Privacy Policy

Who we are

Sutram is a tender and bid management product operated by BluePort Solutions. For the registration process described here, BluePort Solutions is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). You are the Data Principal.

What we collect, and why

Registration asks for four things on the first screen and the rest across seven sections. We collect only what a reviewer needs to decide whether to open an account, and what is needed to run it afterwards.

About the company

• Legal name, the country it is registered in, its type, incorporation date, registration number, industry and the year it started trading.
• Tax registrations: for an Indian company, PAN and — where they apply — GSTIN, TAN, Udyam number and Shop & Establishment licence number. For a company registered elsewhere, the name and number of its local tax registration instead.
• Registered address, and the office address when it differs.
• Company phone, email, billing email, an optional support email and website.
• Number of employees, turnover band, and how you heard about us.

Why: to confirm the company exists and is who it says it is, to issue invoices correctly, and to size and configure the account. The tax registrations are the part that makes verification possible without asking you for documents.

About people

• The person applying: name, email address, phone number, job title, and a username for the account that is created.
• The owner or director, when the applicant is not one: name, role, email, phone, nationality, and — for an Indian national — their personal PAN.
• A support contact: name, email, phone, how they prefer to be reached and when.

Why: the applicant’s email address is what proves the application is genuine, and becomes the first account. The owner’s details tell a reviewer they are dealing with somebody who can make a commercial decision. The support contact is who we call when something breaks.

Where you give us somebody else’s details — an owner, a support contact — you confirm you may do so and that they know.

Documents

If the registered premises are rented we ask for one page of the rent agreement: the page showing the parties and the address. We ask for one page rather than the whole document deliberately, because a full Indian rent agreement very often carries an Aadhaar number, and this system has a standing rule never to hold one.

Records of consent

When you submit, we record which version of these documents you agreed to, when, and the IP address the submission came from. Without the address the record cannot be placed, and a consent record that cannot be placed is not evidence of anything.

Technical

A session cookie so the form remembers where you were. It is HttpOnly, which means no script can read it. We use no analytics, advertising or tracking cookies on the registration site, and no third-party scripts run on it.

Our lawful basis

We process this on your consent under section 6 of the DPDP Act, given at the point of submission. Where a company becomes a customer, continued processing is on the basis of performing that contract.

How long we keep it

• A registration you never finish is removed after 30 days of no activity. We send a reminder after 24 hours and again after 15 days, and a warning three days before it goes.
• When it goes, we delete the company name, registration number, incorporation date, every tax registration, both addresses, the alternate phone, the billing and support emails, the consent IP, and every person you named. Any document you uploaded is deleted from disk by a job that runs every hour.
• What remains is a stub: that an application existed, the industry, the size, and the contact who started it — so we can tell you what happened if you ask, and so a repeated registration is recognisable.
• A registration you delete yourself is cleared the same way, immediately, and the company name is released for reuse.
• An account that goes live is kept for as long as the account exists, and afterwards only as long as tax and company law requires us to.
• Links we email you expire: a verification link after 24 hours, a resume link after 30 days, a password reset after one hour. The records of those links are deleted 30 days after they expire.

Who else sees it

We do not sell your data and we do not share it for advertising. It reaches:

• BluePort staff who review registrations, and only them.
• Our email provider, which delivers the messages this process sends — the address and the contents of those messages, and nothing else.
• Our hosting provider, on servers in India, where the data is stored.

The registration form looks up a PIN code against India Post’s public service to fill in the city and state for you. Only the six digits are sent — no name, no address, nothing identifying you — and if that service is unavailable the form carries on without it.

We do not transfer this data outside India.

Your rights

Under the DPDP Act you may ask us to:

• tell you what we hold about you and who we have shared it with;
• correct or complete anything that is wrong;
• erase it, where we are not required to keep it — you can delete an unsubmitted registration yourself, from your organisations page, at any time;
• withdraw your consent, which stops the processing that relies on it;
• nominate somebody to exercise these rights if you cannot.

Write to blueport.comp@gmail.com and we will respond. If you are not satisfied with how we handle it, you may complain to the Data Protection Board of India.

Keeping it safe

Passwords are stored hashed with Argon2 and are never readable, by us or anybody else. The site is served over HTTPS. Access to registration data is limited to the staff who review it. The database enforces separation between customers at row level, so one customer’s data cannot be read from another’s account.

No system is perfectly secure. If something happens that affects your data, we will tell you and the Data Protection Board as the Act requires.

Children

Sutram is a product for businesses and is not directed at children. We do not knowingly collect the data of anybody under 18.

Changes

If we change this policy we will publish it here with a new version date. The version you agreed to is recorded against your application and does not change retroactively — so the wording you consented to is always the wording that was on this page at the time.

Contact

BluePort Solutions — blueport.comp@gmail.com