Privacy Policy

1. Who we are

SparesYard (www.sparesyard.com), operated by AGSOFTECH, a proprietorship registered in India decides why and how your personal data is processed through the Platform and is the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the "controller" under the GDPR where it applies. This policy also meets the requirements of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Personal data we collect

Data you give us: name, company, country, email address, phone or WhatsApp number, delivery details, the parts you request, messages, photographs, and ratings with comments.

Data about sellers and their staff: business and tax details (such as GST, PAN, IEC, Udyam), addresses, bank holder and bank name, documents uploaded for verification, signatory name, and login email.

Data collected automatically: the country your connection comes from (derived from your IP address by our hosting provider), device and browser information, pages visited, and the link or campaign that brought you to the Platform.

We do not ask for passwords of other services, payment card numbers or bank account numbers of buyers.

3. Why we use it (purposes and lawful basis)

We process personal data on the basis of your consent, which you give by submitting a form or message, and for legitimate uses permitted by Section 7 of the DPDP Act, in order to: (a) pass your quote request to the sellers you choose and let them reply; (b) answer your chat and support requests; (c) verify sellers and keep the Platform safe from fraud, spam and abuse; (d) moderate and publish ratings; (e) send service communications; (f) comply with law and respond to lawful requests of authorities; and (g) improve the Platform. We do not sell personal data.

4. Who we share it with

Sellers: when you send a quote request or chat about a seller's listing, that seller receives your contact details and request so that it can quote you. Each seller then processes your data as an independent data fiduciary under its own responsibility.

Service providers (data processors) acting on our instructions, for hosting, database and file storage, email and messaging. Some of them process data outside India, which is permitted under Section 16 of the DPDP Act except to countries restricted by the Government of India; we use providers with appropriate safeguards.

Authorities, courts or other persons where required by law, or to protect rights, safety or property; and a successor if the business is transferred.

5. How long we keep it

We keep personal data only as long as needed for the purposes above: generally for the duration of your enquiry or relationship and up to 8 years afterwards where needed to meet accounting, tax and legal obligations or to defend legal claims. Seller verification documents are kept for as long as the store is active and for 8 years after it closes. Data is then deleted or anonymised.

6. Security and breaches

We use reasonable security practices, including encryption in transit, access controls, private storage for documents and photographs, and limited staff access. No system is completely secure. In the event of a personal data breach, we will inform the Data Protection Board of India and affected persons as required by law.

7. Your rights

Subject to law, you may: obtain a summary of your personal data and how it is processed; ask us to correct, complete, update or erase it; withdraw your consent at any time (this does not affect processing before withdrawal, and some features may stop working); nominate another person to exercise your rights in case of death or incapacity; and have your grievance addressed.

If you are in the European Union or the United Kingdom, you also have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and the right to complain to your supervisory authority.

To exercise your rights, contact our Grievance Officer through the "Chat with us" button on this website. We will respond within the time required by law. If you are not satisfied, you may complain to the Data Protection Board of India.

8. Children

The Platform is a business service and is not intended for persons under 18. We do not knowingly process the personal data of children. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes

We may update this policy; the version published here, with its date, applies. Significant changes will be highlighted on the Platform.