Welcome to SugM ("we", "our", "us", or "SugM Technologies"). We are dedicated to maintaining the highest standards of data protection, transparency, and user privacy across our price discovery platform, web applications, and services located at https://sugm.shop.
This Privacy Policy fulfills mandatory statutory disclosure requirements under **India's Digital Personal Data Protection (DPDP) Act, 2023**, the **European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679)**, and the **Google API Services User Data Policy**.
1. Legal Preamble & Governance Scope
Under applicable global data protection frameworks:
- Data Fiduciary (DPDP Act 2023): SugM Technologies Private Limited acts as the "Data Fiduciary" for individuals located within India, determining the purpose and means of processing personal data.
- Data Controller (EU GDPR): SugM Technologies acts as the "Data Controller" under Article 4(7) of the GDPR for individuals located in the European Economic Area (EEA) and the United Kingdom.
- Data Principal / Data Subject: Refers to you, the individual user accessing SugM for market price discovery, seller interactions, or account management.
- Consent Manager: An entity registered with the Data Protection Board of India (DPBI) that enables Data Principals to give, manage, review, and withdraw consent through an accessible interface.
2. Lawful Bases for Processing
In strict adherence to GDPR Article 6 and Sections 4 & 7 of the DPDP Act 2023, SugM processes personal data only when supported by a valid statutory legal basis:
| Processing Purpose | DPDP Act 2023 Basis | EU GDPR Basis |
|---|---|---|
| Account Registration & Authentication | Explicit Consent (Sec. 6) | Performance of Contract (Art. 6(1)(b)) |
| Local Fresh Market Price Discovery | Explicit Consent (Sec. 6) | Performance of Contract (Art. 6(1)(b)) |
| Security, Abuse Detection & Anti-Scraping | Certain Legitimate Uses (Sec. 7) | Legitimate Interests (Art. 6(1)(f)) |
| Administrative Alerts & Transactional Emails | Explicit Consent (Sec. 6) | Performance of Contract (Art. 6(1)(b)) |
| Statutory Audits & Law Enforcement Compliance | Certain Legitimate Uses (Sec. 7) | Legal Obligation (Art. 6(1)(c)) |
3. Categories of Personal Data Collected
We collect minimal personal data necessary to operate our price discovery engine:
A. Profile Data via Third-Party OAuth (Google Sign-In)
When you authenticate via Google Sign-In, we request access only to basic profile scopes:
- Google User Identifier: Immutable, unique alphanumeric account ID provided by Google.
- Verified Email Address: Your primary Google email address for account communications.
- Full Name & Profile Image: Public display name and avatar URL for user identity within the app.
Security Guarantee: SugM does not request, store, or process your Google account password or private credentials at any time.
B. Technical & Location Information
- Market Geolocation Data: Approximate location derived from IP address or precise GPS coordinates (strictly subject to your explicit device permissions) used exclusively to present local market item prices.
- Telemetry & Device Logs: IP address, device model, browser user-agent string, operating system version, page access timestamps, and session tokens.
- Seller & Price Submission Data: Store names, item pricing reports, product photos, and market inventory updates submitted directly by users or registered vendors.
4. Itemized Purposes of Processing (DPDP Statutory Notice)
Pursuant to Section 5 of the DPDP Act 2023, this itemized notice informs Data Principals of the explicit purposes for processing personal data:
🔑 Identity Verification
Authenticating your identity and preventing unauthorized account takeover or imposter registrations.
🥗 Local Price Discovery
Aggregating and displaying real-time fresh item prices customized to your regional produce markets.
🛡️ Fraud & Spam Safeguards
Detecting false price submissions, automated bot scraping, malicious attacks, and platform exploitation.
📢 Service Communications
Sending vital security notifications, terms update notices, and responding to user support requests.
5. Google API User Data Policy Disclosure
Google API Limited Use Adherence
SugM’s use and transfer of information received from Google APIs to any other app will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Strict Adherence Principles:
- No Commercial Sale: We never sell, rent, license, or trade Google user data to data brokers, advertisers, or third parties.
- No Advertising Use: Google user data is never used or transferred for serving personalized, retargeted, or interest-based advertisements.
- No AI/ML Model Training: We do not use Google user data to build, train, evaluate, or refine generalized Artificial Intelligence (AI) or Machine Learning (ML) models.
- Human Access Prohibition: Human inspection of Google user data is forbidden except when explicitly authorized by you for technical troubleshooting, required for security investigations, or mandated by court order.
6. Data Principal & Data Subject Rights
Whether protected under India's DPDP Act 2023 or EU GDPR, you possess comprehensive statutory rights regarding your personal data:
| Statutory Right | DPDP Act 2023 Reference | EU GDPR Reference | Description & How to Exercise |
|---|---|---|---|
| Right to Access & Summary | Section 11 | Article 15 | Obtain a summary of personal data being processed and identities of Data Fiduciaries/Processors shared with. |
| Right to Correction & Erasure | Section 12 | Articles 16 & 17 | Request rectification of inaccurate records and complete erasure of personal data ("Right to be Forgotten"). |
| Right of Grievance Redressal | Section 13 | Article 77 | File formal grievances with SugM's Grievance Officer or escalate to DPBI / EU DPA. |
| Right to Nominate | Section 14 | N/A (National Law) | Nominate an individual to exercise data rights in the event of death or incapacity. |
| Right to Data Portability | N/A (Rules Pending) | Article 20 | Receive your personal data in a structured, machine-readable JSON/CSV format. |
| Right to Withdraw Consent | Section 6(4) | Article 7(3) | Withdraw consent easily at any time without affecting lawful processing prior to withdrawal. |
7. Statutory Duties of Data Principals (DPDP Sec. 15)
Section 15 of the DPDP Act 2023 establishes mandatory legal duties for Data Principals when exercising rights or submitting data on digital platforms:
- Duty of Legal Compliance: Comply with all applicable provisions of the DPDP Act 2023 while submitting personal data.
- Duty Against Impersonation: You must not impersonate another individual when providing personal information to SugM.
- Duty Against Data Suppression: You must not suppress material information when registering or completing account verification.
- Duty Against Frivolous Complaints: You must not lodge false, unverified, or frivolous complaints with SugM's Grievance Officer or the Data Protection Board of India.
- Duty of Authenticity: Ensure all information submitted (including seller listings and price reports) is authentic and accurate.
8. Minors & Children's Data Protection
SugM enforces strict protective mandates under Section 9 of the DPDP Act 2023 and GDPR Article 8 regarding minors:
- Age Limits: SugM is not intended for children under 18 years of age (DPDP Act 2023 definition) or under 16 years in the EEA without verifiable parental consent.
- No Tracking or Profiling: We do not conduct behavioral monitoring, targeted advertising, or profiling on children or minors.
- Parental Rights: If a parent or legal guardian discovers their minor child has registered an account without consent, contact privacy@sugm.shop for immediate account suspension and data destruction.
9. Data Sharing, Processors & Cross-Border Transfers
We do not sell personal data. Data sharing occurs exclusively with vetted Data Processors under strict Data Processing Agreements (DPAs):
- Cloud Infrastructure Providers: AWS & Google Cloud Platform for encrypted database hosting and server infrastructure.
- Cross-Border Transfer Safeguards (DPDP Sec. 16): Transfers outside India strictly comply with Government of India notified whitelist territories and regulatory mandates.
- International Transfers (GDPR Chapter V): Transfers outside the European Economic Area utilize EU Standard Contractual Clauses (SCCs) and adequacy decisions.
- Statutory & Legal Disclosures: Data may be disclosed to law enforcement or regulatory authorities pursuant to valid judicial orders or statutory mandates.
10. Data Retention & Storage Limitation
In accordance with Section 8(7) of the DPDP Act 2023 and GDPR Article 5(1)(e):
- Active Account Retention: Profile data is retained as long as your SugM account remains active.
- Automated Purge Lifecycle: Upon account deletion request or consent withdrawal, all personal data is permanently deleted or anonymized from active databases within 30 calendar days.
- Backup Purge: Encrypted backup snapshots are overwritten and purged within standard 60-day backup cycles.
11. Security Safeguards & Data Breach Notification
We enforce multi-layered administrative, technical, and physical security measures:
- Encryption Standards: TLS 1.3 encryption in transit and AES-256 storage encryption at rest.
- Access Restrictions: Zero-trust role-based access control (RBAC) limited to authorized engineering personnel.
- Statutory Breach SLA: In the event of a personal data breach affecting confidentiality or integrity, SugM will notify the **Data Protection Board of India (DPBI)**, competent **EU Data Protection Authorities**, and impacted Data Principals without undue delay.
12. Grievance Redressal Officer & Statutory Contacts
Pursuant to Section 13 of the DPDP Act 2023 and GDPR Articles 37-39, SugM has designated an official **Grievance Redressal Officer & Data Protection Officer**:
⚖️ Statutory Grievance Redressal Officer
Welcome to SugM ("we", "our", "us", or "SugM Technologies"). These Terms and Conditions ("Terms") constitute a legally binding agreement between you and SugM Technologies governing your access to and use of our website located at https://sugm.shop, applications, and price discovery services.
These Terms incorporate user obligations and privacy rights under **India's DPDP Act 2023** and **EU GDPR**. By registering, logging in via Google OAuth, or using SugM, you accept and agree to be bound by these Terms.
1. Binding Agreement & Regulatory Scope
By accessing SugM, you acknowledge that you have read, understood, and agree to be bound by these Terms and our integrated Privacy Policy. If you do not agree to these Terms, you must cease using our Services immediately.
2. Eligibility & Data Authenticity Duty
- Minimum Age: You must be at least 18 years old (or possess valid legal guardian consent if between 13 and 17 years old) to create an account on SugM.
- DPDP Statutory Duty (Sec. 15): You agree to provide true, accurate, and verifiable information. You are legally prohibited from impersonating any individual, suppressing material data, or registering false credentials.
- Account Security: You are responsible for safeguarding your login credentials and for all activities conducted under your user account.
3. Third-Party Authentication & Google Services
SugM enables account registration and login via Google OAuth (Google Sign-In):
- Scope of Access: You authorize SugM to receive basic public profile information (Google Account ID, verified email address, full name, profile avatar) strictly for authentication.
- Google Policy Compliance: SugM's handling of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Access Revocation: You may disconnect SugM's access to your Google account at any time through your Google Account Security Settings.
4. Acceptable Use & Prohibited Conduct
You strictly agree NOT to engage in any of the following prohibited activities:
- Submitting fraudulent, deceptive, or manipulated fresh produce market price reports.
- Scraping, crawling, or automated data extraction using bots, spiders, or scrapers without explicit written permission.
- Impersonating any individual, business entity, fresh produce vendor, or SugM representative.
- Circumventing, disabling, or tampering with platform security protocols, authentication mechanisms, or server infrastructure.
- Distributing malware, viruses, ransomware, or conducting Denial-of-Service (DoS/DDoS) attacks against SugM.
- Filing false, frivolous, or malicious complaints with the Grievance Officer or the Data Protection Board of India.
5. Intellectual Property & User Price Submissions
- Platform Ownership: All logos, trademarks, proprietary code, UI designs, graphics, and price aggregation software are the exclusive intellectual property of SugM Technologies Private Limited.
- User Price Submissions: You retain ownership of any price reports or market reviews you submit. However, by submitting content, you grant SugM a worldwide, non-exclusive, royalty-free, perpetual license to host, display, aggregate, and analyze price discovery data to deliver our core services.
6. Privacy Integration & Consent Management
Your privacy rights under the **DPDP Act 2023** and **GDPR** are fully incorporated into these Terms:
- You retain the right to access, correct, port, or erase your personal data at any time.
- You may withdraw your consent for optional data processing through account settings or by emailing privacy@sugm.shop.
7. Account Deletion & Data Purge Protocol
- Voluntary Termination: You may delete your account at any time via profile settings or by contacting customer support.
- Suspension for Breach: SugM reserves the right to suspend or terminate accounts immediately for violations of these Terms, fraud, or illegal conduct.
- Purge SLA: Following account termination, all personal data linked to your profile will be permanently erased or anonymized within 30 calendar days pursuant to our Privacy Policy.
8. Warranty Disclaimers
SugM is provided on an "AS IS" and "AS AVAILABLE" basis. Market price discovery data displayed on SugM represents crowdsourced and vendor-reported estimates. SugM makes no warranties, express or implied, regarding price accuracy, real-time availability, merchantability, or fitness for a particular commercial purpose.
9. Limitation of Liability
To the maximum extent permitted by applicable law, SugM Technologies, its directors, employees, or affiliates shall not be liable for any indirect, incidental, punitive, or consequential damages (including loss of profits, data corruption, or business interruption) arising out of your use of or inability to access the platform.
10. Governing Law, Grievance Escalation & Modifications
- Governing Law: These Terms shall be governed by and construed in accordance with the laws of India.
- Statutory Dispute Resolution: Any data privacy disputes shall first be submitted to SugM's Grievance Redressal Officer (grievance@sugm.shop). Unresolved statutory complaints may be escalated to the **Data Protection Board of India (DPBI)** under the DPDP Act 2023, without prejudice to mandatory rights reserved for EU residents under GDPR.
- Modifications: SugM reserves the right to update these Terms at any time. Material updates will be highlighted with a revised "Last Updated" date. Continued use of the platform after notice constitutes acceptance of updated Terms.