1. Operator and scope
This policy applies to the TIZARAT website, buyer and supplier accounts, business profiles, product catalogues, requirement forms, lead assignment, contact unlocking, advertisements and support channels. The operator’s exact legal name and contact details must be completed in the Legal Operator Details section before public launch.
TIZARAT is designed for B2B introductions. Business contact details may still be personal data where they identify an individual, sole proprietor, employee or contact person.
2. Information that may be collected
Account and contact data: name, business name, email address, telephone number, role, login identifiers and account-security records.
Business and verification data: business address, city/state, GSTIN, PAN or other verification documents where requested, category, business type, shop/factory details and contact-person details.
Buyer requirement and lead data: product description, quantity, unit, location, budget, timeline, preferred specifications, messages, uploaded files and lead-status information.
Supplier catalogue and advertising data: products, photos, prices, stock declarations, business description, campaign choices, payment reference/UTR proof and ad-review records.
Technical data: IP address, device/browser details, logs, timestamps, session and security events, cookies or local storage required for authentication and service operation.
3. Why information is used
To create and secure accounts; display business profiles; process supplier listings; receive buyer requirements; match and assign leads; unlock and share supplier contact details; enable direct business enquiries; verify platform-service payments; operate and measure advertising where actual tracking is enabled; respond to support/grievance requests; prevent fraud, spam and unlawful activity; maintain audit records; and comply with legal obligations.
TIZARAT does not sell personal contact data as a standalone data-broker product. It may share the minimum relevant information with a supplier or buyer when the user submits a requirement, becomes eligible for a lead assignment, or expressly unlocks/requests contact details. The interface should explain the relevant sharing before the action is confirmed.
3A. Electronic agreement and acceptance evidence
When a Buyer or Supplier accepts an onboarding agreement, TIZARAT records the role, account/user identifier, agreement text and policy version, SHA-256 hashes of the agreement and linked policy bundle, server timestamp, business/account snapshot, fee snapshot, and request metadata such as a hashed IP address and browser user-agent. The acceptance evidence is stored in an append-only ledger for account administration, contract evidence, fee transparency, security, legal compliance and dispute handling. Access is restricted to authorised administrators and lawful disclosures.
4. When information is shared
With counterparties: supplier profile/contact details may be disclosed to a buyer after a contact unlock; buyer requirement/contact information may be disclosed to relevant suppliers where the buyer submits a requirement or the lead programme requires it and the platform provides clear notice.
With service providers: hosting, database, security, email, payment verification, analytics and support providers may process data only to provide services to TIZARAT under appropriate access and security controls. Current core infrastructure includes Cloudflare and Supabase; other providers must be added to this notice when adopted.
With authorities or advisers: information may be disclosed where required by valid legal process, to protect rights/safety, investigate fraud or obtain professional advice, subject to applicable law.
With a business successor: information may transfer in a merger, restructuring or asset transfer subject to appropriate safeguards and law.
5. Marketing and service messages
TIZARAT does not need to send promotional newsletters or marketing emails to provide the core lead-introduction service. Essential account, security, payment, lead, legal and support notifications may still be sent through enabled channels. Marketing communications, if introduced, should require a separate lawful choice and an easy opt-out.
6. Retention and security
Data is retained only for as long as reasonably needed for account operation, lead attribution, fee reconciliation, security, dispute handling, legal compliance and record keeping. Different data types may have different retention periods. Records may be retained longer where a law, legal hold or lawful authority requires it.
Where applicable, intermediary rules require certain account information to be retained for at least 180 days after cancellation or withdrawal of registration. TIZARAT will use reasonable technical and organisational controls, role-based access, logging and secure hosting; no online system can guarantee absolute security.
7. User choices and requests
Users may request correction of inaccurate account information, access to relevant information, deletion or closure where legally available, withdrawal of optional consent, or correction of contact-sharing preferences. Some records may need to be retained to satisfy law, resolve disputes, prevent fraud or establish legal claims.
Submit a privacy request to the privacy contact shown in Legal Operator Details. Include your account email, request type and enough information to identify the record; do not send passwords, OTPs or full payment credentials.
8. Cookies, local storage and third-party links
Essential cookies or local storage may support authentication, session security, preferences and basic operation. If analytics or advertising cookies are introduced, the site should disclose them and provide choices where required. Third-party websites have their own privacy practices; TIZARAT does not control them.
9. DPDP transition
The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 have a phased commencement schedule. This policy is drafted to support the applicable requirements as they commence, including clear notices, purpose limitation, security, user requests and grievance handling. Users’ rights and TIZARAT’s obligations are those in force on the relevant date; this policy does not claim that every provision has already commenced.