🔒 Privacy Policy — Kisanio Agritech Private Limited

Effective Date: 1 May 2026 | Version: 2.0 | Last Reviewed: June 1st, 2026

• www.kisanio.com | [email protected] | Hyderabad, Telangana, India*⚖️ Regulatory Compliance & Governance

This Policy is strictly governed by the following frameworks:

• Information Technology Act, 2000 & IT (Amendment) Act, 2008

• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

• Consumer Protection Act, 2019 & Digital Personal Data Protection Act, 2023 (DPDPA)

• RBI Payment Aggregator Guidelines & GST Act, 2017

👋 1. Who We Are & Why This Policy Exists

Kisanio Agritech Private Limited (Kisanio, we, us, or our) operates the digital agri-marketplace at www.kisanio.com and the Kisanio mobile application (Platform). Our Platform connects farmers and agri-buyers (Users) with verified agricultural vendors and sellers (Vendors) across Telangana and Andhra Pradesh.

📍 2. Scope of This Policy

This Policy applies to:

• All registered Users (buyers/farmers) and Vendors on the Kisanio Platform.

• Visitors who browse www.kisanio.com without creating an account.

• Individuals who contact Kisanio via WhatsApp, email, phone, or in-person.

• Vendors, delivery partners, affiliates, and any third party sharing data with Kisanio.

📝 Key Definitions

• 'Personal Data' — Any information that identifies or can identify a living individual (name, phone number, identity proofs, location, IP address, etc.).

• 'Sensitive Personal Data' (SPDI) — Financial information (bank account, card details), biometric data, health information — governed specifically by SPDI Rules 2011.

• 'Processing' — Any operation on personal data: collection, storage, use, sharing, or deletion.

• 'Data Fiduciary' — Kisanio, as the entity that determines the purpose and means of processing your data.

✅ 3. Your Consent

By accessing or using the Kisanio Platform (including browsing, registration, placing orders, or contacting us), you explicitly consent to the collection, use, storage, and disclosure of your personal information as described in this Privacy Policy.

If you are a minor (under 18 years), you must obtain consent from a parent or legal guardian before using our Platform. Kisanio does not knowingly collect personal data from minors.

📋 4. Information We Collect From You

👤 4.1 Information You Provide Directly

🤖 4.2 Information Collected Automatically

When you visit or use our Platform, we automatically collect certain technical information:

• Device Information: Device type, operating system, device ID, browser type, and version.

• Log Data: IP address, pages visited, time and date of visits, time spent on pages, links clicked.

• Location Data: Approximate location derived from IP address; precise GPS location only if you explicitly grant permission in app settings.

• Cookie Data: Session cookies (login), preference cookies (language, category), analytics cookies (usage patterns).

• App Usage: Features used, search terms entered, products viewed, time in app.

🤝 4.3 Information from Third Parties

• Payment Gateways (Cashfree): Transaction confirmation, payment status — NOT card numbers or UPI PINs.

• Logistics Partners (Shiprocket, Delhivery): Delivery status updates, delivery confirmation, attempt logs.

• Government/Regulatory Sources: For vendor KYC verification — GST validation via GSTN portal, ID verification via verification endpoints (consent-based only).

• Social Login (if enabled): If you sign in via Google, we receive your name, email, and profile photo from Google — no passwords.

• Referral Partners / Affiliates: If you joined Kisanio via a referral link, we record the referral source.

⚙️ 5. How We Use Your Information

🚫 5.1 What We Will NEVER Do With Your Data

• NEVER sell your personal data to any third party, advertiser, or data broker.

• NEVER share your identification proofs, PAN, or financial data with any party not required for KYC/tax compliance.

• NEVER use your data for any purpose not disclosed in this Policy without your explicit consent.

• NEVER retain data longer than required (see Retention Policy, Section 7).

• NEVER send unsolicited commercial communications without your opt-in consent.

🔗 6. Who We Share Your Data With

6.1 Authorized Data Recipients

• Vendor (Seller): Buyer name, delivery address, mobile number, order details — To enable order fulfillment and delivery coordination.

• Cashfree Payment Gateway: Transaction amount, tokenized payment method, order ID — Secure payment processing; PCI-DSS compliant.

• Shiprocket / Delhivery: Buyer name, delivery address, mobile number, parcel weight/dimensions — Shipment booking, pickup scheduling, delivery tracking.

• GSTN Portal (Government): GST number, invoice details (for GST-registered transactions) — GST compliance and e-invoice generation.

• Verification Endpoints (KYC): Verification data — Only for vendor KYC OTP-based verification; consent obtained before every check.

• Cloud Infrastructure (AWS / GCP): Encrypted platform data — application, database, media — Hosting and data storage; data stays within India.

• Analytics Tools (Google Analytics, etc.): Anonymized, aggregated usage data — no personal identifiers — Platform performance and improvement analytics.

• Law Enforcement / Courts: Data as specifically requested in official legal notices — Compliance with court orders, FIRs, government directives under IT Act.

🌍 Cross-Border Data Transfer

Kisanio stores all primary user data on servers located WITHIN INDIA in compliance with applicable Indian data localization requirements. In cases where certain third-party tools (e.g., analytics, cloud services) process data outside India, Kisanio ensures adequate contractual protections (Standard Contractual Clauses or equivalent) are in place.

⏳ 7. Data Storage & Retention

🔒 8. How We Protect Your Data

8.1 Technical Security Measures

• Encryption: All data in transit encrypted via TLS 1.3 (HTTPS). All data at rest encrypted using AES-256. Passwords hashed using bcrypt (we cannot read your password). Payment data tokenized via Cashfree — raw card data never touches Kisanio servers.

• Access Control: Role-based access: employees access only data needed for their function. Multi-factor authentication (MFA) for all internal admin accounts. All internal data access is logged and audited.

• Infrastructure Security: Hosted on ISO 27001-certified cloud infrastructure within India. Regular automated vulnerability scans and penetration tests. Web Application Firewall (WAF) protecting against SQL injection and XSS. DDoS protection and rate limiting on all API endpoints.

• Operational Security: Employee background verification before access to user data. Annual security training for all staff handling personal data. Incident response plan: breach detected → users notified within 72 hours.

💳 Payment Security

All payments on Kisanio are processed by Cashfree Payments — a PCI-DSS Level 1 compliant payment aggregator licensed by the Reserve Bank of India. Kisanio NEVER stores, processes, or transmits raw credit/debit card numbers, CVVs, UPI PINs, or net banking passwords. These are handled exclusively within Cashfree's secure environment.

⚠️ 8.2 Data Breach Protocol

In the unlikely event of a data breach affecting your personal information, Kisanio will:

1. Detect and contain the breach within our security systems.

2. Assess the scope and severity of the breach within 24 hours.

3. Notify affected users via email and/or SMS within 72 hours of discovery.

4. Report the breach to the appropriate regulatory authorities as required by Indian law.

5. Take corrective actions and provide guidance on protective steps you should take.

⚖️ 9. Your Privacy Rights Under Indian Law

🍪 10. Cookies & Tracking Technologies

👦 11. Children's Privacy

The Kisanio Platform is NOT intended for use by persons under the age of 18 years. We do not knowingly collect, process, or retain personal data from minors. If we become aware that a minor has provided personal data without parental consent, we will promptly delete that information. If you are a parent or guardian and believe your child has used our Platform, please contact us at [email protected] immediately.

🔗 12. Links to Third-Party Websites

The Kisanio Platform may contain links to third-party websites, apps, or services (e.g., government portals, logistics tracking pages, payment pages). Kisanio has no control over and is not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party site you visit from our Platform.

🔄 13. Changes to This Privacy Policy

Kisanio reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or other operational factors. We will notify you of material changes via a prominent notice on the Kisanio homepage for 30 days, email notifications, or in-app notification banners.

📋 14. Grievance Officer & Contact

14.1 Grievance Officer (IT Act 2000 — Rule 5(9))

In accordance with the Information Technology Act, 2000 and Rules thereunder, Kisanio has designated a Grievance Officer to address concerns regarding privacy, data protection, and related matters:

• Name: [Grievance Officer Name]

• Designation: Grievance Officer — Data Privacy

• Organization: Kisanio Agritech Private Limited

• Email: [email protected]

• Postal Address: Kisanio Agritech Pvt. Ltd., B1104, VASAVI METROPOLIS, PHASE 2, BHAGAYATH, HYDERABAD, Telangana - 500039, India.

• Phone: +91 7095602964

• Response Time: All grievances acknowledged within 24 hours, resolved within 30 days.

• Available: Monday to Friday, 10 AM to 5 PM IST.

📞 14.2 General Privacy Queries

• For Users / Buyers: Email: [email protected] | WhatsApp: [Support Number] | In-app: Help → Privacy Request (Mon–Sat, 9 AM–6 PM IST).

• For Vendors: Email: [email protected] | KYC queries: [email protected] | Settlement/financial data: [email protected].

💡 Summary — Key Points to Remember

1. We collect only what we need to serve you — and nothing more.

2. We NEVER sell your data. Your information is not a product.

3. You are always in control — access, correct, delete, or export your data anytime.

4. For any privacy concern, our Grievance Officer will acknowledge your issue within 24 hours.