company profiles (company name, location, description, verification badges) and product listings are public. The public RFQ feed shows the requirement and the buyer's name and company — never their email or phone.
• Suppliers you contact: when you send an inquiry, the supplier sees your name, company and message.
• Assigned suppliers: RFQs are reviewed by our team and assigned to relevant suppliers, who can then see the buyer's contact details to send a quotation.
• Our administrators: authorised staff can access account, verification and payment records to run and support the platform.
• Authorities: when required by law, court order or a lawful request from a government agency.

These providers process data only to provide their service and are bound by their own privacy and security obligations. Some may process data outside India, which is permitted under the DPDP Act except to countries restricted by the Government of India.

When you log in, a secure login token and basic profile details are saved in your browser's local storage so you stay signed in; it expires after 7 days and is removed when you log out. Razorpay's checkout may set its own cookies when you make a payment.

We do not use advertising, analytics or tracking cookies.

• Account, profile, listing and verification data: while your account is active, and deleted or anonymised within a reasonable time after you ask us to delete it.
• Payment and invoice records: for as long as required by tax and accounting laws (generally up to 8 years).
• Inquiries and RFQs: while either party's account is active, as they form part of the other party's business records.
• Data we must keep to comply with law, resolve disputes or enforce our terms may be kept for longer.

We use reasonable security practices, including HTTPS encryption in transit, hashed passwords, signed and expiring login tokens, encryption of third-party API credentials, access controls that limit each user to their own data, and restricted administrator access. No system is completely secure; if a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is processed;
• correct, complete or update your data — most of it directly from your dashboard's profile page;
• ask us to erase your data and close your account (subject to records we must keep by law);
• withdraw your consent at any time — this will stop future processing but not affect what was done before, and you may no longer be able to use the platform;
• nominate another person to exercise these rights in case of death or incapacity;
• raise a grievance with our Grievance Officer, and if unresolved, complain to the Data Protection Board of India.

To exercise any of these rights, write to support@b2bforindia.com from your registered email address.

The platform is for businesses and individuals aged 18 or over. We do not knowingly collect data from children; if we learn that we have, we will delete it.

We may update this policy from time to time. The effective date at the top shows the latest version. For significant changes we will notify registered users by email or on the website, and ask for fresh consent where the law requires.

In accordance with the IT Act, 2000, the rules made under it and the DPDP Act, 2023, our Grievance Officer is:

We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt.