Privacy Policy

This Privacy Policy ("Privacy Policy") describes how DigiPro Solutions Private Limited, a company incorporated under the Companies Act, 2013 ("DigiPro", "Company", "we", "us" or "our"), collects, receives, uses, stores, processes, discloses and protects personal information and personal data of individuals who access or use Procurify.in, including its website, web application, software platform, related applications, features and services (collectively, the "Platform" or "Procurify").

For the purposes of this Privacy Policy, Procurify.in is a product/platform of DigiPro Solutions Private Limited and is not a separate legal entity.

This Privacy Policy applies to information collected through:

• the Procurify website;
• Procurify web applications and portals;
• user registration and account creation;
• supplier/vendor onboarding;
• customer onboarding;
• enquiries, demonstrations and contact forms;
• transactions and activities carried out through the Platform;
• communications with DigiPro;
• customer support and service interactions; and
• other digital or electronic interactions with Procurify.

By accessing or using Procurify, you acknowledge that you have read and understood this Privacy Policy.

Where required under applicable law, DigiPro will obtain your consent or rely upon another legally permissible basis before processing your personal data.

DigiPro intends to process personal data in accordance with applicable laws of India, including, as applicable:

2.1 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ("DPDP Act") establishes the statutory framework governing the processing of digital personal data in India.

The provisions relevant to this Privacy Policy include, among others:

• Section 4 – Grounds for processing personal data;
• Section 5 – Notice;
• Section 6 – Consent;
• Section 7 – Certain legitimate uses;
• Section 8 – General obligations of Data Fiduciary;
• Section 9 – Processing of personal data of children;
• Section 10 – Additional obligations of Significant Data Fiduciary, where applicable;
• Section 11 – Right to access information about personal data;
• Section 12 – Right to correction and erasure of personal data;
• Section 13 – Right of grievance redressal;
• Section 14 – Right to nominate;
• Section 15 – Duties of Data Principal;
• Section 16 – Processing of personal data outside India; and
• Section 17 – Exemptions.

The DPDP Act expressly distinguishes between a "Data Fiduciary" and a "Data Principal". Depending on the nature of processing undertaken through Procurify, DigiPro may act as a Data Fiduciary in respect of certain personal data.

The DPDP Act was enacted on 11 August 2023. Its commencement has been notified in phases, and DigiPro intends to align its privacy and data-processing practices with the applicable provisions as and when they become effective.

2.2 Digital Personal Data Protection Rules, 2025

DigiPro will also comply with applicable provisions of the Digital Personal Data Protection Rules, 2025, as and when applicable to the Company and the relevant processing activities.

The Rules prescribe requirements relating to, among other matters, notices, security safeguards, breach-related requirements, consent mechanisms, data retention and other obligations of Data Fiduciaries.

2.3 Information Technology Act, 2000

To the extent applicable, DigiPro shall comply with the Information Technology Act, 2000, including:

• Section 43A – Compensation for failure to protect data;
• Section 69B – Monitoring and collection of traffic data or information for cyber security;
• Section 70B – Indian Computer Emergency Response Team (CERT-In);
• Section 72 – Breach of confidentiality and privacy; and
• Section 72A – Disclosure of information in breach of lawful contract.

Section 43A specifically addresses the liability of a body corporate possessing, dealing with or handling sensitive personal data or information where negligence in implementing and maintaining reasonable security practices causes wrongful loss or wrongful gain.

2.4 Information Technology Rules

Where applicable to the activities undertaken through Procurify, DigiPro shall comply with relevant provisions of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended from time to time.

The Rules require applicable intermediaries to prominently publish their privacy policy, rules and user agreement and contain additional requirements concerning online activities and grievance redressal.

2.5 CERT-In Directions

DigiPro shall, where applicable, comply with directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the Information Technology Act, 2000.

This may include applicable requirements relating to cyber-security incident reporting, preservation of logs, appointment of a point of contact and other cyber-security requirements.

CERT-In's directions presently require applicable entities to maintain ICT system logs securely for a rolling period of 180 days, subject to the applicable legal and regulatory requirements.

For purposes of this Privacy Policy:

"Personal Data"

means any data about an individual who is identifiable by or in relation to such data, as defined under applicable law.

"Data Principal"

means the individual to whom the personal data relates, as defined under the DPDP Act.

"Data Fiduciary"

means the person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data.

"Processing"

means an automated operation or set of operations performed on digital personal data, including collection, storage, use, sharing, disclosure, retrieval, modification, erasure or other similar operations, as applicable under law.

"User"

means any individual who accesses, registers for, or uses Procurify.

"Business Customer"

means any organisation, company, partnership, proprietorship, institution or other entity that uses or subscribes to Procurify.

Depending upon your relationship with DigiPro and your use of Procurify, we may collect the following categories of information.

4.1 Account and Registration Information

When creating or managing a Procurify account, we may collect:

• full name;
• designation;
• business email address;
• mobile/telephone number;
• username;
• login credentials;
• organisation/company name;
• business address;
• department;
• role and user permissions;
• account preferences; and
• other information required for account administration.

4.2 Business and Organisation Information

Where Procurify is used by a business, we may collect information relating to:

• company/organisation name;
• registered/business address;
• GST-related information;
• PAN or other tax/business identifiers where required;
• supplier/vendor information;
• customer information;
• authorised representative information;
• purchase and procurement information;
• order information;
• invoice and payment-related information;
• bank/payment details where necessary for the relevant transaction; and
• other information supplied by the organisation or its authorised users.

4.3 Supplier and Vendor Information

Where a supplier/vendor uses Procurify, DigiPro may collect information required for vendor onboarding, verification, account administration and procurement operations, including:

• supplier name;
• authorised representative details;
• contact details;
• business address;
• tax and statutory registration information;
• banking/payment information;
• documents submitted during onboarding;
• product/service information;
• purchase/order information; and
• communications and correspondence.

4.4 Customer Information

Where customers use Procurify, we may collect:

• customer/organisation details;
• authorised user details;
• contact information;
• purchase requirements;
• quotation and order information;
• transaction information;
• delivery-related information;
• billing information;
• communications and support requests.

4.5 Technical and Usage Information

When you access Procurify, certain information may be automatically collected, including:

• IP address;
• browser type;
• operating system;
• device information;
• date and time of access;
• pages/screens accessed;
• login and logout information;
• session information;
• referring website;
• error logs;
• application activity;
• security and audit logs; and
• other technical information necessary for security, administration and operation of the Platform.

4.6 Cookies and Similar Technologies

Procurify may use cookies, web beacons, pixels, local storage and similar technologies for:

• authentication;
• maintaining sessions;
• security;
• remembering preferences;
• improving Platform functionality;
• analytics;
• performance monitoring;
• preventing fraud and misuse; and
• understanding how users interact with the Platform.

Where required by applicable law, DigiPro will obtain consent before placing or using non-essential cookies or similar technologies.

Users may manage cookies through their browser or device settings. Disabling certain cookies may affect the functionality of Procurify.

DigiPro may process personal data for the following purposes:

• creating and administering user accounts;
• authenticating users;
• providing Procurify services;
• facilitating procurement and supplier/customer interactions;
• processing purchase orders, quotations and transactions;
• managing supplier/vendor onboarding;
• communicating with users;
• providing customer support;
• responding to enquiries and requests;
• sending service-related communications;
• processing payments, where applicable;
• preventing fraud, misuse and unauthorised access;
• maintaining security and integrity of the Platform;
• monitoring and analysing Platform performance;
• maintaining audit and transaction records;
• complying with applicable laws and regulatory requirements;
• responding to lawful governmental or regulatory requests;
• enforcing contractual rights and obligations;
• resolving disputes;
• conducting internal audits and risk assessments;
• improving and developing Procurify and its features;
• sending marketing or promotional communications where legally permitted and, where required, with appropriate consent; and
• any other purpose disclosed to you at the time of collection or otherwise permitted under applicable law.

DigiPro shall process personal data only on a lawful basis applicable to the relevant processing activity.

Depending upon the circumstances, processing may be based upon:

6.1 Consent

Where required, DigiPro may process personal data based on consent provided by the Data Principal.

Consent may be withdrawn subject to applicable law and contractual or legal requirements.

Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal.

6.2 Certain Legitimate Uses

Where recognised under applicable provisions of the DPDP Act, DigiPro may process personal data for certain legitimate uses without separately obtaining consent, including where permitted by law for contractual, legal, security, compliance or other recognised purposes.

6.3 Contractual Necessity

Personal data may be processed where necessary for entering into or performing a contract or providing services requested by the User or Business Customer.

6.4 Legal and Regulatory Obligations

DigiPro may process or disclose personal data where necessary to comply with applicable Indian laws, court orders, governmental directions, regulatory requirements, tax requirements, cyber-security obligations or other lawful requirements.

DigiPro does not sell personal data of Users.

We may, however, disclose or make personal data available to the following categories of recipients where necessary and lawful:

7.1 Business Customers

Where Procurify is being used on behalf of or for a Business Customer, relevant information may be accessible to the Business Customer and its authorised personnel in accordance with the applicable service arrangement.

7.2 Suppliers and Customers

Where the Platform facilitates business transactions between customers and suppliers, relevant information may be shared with the respective counterparty to enable the transaction.

7.3 Service Providers

We may engage third-party service providers for:

• cloud hosting;
• infrastructure;
• cybersecurity;
• payment processing;
• email/SMS communications;
• analytics;
• customer support;
• software development;
• technical support;
• data backup;
• document processing; and
• other services necessary to operate Procurify.

Such service providers shall be required to handle personal data in accordance with applicable contractual and legal obligations.

7.4 Professional Advisers

Personal data may be disclosed to lawyers, accountants, auditors, consultants, insurers and other professional advisers where reasonably necessary.

7.5 Government and Law Enforcement Authorities

DigiPro may disclose information where required or permitted by applicable law, court order, governmental direction, regulatory requirement or lawful request from law enforcement or other competent authorities.

7.6 Corporate Transactions

In connection with a merger, acquisition, restructuring, financing, sale of assets, business transfer or similar corporate transaction, relevant information may be transferred subject to applicable law and appropriate confidentiality and security safeguards.

DigiPro may use cloud infrastructure, service providers or technology providers located outside India.

Where personal data is transferred, stored or processed outside India, DigiPro shall undertake such transfer in accordance with applicable Indian laws, including applicable requirements under the DPDP Act and rules made thereunder.

DigiPro shall implement appropriate contractual, organisational and technical safeguards for such processing, as applicable.

DigiPro takes reasonable and appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• loss;
• destruction;
• misuse;
• accidental disclosure; and
• other unlawful or unauthorised processing.

Security measures may include, as appropriate:

• access controls;
• authentication mechanisms;
• role-based access;
• encryption or equivalent safeguards;
• network security;
• logging and monitoring;
• vulnerability management;
• backups;
• security testing;
• incident response procedures;
• employee confidentiality obligations; and
• vendor security controls.

No electronic system can be guaranteed to be completely secure. Accordingly, although DigiPro takes reasonable security measures, it cannot guarantee absolute security of information transmitted through or stored on the Internet.

In the event of a personal data breach or cybersecurity incident, DigiPro shall take reasonable steps to:

• identify and assess the incident;
• contain and mitigate the incident;
• investigate the cause and impact;
• preserve relevant evidence and logs;
• take remedial and preventive measures;
• notify affected persons where required by applicable law;
• notify competent governmental or regulatory authorities where legally required; and
• comply with applicable CERT-In and other statutory reporting requirements.

DigiPro will maintain an appropriate incident response mechanism for handling security incidents.

DigiPro shall retain personal data only for as long as reasonably necessary for:

• providing the requested services;
• maintaining user and business records;
• fulfilling contractual obligations;
• complying with legal and regulatory requirements;
• resolving disputes;
• preventing fraud;
• maintaining security;
• enforcing agreements; and
• legitimate business or operational purposes permitted under applicable law.

Different categories of data may be retained for different periods.

Certain records may be retained for longer periods where required by applicable laws, including tax, accounting, corporate, regulatory, cybersecurity or dispute-resolution requirements.

Where personal data is no longer required and there is no legal or legitimate requirement for its retention, DigiPro shall take reasonable steps to delete, anonymise or otherwise securely dispose of such data.

Subject to the DPDP Act and other applicable laws, Data Principals may have rights including:

12.1 Right to Access

The Data Principal may have the right to obtain information regarding personal data processed by DigiPro, subject to applicable legal limitations.

12.2 Right to Correction

A Data Principal may request correction of inaccurate or incomplete personal data.

12.3 Right to Erasure

A Data Principal may request erasure of personal data where permitted under applicable law.

DigiPro may retain certain information where retention is required by law or otherwise legally permissible.

12.4 Right to Withdraw Consent

Where processing is based on consent, the Data Principal may withdraw consent in accordance with applicable law.

12.5 Right to Grievance Redressal

A Data Principal may raise a grievance concerning the processing of personal data.

12.6 Right to Nominate

Where applicable under the DPDP Act, a Data Principal may have the right to nominate another individual to exercise specified rights in the event of death or incapacity.

A Data Principal may contact DigiPro using the contact details provided in this Privacy Policy to:

• request access to personal data;
• request correction;
• request erasure;
• withdraw consent where applicable;
• raise a privacy-related grievance; or
• exercise any other applicable statutory right.

DigiPro may require reasonable information to verify the identity and authority of the person making the request before processing the request.

Requests shall be handled in accordance with applicable law.

DigiPro is committed to providing a mechanism for addressing privacy and data-protection grievances.

Users may submit a grievance relating to:

• collection or processing of personal data;
• unauthorised access;
• misuse of personal data;
• correction or deletion requests;
• consent;
• privacy-related communications; or
• any other matter concerning the handling of personal data by DigiPro.

Grievance Officer / Privacy Contact

Name: [●]

Designation: Grievance Officer / Privacy Officer

Email: [●]

Address: [Registered Office Address of DigiPro Solutions Private Limited]

Telephone: [●]

DigiPro shall endeavour to acknowledge and resolve grievances within the time period prescribed by applicable law.

Where applicable, Users may exercise their statutory remedies before the competent authority or Data Protection Board of India in accordance with the DPDP Act and rules.

Procurify is intended primarily for business and professional users.

DigiPro does not knowingly seek to collect personal data of children except where such collection is legally permitted and appropriate for the relevant service.

For purposes of the DPDP Act, a child means an individual who has not completed eighteen years of age.

Where processing of a child's personal data is subject to applicable provisions of the DPDP Act, DigiPro shall implement the required safeguards and obtain verifiable parental or lawful guardian consent where legally required.

Where payments are facilitated through Procurify, DigiPro may collect or process information necessary to complete, verify and reconcile the relevant transaction.

Where payment processing is handled by a third-party payment service provider, payment credentials may be processed directly by that provider in accordance with its applicable terms and privacy policy.

DigiPro does not intend to store complete payment-card information unless specifically required and legally permitted for the relevant service.

DigiPro may send Users communications relating to:

• account administration;
• transactions;
• service updates;
• security alerts;
• technical notices;
• changes to the Platform;
• customer support; and
• other service-related matters.

Where legally permissible, DigiPro may also send promotional or marketing communications.

Users may opt out of non-essential marketing communications by using the unsubscribe mechanism provided in the communication or by contacting DigiPro.

Opting out of marketing communications will not prevent DigiPro from sending essential transactional, security or service-related communications.

Procurify may use cookies and similar technologies.

Essential Cookies

These may be required for:

• login;
• authentication;
• security;
• session management; and
• core Platform functionality.

Analytics Cookies

These may help DigiPro understand how Users interact with Procurify and improve performance.

Preference Cookies

These may remember settings and preferences.

Marketing Cookies

Where used, these may assist with relevant promotional activities and shall be used subject to applicable law and consent requirements.

Users may control cookies through browser settings and other mechanisms provided by Procurify.

Procurify may contain links to third-party websites, applications or services.

DigiPro is not responsible for the privacy practices, content, security or policies of third parties.

Users are advised to review the privacy policies of such third parties before providing personal information.

Where a Business Customer uses Procurify to collect, upload or otherwise process personal data concerning its employees, customers, suppliers, representatives or other individuals, the Business Customer may determine the purpose and means of such processing.

In such circumstances, DigiPro may process such information on behalf of the Business Customer in accordance with the applicable agreement, instructions and applicable law.

The Business Customer is responsible for ensuring that it has the necessary rights, notices, permissions and lawful basis to provide such personal data to DigiPro for processing through Procurify.

Where applicable, the Business Customer shall be responsible for responding to Data Principal requests concerning data for which it is the relevant Data Fiduciary.

Users are responsible for ensuring that information provided to DigiPro is accurate, complete and up to date.

Users shall promptly notify DigiPro of any changes to information that may affect their account, transactions or use of Procurify.

DigiPro may rely upon information supplied by Users and shall not be responsible for consequences arising solely from inaccurate or fraudulent information provided by a User or third party.

Users shall:

• maintain the confidentiality of their login credentials;
• use Procurify only for lawful purposes;
• not share authentication credentials with unauthorised persons;
• promptly report suspected unauthorised access;
• provide accurate information;
• ensure they have authority to provide information relating to another individual or organisation; and
• comply with applicable laws and contractual obligations.

Users must not knowingly upload, submit or transmit personal data belonging to another individual unless they have a lawful right or authority to do so.

Procurify may process confidential business information belonging to customers, suppliers or other users.

DigiPro shall take reasonable measures to protect such information and shall use or disclose it only for authorised purposes, subject to applicable agreements and law.

Nothing in this Privacy Policy shall override a specific confidentiality or data-processing obligation contained in a valid written agreement between DigiPro and a Business Customer.

DigiPro intends to incorporate privacy and data-security considerations into the design, development and operation of Procurify.

Depending upon the nature, scope and risk of processing, DigiPro may undertake measures such as:

• access minimisation;
• role-based access controls;
• data minimisation;
• retention controls;
• security testing;
• audit logging;
• encryption;
• privacy reviews;
• vendor assessments; and
• incident-response procedures.

Procurify may use automated systems, rules, algorithms or similar technologies for operational, security, fraud-prevention, workflow or other legitimate purposes.

Where applicable law grants an individual specific rights in relation to automated processing, DigiPro shall comply with those requirements.

DigiPro reserves the right to disclose personal data where reasonably necessary to:

• comply with applicable Indian law;
• comply with a court order;
• comply with a lawful governmental or regulatory direction;
• investigate suspected fraud or unlawful activity;
• protect the rights, property or safety of DigiPro, its users or others;
• investigate cybersecurity incidents; or
• establish, exercise or defend legal claims.

Such disclosure shall be limited to what is reasonably necessary and legally permissible.

If DigiPro undergoes a merger, acquisition, restructuring, sale, transfer or other corporate transaction, personal data may form part of the transferred business assets or records, subject to applicable law and appropriate confidentiality and security measures.

Where legally required, affected Data Principals shall receive appropriate notice.

DigiPro may modify or update this Privacy Policy from time to time to reflect:

• changes in applicable laws;
• regulatory developments;
• changes to Procurify;
• changes in data-processing practices;
• security requirements; or
• operational requirements.

The updated Privacy Policy shall be published on Procurify.in with the revised "Last Updated" date.

Where required by applicable law, DigiPro shall provide additional notice or obtain consent for material changes.

Users are encouraged to periodically review this Privacy Policy.

This Privacy Policy shall be governed by and construed in accordance with the laws of India.

Subject to applicable law, disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the competent courts having jurisdiction over the registered office of DigiPro Solutions Private Limited.

Nothing in this clause shall restrict any statutory right or remedy available to a Data Principal under applicable data-protection or other laws of India.

If any provision of this Privacy Policy is determined to be unlawful, invalid or unenforceable under applicable law, such provision shall, to the extent possible, be modified or severed without affecting the validity and enforceability of the remaining provisions.

Failure by DigiPro to enforce any provision of this Privacy Policy shall not constitute a waiver of its right to enforce that provision subsequently.

For questions, requests or concerns regarding this Privacy Policy or the processing of personal data through Procurify, please contact:

DigiPro Solutions Private Limited

Product: Procurify.in

Registered Office: CTS No:4 RS No:219/6, ADARSH NAGAR VADAGAON,BELGAUM, -590005, KARNATAKA.

Email: info@procurify.in

Privacy / Grievance Officer:

Designation: Founder and CEO

Telephone: 8431331405

Website: Procurify.in

By accessing or using Procurify.in, you acknowledge that you have read and understood this Privacy Policy.

Where applicable law requires consent, your consent will be obtained through an appropriate mechanism before the relevant processing takes place.

© DigiPro Solutions Private Limited. All Rights Reserved.