ProcureRight

Privacy Policy

Privacy Notice

TRP Construction Manufacturing Private Limited will process the Personal Data you provide, including your name, contact details, business details, project information and other information submitted through this form, to respond to your enquiry, provide procurement-related services, process orders and provide customer support, as applicable.

For more information regarding the categories of Personal Data collected, purposes of processing, sharing, retention, security measures and your rights, please read our Privacy Policy.

Where processing requires your consent, you may withdraw your consent through the mechanism described in our Privacy Policy.

Last Updated on 07.09.2026

This Privacy Policy ("Policy") sets out the manner in which TRP Construction Management Private Limited, a company incorporated under the provisions of the Companies Act, 2013, ("TRP", or "Company"), collects, receives, records, stores, uses, processes, discloses, transfers, retains and otherwise deals with Personal Data and other information in connection with the use of the Company's website “www.procureright.in”, the “TRP Connect” mobile application, buyer portal, digital procurement platform, application programming interfaces (APIs), software interfaces and all other digital platforms, applications, websites, portals or services owned, operated or managed by the Company (collectively, the "Platform").

The Company recognises the importance of protecting the privacy of its Users and is committed to processing Personal Data in a lawful, fair, transparent and secure manner in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the rules framed thereunder and other applicable laws.

This Policy applies to all individuals and entities who access or use the Platform, including but not limited to buyers, registered Users, prospective customers, authorised representatives of business entities, suppliers and vendors, contractors and service providers, visitors to the Platform and any other person whose Personal Data is collected by the Company in connection with the Platform or its services.

This Policy does not apply to third-party websites, applications or services that may be linked to or accessible through the Platform. Users are advised to review the privacy policies of such third parties independently.

Definitions

For the purposes of this Policy, unless the context otherwise requires:

"Applicable Law" means all statutes, rules, regulations, notifications, governmental directions and judicial decisions applicable to the Company or the processing of Personal Data.

"Consent" means any free, specific, informed, unconditional and unambiguous indication of the User's agreement to the processing of Personal Data in accordance with applicable law.

"Data Fiduciary" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

"Data Principal" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

“Data Processor” shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

"Order" means any purchase order, procurement request, quotation acceptance or transaction initiated through the Platform.

"Personal Data" means any data about an individual who is identifiable by or in relation to such data and shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023.

"Platform" means the website www.procureright.in, the TRP Connect mobile application, buyer portal, digital procurement platform, APIs and all other digital platforms, websites, applications, portals or services owned, operated or managed by the Company.

"Processing" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023 and includes any operation performed on Personal Data, whether wholly or partly by automated means.

"User", "you" or "your" means any individual or legal entity accessing or using the Platform or otherwise providing information to the Company.

Personal Data We Collect

In the course of providing the Platform and related services, the Company may collect, receive, generate, verify or otherwise process Personal Data and other information directly from Users, automatically through the Platform, or from authorised third parties.

The categories of information processed by the Company include, but are not limited to, the following:

Registration and Identity Information

The Company may collect information including but not limited to user’s name, contact details, profile information voluntarily provided by the User, One Time Password (OTP) required for creating and maintaining a User account.

The Company uses OTP-based verification to authenticate Users during registration, login, password recovery and other account-related activities. OTPs are used solely for authentication and security purposes and are not retained beyond the period reasonably necessary for verification, except where retention is required for fraud prevention, audit, security or compliance with Applicable Law.

Business and Commercial Information

Where the User acts on behalf of a business or commercial entity, the Company may collect and process information including:

Transaction and Procurement Information

The Company may collect information relating to transactions undertaken through the Platform, including:

Project Information and Uploaded Content

The Platform enables Users to upload and share documents necessary for procurement and project execution.Accordingly, the Company may collect and process:

The User represents and warrants that it has all necessary rights and authorisations to upload such information and that such uploads do not infringe the rights of any third party.

Payment Information

The Company may collect information relating to payments made through the Platform, including:

The Company does not store complete debit card, credit card or banking credentials where payments are processed through authorised third-party payment gateways. Such payment information is collected and processed directly by the relevant payment service provider in accordance with its own privacy practices.

Communication Records

The Company may maintain records of communications exchanged with Users, including communications through:

Such records may be maintained for customer support, quality assurance, dispute resolution, legal compliance and service improvement.

Device, Technical and Usage Information

When a User accesses or interacts with the Platform, the Company may automatically collect technical and usage-related information, including:

browser type and version;

operating system;

device identifiers;

application version;

session information;

log files;

date and time of access;

pages visited;

clickstream data;

usage statistics;

diagnostic information;

crash reports;

cookies and similar technologies; and

other information relating to the operation and security of the Platform.

Location Information

Subject to the User's device settings and permissions, the Company may collect approximate or precise location information where necessary for delivery management, logistics coordination, supplier identification, fraud prevention, service optimisation or other legitimate business purposes.

The User may disable location permissions through the device settings; however, certain functionalities of the Platform may consequently become unavailable or operate with limited functionality.

Information Received from Third Parties

The Company may receive information relating to a User from authorised third parties, including:

payment gateway service providers;

suppliers;

manufacturers;

business partners;

identity verification service providers;

analytics providers; and

governmental or regulatory authorities, where required or permitted under Applicable Law.

Such information shall be processed in accordance with this Policy and Applicable Law.

How We Collect Information

The Company may collect information through one or more of the following means:

information uploaded or shared by the User, including BOQs, quotations, drawings, specifications and project documents;

information generated through Orders, procurement activities, payments, deliveries and other transactions;

communications exchanged between the User and the Company;

cookies, SDKs and other tracking technologies;

automated system logs generated through the User's interaction with the Platform;

authorised third-party service providers engaged by the Company; and

any other lawful means consistent with the purposes set out in this Policy and Applicable Law.

Purposes For Which We Process Personal Data

We process personal data only for specified and lawful purposes. Personal data may be processed for the following purposes:

Security and Fraud Prevention to protect the Platform; prevent unauthorised access; detect fraudulent or suspicious activity; investigate security incidents; and maintain system and transaction integrity.

Legal and Regulatory Compliance to comply with applicable laws; respond to lawful requests from governmental or regulatory authorities; comply with court orders and legal proceedings; maintain statutory records; and establish, exercise or defend legal claims.

Business Operations and Improvement to analyse Platform usage; improve products and services; troubleshoot technical issues; understand customer requirements; and improve user experience.

Marketing and Promotional Communications. Where required, TRP may process your personal data to send promotional communications, offers, product information, newsletters or other marketing communications based on your consent or another lawful basis available under applicable law. You may withdraw consent to marketing communications or opt out by using the unsubscribe mechanism contained in the communication or by contacting us through the details provided below.Withdrawal from marketing communications will not affect transactional or legally required communications.

Data Minimisation

TRP seeks to collect only such personal data as is reasonably necessary for the relevant purpose. The Users are requested not to upload or provide personal data belonging to another individual unless you are legally authorised to provide such information.

Where the user upload BOQs, project documents, drawings or other documents, the User shall ensure that such documents contain only information reasonably necessary for the procurement or project-related purpose.

Basis For Processing

Depending on the circumstances, TRP may process personal data:

On the basis of Consent: Where Consent is required, TRP will seek Consent in an appropriate manner. Consent may be withdrawn in accordance with applicable law.

For permitted legitimate uses: TRP may process personal data without separately obtaining consent where such processing is permitted under applicable law, including where processing is necessary for specified lawful purposes recognised under the DPDP Act.

Withdrawal of Consent

Where processing is based on Consent, you may withdraw your consent by contacting us through the channels specified in this Policy or through the functionality made available on the Platform. However, Please note that withdrawal of consent may affect our ability to provide certain products, services or functionalities where the relevant processing is necessary for providing them.Withdrawal of consent will not affect the lawfulness of processing undertaken before such withdrawal.

Sharing of Personal Data

TRP may share personal data where reasonably necessary for the purposes described in this Policy. This may include sharing with:

Service Providers: TRP may engage third-party service providers for payment processing, cloud storage, hosting; IT and software services; logistics and delivery; customer support; communication services; analytics; cybersecurity; and other operational requirements. Where such entities process personal data on behalf of TRP, appropriate contractual arrangements and safeguards shall be implemented as applicable.

Professional Advisers: Personal data may be shared with lawyers, auditors, accountants, consultants and other professional advisers, where reasonably necessary.

Government and Regulatory Authorities: Personal data may be disclosed where required by applicable law, court order, governmental direction or regulatory requirement.

Corporate Transactions: Personal data may be transferred or disclosed in connection with a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable law.

Data Processors

TRP may appoint third-party Data Processors to process personal data on its behalf. Such processors may include technology providers, hosting providers, cloud service providers, payment service providers, logistics providers, communication providers and other service providers.

TRP shall endeavour to ensure that appropriate contractual arrangements are entered into with relevant Data Processors and that they process personal data only for authorised purposes and in accordance with applicable requirements.

Data Security

TRP shall implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, unauthorised disclosure, misuse, alteration, loss, destruction and other security risks.

Security measures may include, as appropriate, access controls, authentication mechanisms, encryption or equivalent safeguards, secure hosting arrangements, logging and monitoring, employee access restrictions and contractual controls over service providers.

No electronic transmission or storage system can be guaranteed to be completely secure. Accordingly, while TRP takes reasonable measures to protect personal data, absolute security cannot be guaranteed.

Security Safeguards

TRP shall implement reasonable technical and organisational measures appropriate to the nature, volume and risk of Personal Data processed.

TRP shall periodically review its security safeguards and modify them where reasonably necessary.

No electronic system can be guaranteed to be completely secure. However, TRP shall take reasonable measures to reduce the likelihood and impact of unauthorised access or other security incidents.

Data Retention Principle

Retention of Personal Data collected by TRP is based upon the its original purpose, continuing business necessity, legal requirements, contractual obligations, dispute/litigation requirements, security requirements and other lawful grounds.

Where Personal Data is no longer required and no lawful retention requirement applies, TRP will delete, anonymise or otherwise dispose of it in accordance with its retention procedures.

Data Principal Rights

Subject to Applicable Law, a Data Principal may exercise applicable rights including:

Erasure Request

A Data Principal may request erasure where permitted by Applicable Law.

TRP may refuse or limit erasure where retention is required or permitted, including where necessary for legal compliance, taxation/accounting, contractual records, legal claims, fraud prevention, security, regulatory requirements or other lawful purposes.

Where erasure is completed, TRP shall take reasonable steps to ensure that the information is no longer available for ordinary processing, subject to lawful backup retention.

Withdrawal Request

Where consent is the basis of processing, the Data Principal may withdraw the Consent. TRP shall process the withdrawal request within the period of 15 days. Where processing continues on another lawful basis, TRP may continue such processing while informing the Data Principal where appropriate.

Children's Personal Data

The Platform is intended primarily for businesses and persons capable of entering into commercial transactions. TRP does not knowingly seek to collect Personal Data of children except where legally permitted and where the required Consent or other lawful mechanism is implemented.

Where processing of children's Personal Data is subject to specific requirements, TRP shall implement applicable safeguards.

Cookies and Similar Technologies

TRP may use cookies, SDKs, pixels, local storage, session identifiers, logs and similar technologies which may be used for authentication, security, functionality, preferences, analytics, performance, fraud prevention and marketing where permitted.

TRP ensures that where consent is legally required, appropriate consent shall be obtained.

Data Accuracy

TRP shall take reasonable steps to maintain accurate Personal Data where accuracy is necessary for the purpose of processing. Users shall be responsible for providing accurate and current information. User is obligated to promptly update information that becomes inaccurate.

Marketing Communications

Where required, TRP shall obtain consent before sending promotional communications. Users may unsubscribe using the unsubscribe link, SMS opt-out, account settings, email request or another mechanism notified by TRP.

Transactional messages, security notifications, account alerts and legally required communications may continue notwithstanding marketing preferences.

Changes To This Privacy Policy

TRP may amend this Privacy Policy to reflect changes in law, regulatory requirements, Platform changes, new processing activities, technology changes, changes to business operations or improved privacy practices.

Contact Details

TRP Construction Manufacturing Private Limited

Designated Privacy / Grievance Contact