Privacy Policy

Privacy Policy

Closed-beta legal boundary: Founder-prepared draft for closed-beta readiness. Lawyer/CA review required before paid/public production. PGI Hub has no approved live payments, GST invoicing, vendor payouts, escrow, public marketplace launch, automated supplier award, or production legal approval under this pack.

1. Master Overview and Boundary

This Privacy Policy governs how PGI processes personal data, account data, contact data, buyer procurement data, vendor profile data, RFQ workflow records, support data, security logs, cookies, and platform interaction data during closed beta. It defines privacy-by-design controls for a procurement intelligence platform where contact-hidden supplier discovery, confidential BOM/RFQ workflows, vendor data correction, and AI-assisted decision support require strong data minimisation and visibility governance.

This Policy is a founder-prepared DPDP-oriented draft. It is not a final legal privacy notice, does not approve public production processing, and must be reviewed by Indian privacy counsel and relevant advisors before paid/public launch.

2. Operator and Privacy Roles

3. Operational Definitions

• Personal Data means information that identifies or relates to an identifiable individual, including account details, work email, name, role, organization membership, support records, and contact data.
• Buyer Procurement Data means BOMs, drawings, part numbers, MPN aliases, specifications, quantities, RFQ records, project notes, supplier shortlists, quote comparisons, and procurement reports uploaded or created by buyers.
• Vendor-Submitted Data means vendor profile, capability, rates/offers, stock, lead-time, certification, team, and contact governance information submitted or confirmed by a vendor.
• Contact Hidden Data means supplier contact information shielded from broad buyer visibility and governed by controlled access workflows.
• Visibility Level means the platform classification controlling whether a field is internal-only, account-visible, organization-visible, vendor-visible, buyer-visible through RFQ, public/footer-visible, or contact-hidden.
• Audit Log means a security, legal, support, acceptance, data correction, vendor claim, RFQ, or admin action record retained for accountability.
• Platform Informational Inferences are defined in the Terms and Conditions and include AI-assisted, rule-based, normalized, ranked, estimated, compared, or summarized outputs.

4. Privacy-by-Design Commitments

PGI should implement data minimisation, purpose limitation, storage limitation, role-based access, contact hiding, versioned consent/notice records, audit logging, supplier-profile correction routes, cookie preference controls, and human review for sensitive platform actions. Closed-beta data must be processed only for controlled evaluation, procurement workflow operation, security, support, legal readiness, data-quality improvement, and professional review preparation.

PGI must not use closed-beta buyer confidential BOM/RFQ/project data to publicly expose a buyer's sourcing strategy. PGI must not expose hidden supplier contact data merely because a supplier appears in discovery results. Vendor contact visibility requires governed workflow design and recorded context.

5. Data Categories

6. Processing Purposes

7. Data Sources

PGI may process data from users, buyer organizations, vendor organizations, invited suppliers, uploaded files, RFQ workflows, public-source supplier facts, third-party provider/API sources, support channels, security logs, cookie/consent tools, and internal research. Public-source or provider/API data can be incomplete, stale, or subject to source restrictions.

8. Contact Hidden Logic

Supplier contact data is not automatically exposed through discovery, ranking, quote comparison, or vendor labels. Contact Hidden controls protect individuals and suppliers from scraping, unsolicited outreach, unauthorized disclosure, and premature commercial reliance. Buyer contact requests should be governed by user eligibility, workflow context, acceptance records, rate limits, audit logs, and applicable privacy notices.

9. BOM/RFQ Confidentiality

Buyer BOMs, drawings, specifications, target quantities, commercial notes, and supplier shortlists can reveal sensitive procurement strategy. PGI should use workspace controls, RFQ-scoped sharing, data minimisation, and audit logs to avoid exposing buyer data beyond the intended workflow. Buyers remain responsible for ensuring they have authority to upload and share procurement data.

10. Vendor Data Correction Rights

Vendors may request correction, claim review, suppression, or removal of inaccurate vendor profile data, unsupported certification claims, stale stock/rate information, misleading categories, hidden contact issues, or disputed PGI Researched records. Correction handling should be logged, reviewed, and mapped to the Vendor Correction Policy and internal SOP.

11. Cookies and Preference Center

Necessary cookies and local storage may be used for security, session, consent, and essential platform operation. Non-essential analytics, marketing, or preference cookies must not load before consent where applicable. The cookie preference center must support Accept All, Reject Non-Essential, Manage Settings, Update Preferences, and Withdraw where implemented.

Rejecting non-essential cookies must not block core site access, except where a feature requires a strictly necessary cookie or similar storage mechanism.

12. Consent and Notice Points

13. Retention Matrix

14. Sharing Matrix

15. AI Training / Non-Training Position

Closed-beta buyer confidential procurement data, RFQ data, vendor contact data, and support/grievance data should not be used to train public or general-purpose models without explicit reviewed approval. PGI may use data for platform operation, structured extraction, normalization, quality review, safety evaluation, audit, and internal product improvement where privacy, confidentiality, and contractual controls permit.

Any broader model-training use requires a separate reviewed policy, notice, consent basis where needed, data minimisation, and professional approval.

16. International Access and Cross-Border Caveat

PGI may use cloud, infrastructure, email, security, analytics, provider/API, or support services that involve access or processing outside the user's location. Cross-border processing, transfer mechanisms, DPDP obligations, vendor contracts, and local law requirements remain subject to lawyer review before paid/public production.

17. Children and Minors

PGI is a B2B procurement platform and is not intended for children or minors. Users must not create accounts or submit personal data on behalf of minors for procurement workflows.

18. Security Safeguards and Audit Logs

PGI should use access controls, role separation, authentication, encryption where appropriate, audit logs, security monitoring, incident response, vulnerability intake, administrative approval requirements, and data-quality review. No security control is represented as complete or infallible under this founder draft.

19. Deletion, Correction, Support, and Grievance

Users may request access, correction, deletion, suppression, or support through the relevant PGI request channel. PGI may deny, limit, defer, or retain records where required for legal, audit, security, fraud prevention, dispute, RFQ/quote evidence, or operational integrity, subject to final professional review.

Related Documents

• terms-and-conditions
• closed-beta-terms
• acceptable-use-policy

Review Status

Founder-prepared draft. Lawyer/CA review required before paid/public production.

Paid/public production readiness: Not approved. Lawyer/CA/payment-provider/founder review required.