Privacy Policy

• Identity and KYC data: name, PAN, Aadhaar (masked), passport, GSTIN, photograph.
• Contact data: address, mobile number, email.
• Transaction data: bids placed, deposits, invoices, payment references.
• Technical data: IP address, device and browser information, usage logs.

We process personal data on the basis of your consent, or for certain legitimate uses permitted by Section 7 of the DPDP Act, in order to verify bidders, conduct auctions, process payments, effect RTO transfer, provide support and meet obligations under the Motor Vehicles Act, 1988, the GST laws and the Prevention of Money-Laundering Act, 2002.

Consent is obtained through a clear affirmative action at the point of collection and a notice is provided in English; on request we will provide it in Hindi, Telugu or any other language listed in the Eighth Schedule to the Constitution. You may withdraw consent at any time by writing to privacy@bidmyride.in, with effect for the future.

Data may be shared with Data Processors engaged by us (payment gateways, logistics partners, inspection agencies, IT vendors) under written contract, with sellers to the extent needed to complete a sale, and with government authorities where disclosure is required by law or court order.

Personal data is retained only for as long as necessary for the stated purpose. Financial and KYC records are retained for eight years under the Companies Act, 2013 and five years under PMLA record-keeping requirements, after which data is erased or anonymised.

We maintain reasonable security practices comparable to IS/ISO/IEC 27001, including encryption in transit, access controls, logging and periodic review. In the event of a personal data breach we will notify the Data Protection Board of India and affected Data Principals in the manner prescribed under the DPDP Act.

• Right to access a summary of your personal data and its processing.
• Right to correction, completion, updating and erasure.
• Right to nominate another individual to exercise your rights.
• Right to grievance redressal before approaching the Data Protection Board.

Our services are not directed at persons under 18. We do not knowingly process the personal data of children without verifiable consent of a parent or lawful guardian, and we do not undertake tracking or targeted advertising directed at children.

Data is primarily stored on servers located in India. Where a processor operates outside India, transfers are made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and under contractual safeguards.