Privacy Policy

Plus Ultra Innovation ("Plus Ultra", "we", "us", "our") operates the e-procurement and vendor-discovery platform ProcureOne Ultra available at www.plusultrainnovation.com. This Privacy Policy describes how we collect, use, share and safeguard personal data of users (data principals) who visit our website, register an account, transact on the platform, or otherwise interact with our services.

This Policy is governed by the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable Indian law.

1. Data We Collect

• Identity & contact: name, email, mobile, organisation, GSTIN, PAN, address, state, city.
• Account credentials: securely hashed password, JWT tokens, login timestamps, IP address at the time of consent.
• Transactional data: tenders, bids, awards, invoices, payments, success-fee records.
• Technical: device, browser, IP, referrer, audit-log telemetry needed for security and abuse prevention.
• Documents & uploads: tender documents, KYC artefacts (GST/PAN/MSME/BIS certificates), purchase orders.

2. Purposes of Processing

• Account creation, authentication, and identity verification.
• Operating the procurement lifecycle (tendering, bidding, award, invoicing).
• Issuing GST-compliant tax invoices, success-fee invoices, and processing payments via Razorpay.
• Service communications (transactional email, alerts, support).
• Detecting fraud, brute-force, and other security threats; complying with court / regulatory orders.

3. Legal Basis & Consent

We process personal data on the basis of your specific, informed and unambiguous consent captured at registration and at each payment checkout. You can withdraw consent at any time from your account settings, subject to retention obligations under tax / accounting law.

4. Sharing & Disclosure

We share personal data only with: (a) Razorpay for payment processing, (b) Resend for transactional email delivery, (c) cloud storage providers for tender / KYC documents, (d) statutory authorities when legally compelled, and (e) professional advisers under confidentiality. We do not sell personal data.

5. International Transfers

Where data processors operate servers outside India, transfers occur only to jurisdictions notified by the Central Government under §16 of the DPDP Act.

6. Retention

Account data is retained while your account is active. After deletion (DPDP §12), operational data is erased within 30 days, except where retention is required by the Income Tax Act, GST Act, or any other applicable law (typically 8 years for tax records).

7. Your Rights (DPDP §11–§14)

• Right to access & export your data at /privacy.
• Right to correction and updation via your profile page.
• Right to erasure ("delete my account") with the phrase DELETE_MY_ACCOUNT.
• Right to grievance redressal — contact the Grievance Officer below.

8. Security

We use industry-standard controls: bcrypt password hashing, JWT with server-side revocation, HMAC-SHA256 webhook signature verification, role-based access control, append-only audit logging, encrypted-at-rest storage, and file-upload extension + MIME whitelisting.

9. Cookies

We use first-party cookies and localStorage strictly for session continuity, lead-source tracking and CSRF protection. We do not run advertising trackers.

10. Children

Our services are not intended for children below 18. We do not knowingly collect data of minors.

11. Changes to this Policy

Material changes will be notified by email at least 7 days before they take effect. The version and effective date appear at the top of this page.

12. Grievance Officer (DPDP §13)