Data Collection, Protection, and Privacy Policy

1. Introduction and Scope

Welcome to 21 Hectares Agrotech Private Limited. This Data Collection, Protection, and Privacy Policy outlines how we collect, process, store, and protect the digital personal data of farmers and our partners. This policy is strictly governed by the Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025. It applies to all data collected via our on-ground field agents, telephonic interactions, and digital systems.

2. Categories of Data Collected

We collect specific data points to facilitate transparent agricultural trade and optimize our supply chain. The data we collect includes:

• Personal Identity & Contact Information: Farmer Name, Village Name, Contact Numbers, and Photographs.
• Financial & Statutory Identifiers: Aadhaar details, PAN, Bank Account details, and Land Record Photographs.
• Agricultural & Operational Metrics: Total land size available for farming, crops grown year-round (including specifics like soybeans and castor), and the approximate stocked quantity of commodities currently held.

3. Collection Channels and Notice

All data is explicitly sourced through our authorized on-ground field agents (supervisors and field managers) via direct in-person meetings or telephonic conversations.

• Pre-Collection Notice: Before any data is collected, field agents are mandated to provide a clear, itemized notice explaining exactly what data is being requested and for what purpose.
• Multilingual Consent: This notice, along with the request for explicit affirmative consent, is made available in English, Gujarati, and other applicable regional languages as per the Eighth Schedule of the Constitution.
• Affirmative Action: Data is only recorded into our systems after receiving clear, verifiable consent (e.g., physical signature, digital checkbox, or recorded verbal agreement).

4. Purpose Limitation and Actionability

We process data strictly for the purposes for which it was collected. We categorize our processing into two distinct legal grounds:

• Statutory Compliance (Legal Obligation): Aadhaar, PAN, Bank Details, and Land Records are collected and processed exclusively to verify the source of agricultural produce and prove that material was purchased directly from a farmer. This is strictly for fulfilling GST exemption requirements and related statutory audits.
• Operational Efficiency (Explicit Consent): Crop details, stock quantities, and land sizes are utilized to forecast supply chain logistics, plan material procurement, and contact farmers (via call or SMS) with current commodity market rates to assess their intent to sell.

5. Data Storage, Access Controls, and Security

21 Hectares Agrotech Private Limited acts as the Data Fiduciary, ensuring robust security measures are in place to protect your digital personal data.

• Cloud Infrastructure: All digitized farmer data is securely hosted on our company-operated ERP system via Frappe Cloud (acting as the Data Processor).
• Role-Based Access Control (RBAC): Access is strictly limited by job function. Field supervisors using the CRM tool can only access data for individual farmers they directly interact with, preventing unauthorized bulk data extraction.
• Internal Confidentiality: Unhindered access to raw database exports is restricted exclusively to the Head of Back-End Operations and designated Data Analysts. All personnel with this level of access are legally bound by Non-Disclosure Agreements (NDAs) signed upon accepting their offer letters.
• Derived Insights: Marketing and operational teams are only provided with derived, actionable insights stripped of raw personal identifiers.

6. Third-Party Sharing and Disclosures

21 Hectares Agrotech Private Limited does not sell or share bulk personal data with unauthorized external entities. Data is only shared externally under the following strict conditions:

• URD GST Compliance: In procurement models where partner factories (such as Ihsedu) purchase directly from the farmer, necessary supplier data is shared with the purchasing entity exclusively to fulfill Unregistered Dealer (URD) GST compliance and Reverse Charge Mechanism (RCM) obligations.
• Aggregated Insights: When reporting on operational metrics or grant utilization all shared data is fully anonymized. Only aggregated trends, devoid of any digital personal data, are disclosed to external stakeholders.

7. Data Principal Rights

Under the DPDP Act 2023, farmers (Data Principals) hold the following rights regarding their personal data:

• Right to Access: The right to request confirmation of what personal data is being processed and obtain a summary of it.
• Right to Correction & Erasure: The right to request the correction of inaccurate data or the deletion of data once it is no longer needed for the specified purpose or legal compliance.
• Right to Withdraw Consent: The right to withdraw consent for operational and marketing communications at any time. (Note: Withdrawal does not affect data retained for statutory GST compliance).
• Right to Nominate: The right to nominate another individual to exercise these rights in the event of death or incapacity.
• Right to Grievance Redressal: The right to easily register a complaint regarding data processing.

8. Retention Timelines

We strictly enforce data minimization to ensure we only hold onto your personal information for as long as it is actively useful or legally required. Our retention periods are strictly divided by data type:

• CRM and Operational Data (Harvesting Season Cycle): All data collected for market updates, logistics, and operational efficiency (such as crop choices, available land size, and current stock quantities) is intrinsically tied to the agricultural cycle. This data is not stored indefinitely; it is systematically updated, overwritten, and replaced at the beginning of each new harvesting season to ensure our CRM reflects only your most current agricultural reality.
• Statutory Compliance Data (72 Months): Under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, we are legally mandated to retain all financial and trade compliance records—including your Name, Aadhaar/PAN, Bank Details, and Land Records used to prove direct farmer purchases—for a period of 72 months (6 years) from the due date of furnishing the annual GST return for the year in which the trade occurred. In the event of a pending tax audit or legal proceeding, this data will be retained until one year after the final disposal of the appeal or proceeding, as required by law.

9. Contact and Grievance Redressal

For any questions, requests to exercise rights, or to withdraw consent, please contact our designated Data Protection Officer:

Name: Mit Patel
Email: mit@bullagritech.in
Phone: 7624063599