Privacy Policy

Effective from: 4 October 2026  ·  Version: 2026-10-04

This Privacy Policy explains how BITZO PVT LTD (“BITZO”, the “Company”, “we”), having its office at Surat, Gujarat, India, collects, uses, shares, stores and protects your personal data when you use our website, mobile application and related services (the “Platform”), and what rights you have. It is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023 and the rules made under it, as and when they come into force.

For the data that we decide the purpose and means of, the Company is the Data Fiduciary. By creating an account and ticking “I agree”, or by using the Platform, you consent to the processing described here. If you do not agree, please do not use the Platform. You can withdraw your consent at any time (see section 10), but then we may not be able to provide the service.

1. Personal data we collect

1.1 Customers

• Account and profile: mobile number (required), name, city and area, e-mail address (optional), gender and date of birth (only if you add them), profile photograph (optional), and the categories you are interested in.
• Activity: bills and QR codes you claim, Points earned and redeemed, redemption requests and codes, businesses you follow, save or report, reviews (Happy / Unhappy), likes, dislikes, comments, posts shared, searches and city selection, notifications you receive and read.
• Messages and content: chat messages with businesses, enquiries you send, reports and the photographs or text you attach, and your messages to our support team through the Contact page.

1.2 Businesses (Sellers) and their representatives

• Owner name, mobile number, e-mail address, hashed password, business name, category, description, address, location (latitude / longitude), opening hours, contact numbers, website and social links, logo, cover image and photographs, Google business identifier if you use that feature.
• Billing details used for invoices (billing name, address, GSTIN where given), plan, wallet and payment history, ad campaigns, leads and enquiries received, support tickets and replies, and activity in the Seller Panel.
• Details of customers that the Platform shows you in order to run your rewards programme (see the Seller Terms).

1.3 Everyone

• Technical data: IP address, browser and device type, operating system, language, pages and features used, date and time, referring page, crash and security logs, and device or push-notification tokens if you allow notifications.
• Approximate or precise location: only if you allow your browser or device to share it (for example for the Map or “near me” features). You can refuse or withdraw this in your device settings.
• Cookies and similar technologies: see our Cookie Policy.

We do not ask you for card, bank account, UPI PIN or Aadhaar numbers. Payments for Business services are handled by our payment gateway; we receive only the payment status, amount and reference. Customers’ accounts have no password. Passwords of Business accounts are stored only in hashed form.

2. Where the data comes from

From you directly; from your use of the Platform; from businesses (for example when they create a bill for your mobile number); from your device and browser; and from service providers such as maps, messaging and payment services.

3. Why we use your data

1. To provide the service you asked for: create and secure your account, send OTPs, show businesses and offers near you, run Points, claims and redemptions, show your history, enable follow, save, reviews, posts and chat, and respond to your requests.
2. To run businesses’ rewards programmes: sharing the data needed so that a business can credit, check and honour your Points and answer your messages.
3. To keep the Platform safe: detect and prevent fraud, fake bills, duplicate and abusive accounts, spam, security incidents and misuse; enforce our Terms; moderate content, including with automated tools.
4. To communicate with you: service messages by SMS, WhatsApp, e-mail, in-app and push notifications (for example OTP, claim links, points and redemption updates, security and policy notices), and promotional messages where the law permits and you have not opted out.
5. To improve the Platform: understand how it is used, measure performance, fix errors, develop features, produce reports and statistics (including aggregated or de-identified data).
6. To bill and keep accounts: for businesses, invoicing, taxes, payments, refunds and wallet records.
7. To meet legal duties: comply with laws, court and government orders, respond to lawful requests, maintain records and resolve disputes.

We use your data only for these purposes or for another purpose that the law permits, and we tell you if we want to use it for something materially different.

4. Who we share data with

We do not sell your personal data. We share it only as follows:

1. Businesses you deal with. A business sees the information needed to run its rewards programme and to respond to you, such as your name, mobile number, e-mail address (if given), the bills and Points that relate to it, and your chat messages, reviews, follows and enquiries addressed to it. Businesses are responsible for what they do with this data under the Seller Terms and the law.
2. Public information. Your reviews, comments, posts and Happy / Unhappy feedback may be visible to others, usually with your name or initial and your photograph if you added one. Business profiles are public.
3. Service providers (data processors) that work for us under contract: cloud hosting and storage, e-mail and SMS / WhatsApp delivery, push notification and real-time messaging (chat), maps and location search, payment processing, content moderation and artificial-intelligence services that review text and images or help answer support requests, analytics and error monitoring, and customer-support tooling. They may use the data only to provide their service to us.
4. Authorities and legal process. Courts, police and government agencies, where required by law or in good faith to prevent or investigate an offence or protect rights, safety and security.
5. Advisers and business transfers. Auditors, lawyers and insurers under confidentiality, and a buyer or successor if the Company or its business is merged, sold or reorganised, who must honour this policy.
6. With your consent or at your request.

5. Where data is stored; transfers outside India

Data is stored on servers and cloud services that we or our providers operate. Some providers may process data outside India. Where we transfer personal data abroad, we do so only to the extent the law allows and with providers that give appropriate protection.

6. How long we keep data

When data is no longer needed, it is erased or anonymised, unless the law requires us to keep it.

7. How we protect data

We use reasonable security safeguards appropriate to the data, such as encrypted connections (HTTPS), access controls, hashed passwords, protection against automated abuse, logging and monitoring, and limits on who in our team can see data. No system is completely secure, and we cannot guarantee absolute security. If a personal data breach affects you, we will inform you and the authorities as the law requires. Please protect your OTP and your device, and never share your OTP.

8. Children

The Platform is for people aged 18 or over. We do not knowingly collect personal data of children. If you believe a child has given us data, write to us and we will delete it.

9. Cookies, notifications and communications

1. We use cookies and similar technologies as explained in the Cookie Policy.
2. You can turn off push notifications in your browser or device settings.
3. Promotional e-mails contain an unsubscribe link. For SMS or WhatsApp, follow the instruction in the message or write to us. We will still send service messages (such as OTPs and security or policy notices).

10. Your rights and choices

As a Data Principal you have the right, as provided by law, to:

• obtain a summary of the personal data we process about you and the processing activities, and the identities of those with whom we have shared it;
• ask us to correct inaccurate or misleading data, complete incomplete data and update it (you can edit most profile data yourself in Settings);
• ask us to erase your personal data when it is no longer needed for the purpose for which it was collected, unless we must retain it by law;
• withdraw your consent at any time (the consequences are described below);
• have your grievance redressed, and nominate another person to exercise your rights in the event of your death or incapacity.

To use these rights, write to our Grievance Officer (section 13) or through the Contact page. We may ask you to prove your identity first (for example with an OTP to your registered number). We respond within the time the law allows. If you withdraw consent or ask for erasure, we may be unable to provide the service, your account and Points may be closed, and we will keep what the law requires us to keep.

11. Automated tools and artificial intelligence

We use automated tools, including AI services, to help moderate text and images, detect fraud and abuse, and draft or suggest answers to support requests. Important decisions, such as removing a business, are not made by these tools alone without the possibility of human review. The content is shared with such providers only as needed for the feature.

12. Links and third-party websites

Businesses may link to their own sites, and the Platform contains links and maps from third parties. We do not control and are not responsible for their privacy practices. Please read their policies.

13. Grievance Officer and complaints

If you have a question or complaint about your personal data, contact:

Grievance Officer, BITZO PVT LTD
Surat, Gujarat, India
E-mail: contact@bitzomart.com

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India (once constituted) or other authority provided by law.

14. Changes to this policy

We may update this policy. The version and date are shown at the top. We will tell you about important changes on the Platform or by SMS / e-mail / notification, and may ask for your consent again where the law requires. Using the Platform after the change means that you accept it.

15. Governing law

This policy is governed by the laws of India. Disputes are subject to the jurisdiction clause of the Terms & Conditions (courts at Surat, Gujarat), without affecting any right you have under law.