Privacy Policy

1. Who we are and what this policy covers

ENE Expo is operated by [Operator legal name], [company type] registered in India ([CIN]), with its registered office at [registered address]. In this policy “we”, “us” and “the platform” mean that company; “you” means any person who uses it.

This policy takes effect on [effective date] and replaces any earlier version. It covers four surfaces that run on one shared database:

1. 1.The public booking site, where visitors register, buy expo passes and post buying requirements.
2. 2.The exhibitor panel, where exhibitors onboard, book stalls, list products, buy lead credits and run ad campaigns.
3. 3.The admin panel, used by our own staff to run expos, review bookings and manage users.
4. 4.The entry-scanning app, used by gate staff to scan pass QR codes.

We are the data fiduciary for the personal data described below, within the meaning of the Digital Personal Data Protection Act, 2023. Where an exhibitor uses lead data it has claimed for its own sales activity, that exhibitor is a separate data fiduciary for its own use of it.

2. What we collect

What we hold depends on which role your account has. Every account, whatever the role, has a name, a mobile number in E.164 form, an optional secondary mobile, an optional email address, a role and an active or inactive status.

We also hold an imported list of exhibitors from earlier editions of the expo — company name, GSTIN, contact name, email, phone number, the past expo attended and the stall size taken — supplied to us by the event organiser rather than by the person named. Records in that list may carry an internal note written by our staff.

When a visitor pays for a pass, an exhibitor pays for a stall, a lead pack or an ad campaign, we store the Razorpay order identifier, payment identifier, amount, currency and status, and the invoice fields needed for GST: buyer name, GSTIN, billing address, contact name, contact number, place of supply, HSN code and the tax lines. We never receive or store card numbers, UPI credentials, CVVs or bank passwords — those go directly to Razorpay.

We do not collect biometric data, government identity numbers other than GSTIN, health data, precise device location, or any special category of data.

3. How we use it

Every use below is tied to a purpose you gave consent for when you registered, or to a legal obligation we cannot avoid.

• Running your account. Creating it, signing you in by one-time password, keeping one active session per account, and letting you correct your own details.
• Verifying contact details. We send a one-time password to your mobile number, and to your email or secondary mobile when you add one. We store only a hash of that code, plus the attempt count, and discard it once it is used or expires.
• Selling and honouring passes. Issuing passes for the dates you choose, generating the QR token, admitting you at the gate, and rolling an unused paid pass over to a later date where the rules allow it.
• Matching buying requirements. Turning your requirement text and reference photo into a search vector, finding exhibitors whose listed products are the closest match, and offering the requirement to those exhibitors. Section 4 sets out what they then receive.
• Running stall bookings. Taking bookings during the booking window, running the allocation draw, collecting the advance and the balance, and issuing badges and amenities.
• Taking payment and issuing tax documents. Creating Razorpay orders, verifying payment signatures and webhooks, issuing proforma invoices, and keeping the records the GST and income-tax rules require.
• Product listings and search. Storing your product text, prices, units and images, and computing embeddings from them so visitors and our matching engine can find them.
• Reviewing advertising. Checking submitted creative against our rules, approving or rejecting it, and refunding a rejected campaign.
• Notifying you. Transactional messages you cannot switch off while your account is open — sign-in codes, payment receipts, booking and approval outcomes, lead notifications. Marketing messages about future expos only if you opt in, with an unsubscribe link in every one.
• Security and abuse. Detecting duplicate accounts, forged QR tokens, replayed payment callbacks and attempts to reach another exhibitor's data, and keeping the audit trail that lets us investigate.
• Legal compliance. Responding to a lawful order from a court, tax authority or law-enforcement agency.

We do not sell personal data. We do not share it with data brokers, do not use it for cross-context behavioural advertising, and do not use it to train any general-purpose AI model. Product embeddings are computed from listing text and product photographs, not from personal data.

4. Leads: what an exhibitor receives about you

This is the most consequential disclosure in this policy, so it has its own section. If you post a buying requirement, exhibitors will get your contact details. Read this before you post one.

When a visitor submits a requirement, the platform ranks exhibitors against it and offers the requirement to the matched exhibitors. Each requirement has a fixed number of claim slots. An exhibitor who spends one lead credit to claim a slot receives:

• Your name and the mobile number on your account.
• Your email address, where your account has one.
• The full text of the requirement, its category and keywords, the quantity and unit, the budget range you entered, and the reference photo you attached.

Once the claim slots for a requirement are full, no further exhibitor can claim it. Exhibitors who were matched but did not claim see only that a requirement exists in their category — not your identity or contact details.

A claim cannot be undone. We cannot recall a lead from an exhibitor who has already claimed it, and we cannot make that exhibitor delete it. What we can do is stop further disclosure: closing a requirement prevents any remaining slot from being claimed. You can close your own requirement from your dashboard, or ask us to close it.

Exhibitors accept binding conditions on lead data under clause 6 and clause 11 of the Terms and Conditions: they may use it to respond to your requirement, must not resell, publish or add it to a bulk marketing list, and must honour your request to stop contacting them. If an exhibitor breaks those conditions, tell us at [grievance email] and we will act on their account. We do not control what an exhibitor does after it has your details, and you should weigh that before posting.

A direct requirement you send to one named exhibitor is disclosed only to that exhibitor.

Exhibitors also receive nothing about visitors who merely attend — walking a hall, visiting a stall or having a pass scanned does not pass your details to anyone.

5. Who else sees your data

Beyond the exhibitor disclosure in section 4, your data reaches only the processors we need to run the platform. Each is bound by its own contract to process data on our instructions and for no other purpose.

Requirement text and reference photos are sent to Modal to be turned into a search vector. That text is your own free-form writing, so avoid putting personal details in it beyond what an exhibitor needs to quote you.

We also disclose data in three other situations:

• Event and venue operations. Aggregate footfall and pass-scan counts go to the venue and the organiser. These carry no names.
• Legal requirement. A court order, a statutory notice from a tax authority, or a law-enforcement request we are legally obliged to answer.
• Business transfer. If the platform or the company is acquired or merged, your data may transfer to the acquirer. We will give you at least 30 days' notice by email and in-app notice, and you may delete your account before the transfer.

We do not pass your data to any advertising network, analytics broker or marketing platform.

6. Sessions, cookies and device data

We use cookies for one purpose only: keeping you signed in. The session cookie holds your authentication token and is set when you complete a one-time password sign-in. Blocking it means you cannot sign in.

Each account may hold only one active session at a time. Signing in on a second device ends the session on the first. To enforce that, we store a session identifier and the time it was claimed against your account.

Our servers keep ordinary request logs — IP address, timestamp, the endpoint called and the response status — which we use to investigate errors and abuse. We infer nothing about your location from them beyond what is needed to spot suspicious access.

We run no advertising cookies, no third-party tracking pixels, no cross-site fingerprinting and no session-replay recording. There is nothing to opt out of, because there is no behavioural tracking to opt out of.

7. Storage, security and how long we keep things

All data is stored in managed cloud infrastructure in [primary region], encrypted in transit with TLS and at rest by the storage provider. Passwords and one-time codes are stored only as salted hashes; nobody at our company can read them.

Access is restricted at the database level, not just in the interface. Row-level security policies confine each exhibitor to its own records, so one exhibitor cannot read, infer or count another's bookings, products, leads or customers. Our staff reach personal data only through the admin panel, under their own named account, and their actions are logged.

Files are split across two stores. Product images and public expo media sit in a public bucket and can be read by anyone with the URL — do not upload anything confidential as a product image. Requirement reference photos, staff badge photographs and ad creative sit in a private bucket, reachable only through a short-lived signed link issued to someone entitled to see it.

How long we keep each kind of record:

Where the law requires us to keep a record after you have asked for erasure, we keep only that record and strip the personal fields we are not obliged to retain.

If a breach affects your personal data, we will notify the Data Protection Board of India and every affected person, as the Digital Personal Data Protection Act, 2023 requires. Our notice will say what happened, what data was involved, what we have done about it and what you should do.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

1. 1.Know what we hold. Ask for a summary of your personal data, the purposes we process it for, and the identities of everyone we have shared it with. Email [grievance email] with “Data access request” in the subject line.
2. 2.Correct it. Update your own name, mobile, email, company details and address in your profile. Where a field is locked after approval — GSTIN, for instance — email us and we will correct it.
3. 3.Have it erased. Ask us to delete your account and your personal data. We erase within 30 days, keeping only what section 7 says the law makes us keep.
4. 4.Withdraw consent. Withdraw consent for any purpose, as easily as you gave it. Withdrawing consent for a purpose the platform depends on means we can no longer provide it, and your account may be closed. Withdrawal does not undo processing already carried out lawfully, and it does not entitle you to a refund of a pass, booking or lead pack already used.
5. 5.Nominate someone. Nominate a person to exercise these rights on your behalf if you die or become incapable of doing so. Email [grievance email].
6. 6.Complain. Raise a grievance with us first, then with the Data Protection Board of India if we do not resolve it.

We respond to any of these within 30 days. We will ask you to confirm the request from the mobile number or email address on the account, because we must not act on a request from someone impersonating you.

Two limits worth stating plainly. A lead already claimed by an exhibitor cannot be recalled — see section 4. And transactional messages cannot be switched off while your account is open, because they carry sign-in codes, receipts and booking outcomes; marketing messages can be switched off at any time.

9. Children

The platform is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, and we run no verifiable parental-consent process, so a child cannot lawfully use it.

If we learn that an account belongs to someone under 18, we will close it and erase its data. A parent or guardian who believes a child has registered should write to [grievance email] and we will act within 72 hours.

A child may attend the expo on an accompanying adult's pass where the event rules allow it. In that case we hold no data about the child — the pass and the scan record belong to the adult.

10. Changes to this policy

We will update this policy as the platform changes and as the law develops. The date at the top always shows the current version.

For a change that materially affects how we use your data — a new category collected, a new recipient, a longer retention period — we will give you at least 30 days' notice by email and by notice in the platform before it takes effect. If the change requires your consent, we will ask for it rather than assume it.

For a correction that does not change what we do with your data, we will update the page and the date. If you disagree with a change, you may delete your account before it takes effect.

11. Contact us

[Operator legal name], [registered address].

We acknowledge every privacy request within 72 hours and resolve it within 30 days. If we have not resolved your grievance, you may complain to the Data Protection Board of India.