Privacy Policy

1. Introduction and Regulatory Alignment

This Privacy Policy sets out the manner in which NexG Petrolube Private Limited, a company incorporated under the Companies Act, 2013 and having its registered office at 1, Bhupen Bose Avenue, Kolkata – 700004, West Bengal, India, collects, processes, stores, uses, discloses, and protects business, operational, and system-generated data of users accessing or using its website, mobile application, and associated digital infrastructure.

This Policy is framed in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. The Platform is designed exclusively for business-to-business transactions relating to petroleum products and used oil and is not intended for consumer or personal use.

2. Consent, Authority and Binding Acknowledgement

By accessing, registering on, or otherwise using the Platform, users expressly provide their free, specific, informed, unconditional, and unambiguous consent to the collection, processing, storage, use, and disclosure of their personal and business data in the manner and for the purposes set out herein. Such consent is deemed to be granted through clear affirmative action and shall remain valid unless withdrawn in accordance with applicable law.

Where a user accesses or uses the Platform on behalf of a company, government body, partnership, or any other legal or statutory entity, the user represents and warrants that they are duly authorised to act for and bind such entity, and that any consent provided, information submitted, or obligations undertaken through the Platform shall be legally binding upon such entity.

3. Nature and Categories of Data Collected

The Company may collect and process business-related identification and compliance information necessary to verify and onboard Users and to facilitate lawful transactions on the Platform. Such information may include, without limitation, the legal name of the entity, Goods and Services Tax (GST) registration details, Permanent Account Number (PAN), Corporate Identification Number (CIN), applicable licences, waste handling or environmental clearances, hazardous material handling documentation, details of authorised representatives, and registered or operational addresses.

In the course of facilitating transactions, the Company may also collect transaction-specific and operational data, including bids submitted, quotations exchanged, negotiated prices, references to security deposits, records of Platform Fees, logistics and delivery schedules, pickup quantities, route and movement data, and other information reasonably required for execution, reconciliation, audit, and dispute resolution purposes.

Additionally, the Company automatically collects certain technical and usage-related information when Users access or interact with the Platform. This may include internet protocol (IP) addresses, device identifiers, operating system details, browser type, timestamps, access logs, and analytical data generated through cookies or similar technologies, which are used to monitor performance, enhance security, improve user experience, and ensure the efficient functioning of the Platform.

All payment-related information is processed exclusively through authorised third-party payment gateway service providers. The Company does not store, retain, or have direct access to Users’ card details, banking credentials, or other sensitive financial information, except to the extent strictly necessary for transaction reconciliation, compliance, or record-keeping as permitted under applicable law.

4. Purpose of Processing, Sustainability, and AI/Automated Features

The data collected by the Company is processed strictly for lawful, legitimate, and bona fide business purposes integral to the operation of the Platform. Such purposes include, without limitation, verification and authentication of Users, facilitation of bidding, quotation, and negotiation processes, execution and recording of commercial transactions, coordination of logistics and operational activities, prevention and detection of fraud or misuse, resolution of disputes, compliance with applicable statutory, regulatory, and contractual obligations, and maintenance of the security, integrity, and reliability of the Platform.

The Platform incorporates built-in functionalities designed to generate sustainability metrics, environmental impact assessments, and regulatory or compliance reports, which may be derived from information provided by Users as well as system-generated operational data. Users expressly acknowledge and consent to the processing, aggregation, and analysis of their data for the purposes of generating such sustainability, environmental, and compliance-related reports, including for internal records, regulatory submissions, or disclosures mandated under applicable law.

The Platform may use collected data for automated decision-making, AI pricing suggestions, or algorithmic matching in future modules. Users consent to the use of their data for such automated processing and analysis, which will be conducted transparently and fairly in accordance with applicable laws.

5. Legal Basis for Processing

The Company undertakes the processing of personal and business data on one or more lawful grounds, as permitted under applicable data protection laws. Such grounds include the free, specific, informed, unconditional, and unambiguous consent of the User; the necessity of processing for the performance of contractual obligations or for taking steps at the request of the User prior to entering into a contract; compliance with applicable statutory or regulatory requirements; the protection and enforcement of the Company’s legal rights, interests, and claims; and the pursuit of the Company’s legitimate business interests, provided that such interests are balanced against and do not override the fundamental rights and freedoms of the Users.

6. Disclosure to Third Parties and Authorities

The Company may disclose or share personal, business, transactional, or technical information with other registered users of the Platform, logistics and transportation partners, technology service providers, payment gateway operators, auditors, consultants, and legal or professional advisors, strictly on a need-to-know basis and solely to the extent necessary for the facilitation of transactions, provision of services, operational support, audit, compliance, or protection of the Company’s legitimate interests.

Users are solely responsible for the accuracy, authenticity, and completeness of any documents, certifications, product descriptions, or other information uploaded to the Platform, including but not limited to environmental clearances, waste handling certificates, and hazardous material documentation. NexG Petrolube Private Limited assumes no responsibility or liability for any misrepresentation, error, omission, or regulatory non-compliance arising from User-submitted materials. Users agree to indemnify and hold harmless the Company from any claims, fines, or penalties resulting from inaccurate or fraudulent documentation.

Information may also be disclosed to governmental authorities, regulatory bodies, statutory agencies, courts, or law enforcement agencies where such disclosure is required under applicable law, pursuant to a lawful order, or where reasonably necessary to protect the legal rights, property, or safety of the Company, its Users, or the public. All such disclosures shall be made in accordance with applicable data protection and confidentiality obligations.

The Company shall not be responsible for third-party actions or failures, including payment gateways, logistics providers, or external service partners.

7. Data Storage, Security and Retention and Breach Notification

All information collected by the Company is stored on secure cloud-based infrastructure and is protected through reasonable administrative, technical, and organisational safeguards that are consistent with industry standards and designed to prevent unauthorised access, loss, misuse, alteration, or disclosure. Such safeguards may include access controls, encryption, monitoring mechanisms, and internal data protection protocols.

The Company retains personal and business data only for such period as is reasonably necessary to fulfil the purposes for which it was collected, including operational requirements, performance of contractual obligations, compliance with applicable statutory or regulatory mandates, and the establishment, exercise, or defence of legal rights. Upon the expiry of the applicable retention period, data is securely deleted, destroyed, or irreversibly anonymised in a manner that ensures it can no longer be associated with an identifiable User.

The Company employs reasonable technical, administrative, and organizational measures to protect the security, confidentiality, and integrity of Users’ data. These measures include encryption, access controls, monitoring systems, and cybersecurity best practices. However, Users acknowledge that no system is entirely immune to cyber threats, hacking, or unauthorized access. NexG Petrolube Private Limited does not guarantee complete security and shall not be liable for any loss, damage, or disclosure arising from cyberattacks, system intrusions, or other security breaches, except as mandated by applicable law.

8. User Rights and Grievance Redressal

Users are entitled, in accordance with applicable data protection and privacy laws, to request access to their personal and business information held by the Company, seek correction or updation of inaccurate or incomplete data, and withdraw previously granted consent for the processing of their data, to the extent such processing is based on consent and subject to applicable statutory, regulatory, or contractual obligations.

The Company has appointed a designated Grievance Officer to address complaints, concerns, or queries raised by Users in relation to data protection, privacy practices, or the exercise of user rights. All grievances shall be examined and addressed in a fair, diligent, and time-bound manner in accordance with applicable law. The contact details of the Grievance Officer shall be made available on the Platform and updated from time to time.