Data Protection Policy

Protection principles

• Collect only information needed for defined agriculture, commerce, service, KYC, support and compliance purposes.
• Use role-based access, RLS, signed private documents and server-side secret isolation.
• Maintain audit logs for sensitive admin actions where technically enabled.
• Limit access to staff and service providers with a legitimate business need.

Sensitive data

Aadhaar, PAN, bank details, KYC documents, payment events and admin security data require stronger controls including masking, hashing/encryption where implemented, private storage and reviewer authorization.

Incident response

Suspected data incidents should be reported to admin@garudaya.in. GARUDAYA should maintain internal incident classification, containment, notification and remediation procedures. [Legal approval required before production publication: GARUDAYA should confirm exact timelines, jurisdiction wording, fee treatment, regulatory classifications and escalation officers with counsel.]

Official contact and notices

Questions about data protection policy should be sent from the registered account email wherever possible. GARUDAYA may request order IDs, application IDs, invoice numbers, KYC references or proof of authority before sharing account-specific information. Official notices may be sent to legal@garudaya.in; operational support may be sent to support@garudaya.in. Registered office: C/O Sabita Jena Nuagam, Dasamundali, Sheragada, Aska, Ganjam – 761106, Odisha, India.