Skip to Content
AI Copilot & Single Desk for 35+ Portals · Tender Search · Calculators +91 90963 85270 WhatsApp support@gemexpert.tech Login

Privacy Policy

This notice explains how GemExpert collects, uses and protects your personal data, and the rights set out in the Digital Personal Data Protection Act, 2023 (DPDP Act). It is written to support the Act and the phased Digital Personal Data Protection Rules, 2025 as their relevant provisions take effect.

Version: 2026-10-16.v2 · Effective: 16 October 2026.

1. Who we are (Data Fiduciary)

GemExpert is the Data Fiduciary that decides why and how your personal data is processed. You can reach us at support@gemexpert.tech or +91 90963 85270. Our Grievance Officer details are in section 10.

2. The personal data we collect

  • Identity & contact: your name, designation, firm name, email, phone, city/state.
  • Business / KYC: GSTIN, PAN, business type, turnover band, MSME/Udyam status, GeM seller/vendor ID — only where you provide them.
  • Enquiry details: the services you ask about, tender references, certification scope and anything you type into our forms.
  • Demo-booking data: your selected expert, date and time, timezone, meeting link, booking status, and the answers you submit through Odoo Appointments or Calendly.
  • Technical data: IP address, browser/device information and cookies (see our Cookie Policy).
  • Platform data (if you use the GemExpert application): account details, the firm documents/evidence you upload and the bids you track.
  • Google sign-in data (if you choose “Continue with Google”): the stable Google account identifier, verified email address and display name returned by Google. We do not receive or store your Google password, Google access token, refresh token or ID token.

3. Why we process it, and our lawful basis

We process your personal data on the basis of your consent (and, where applicable, the legitimate uses permitted by the DPDP Act) to: respond to your enquiry and provide the services you request; create and secure your account; verify your email address; authenticate you when you choose Google sign-in; prepare quotes and proposals; deliver and support the platform; meet legal, tax and audit obligations; and — only if you opt in — send you updates, offers and service communications by email, SMS and WhatsApp. We collect only the data needed for these purposes and we never sell your data.

4. Consent and how to withdraw it

Where we rely on consent, we ask for it with a clear, specific, affirmative action, and we record the version and time of your consent. You may withdraw your consent at any time — it is as easy to withdraw as it was to give. Use Manage your data or email the Grievance Officer. Withdrawal does not affect processing already carried out, and we will stop further processing for that purpose within a reasonable period.

5. Who we share it with

We may share personal data with Data Processors who act on our instructions (for example hosting, email/messaging and payment providers) under appropriate contracts, and with authorities where the law requires. If you choose Google sign-in, Google processes the sign-in request under its own privacy terms and sends us the identity fields listed in section 2. If the booking page identifies Calendly as the scheduling provider, Calendly processes the booking details you enter; Google Calendar and Google Meet may process invitation and meeting details when those integrations are used. We do not sell your data or share it for unrelated advertising.

6. How long we keep it

We keep personal data only for as long as needed for the purposes above or as required by law. Unfinished registration challenges and their security metadata are automatically removed after a short anti-abuse retention period. When you withdraw consent or ask us to erase your data, we will delete or anonymise it unless we must retain it for a legal obligation. Enquiry data for leads that do not proceed is reviewed and purged periodically.

7. How we protect it

We apply reasonable security safeguards: encryption in transit (HTTPS), role-based access control, audit trails on key records, isolation of your evidence, and restricted administrative access. Enterprise plans support private / on-prem storage. In the event of a personal data breach, we will notify the Data Protection Board of India and affected persons as required by the Act.

8. Your data choices and DPDP rights

  • Access — a summary of the personal data we process about you.
  • Correction & erasure — correct, complete, update or erase your personal data.
  • Grievance redressal — a readily available means to raise concerns (section 10).
  • Nomination — nominate another person to exercise your rights in the event of death or incapacity.
  • Withdraw consent — at any time (section 4).

Exercise any of these at Manage your data. We make these controls available now and will respond within the legal timelines applicable when a request is received.

9. Children's data

Our services are intended for persons aged 18 and above and are not directed at children. We do not knowingly collect children's data without verifiable parental consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

10. Grievance Officer & the Data Protection Board

If you have any concern about how your personal data is handled, contact our Grievance Officer:

Grievance Officer, GemExpert — support@gemexpert.tech, +91 90963 85270.

If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India when the relevant complaint provisions apply under the law's phased commencement.

11. Changes to this notice

We may update this notice from time to time. The version and effective date at the top reflect the current notice; material changes will be highlighted on this page.

This page is a general summary and not legal advice. For a specific agreement, contact support@gemexpert.tech.