Privacy Policy

This policy explains what personal data Nmjoy collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it under the Digital Personal Data Protection Act 2023 ("DPDP Act").

1. Who we are

Nmjoy
India
Grievance Officer: Nmjoy Grievance Officer (grievance@nmjoy.com)

Nmjoy ("we", "us") operates the Nmjoy marketplace and is the data fiduciary for the personal data described in this policy; you are the data principal. Privacy requests and questions go to privacy@nmjoy.com. Our Grievance Officer, Nmjoy Grievance Officer (grievance@nmjoy.com), is the contact for grievances about personal data.

2. What we collect

Account data. Your email address, display name, optional avatar, and how you sign in: your password, which we keep only as a one-way hash we cannot reverse, and, if you sign in with Google, the account identifier and verified email address Google gives us. We do not receive access to your Google account.

Sign-in data. For each device you are signed in on: when you signed in and last used it, and its IP address and browser user agent, so that you can see your sessions and end them. It is deleted when you sign out of that device or the session expires. If you turn on two-step sign-in, we also keep your authenticator key, encrypted, and one-way hashes of your recovery codes, until you turn it off; closing your account keeps them, unused. While you sign up or add a password, the details you entered and the one-way hash of your password wait, encrypted, in a cookie in your browser for up to 15 minutes until you enter the code we email you; we keep none of it until then. To limit repeated sign-in attempts, the first attempt from a browser gives it a random device identifier in a cookie; we keep a one-way hash of it and when it was first and last used, not linked to your account, and delete it after a year unused.

Seller data. If you open a store: your name, your email address, store name, description, and your payout details: either the recipient identifier your payout provider returns or, for providers that do not keep them, your bank account, UPI id or crypto wallet address, which we store encrypted. We do not collect PAN or GSTIN. If you attach advertising tags to your products, we store the tag identifiers you enter.

Transaction data. Orders and the products in them, amounts in rupees, payment status, and the payment identifier from our payment provider. We keep this as a business and tax record.

Subscription use. Each time you download a file or open one in the browser through a subscription: which product and file, which subscription, and when. We use it to apply the fair-use limit on subscription downloads and to show sellers how often their products are downloaded. Downloads of products you bought are not recorded.

Content you post. Reviews, questions, answers, and any reports you file, including the evidence links you attach.

Moderation and support data. Messages you send us, reports about you or your content, and the outcome and reason of any moderation decision.

Acceptance records. Which version of each agreement you accepted, when, and the IP address and browser user agent at that moment. We keep this so that both of us can prove what was agreed.

Technical data. Server logs, and an audit record of administrative actions taken on your account or content.

Cookie choice. Whether you accepted or declined advertising cookies, held in a cookie in your browser as our Cookie Policy describes.

We do not collect precise location, biometric data, or any other data beyond what is listed here, and we do not build profiles of your browsing.

3. Why we use it, and on what basis

We use personal data to create and run your account, process orders and deliver purchases, pay sellers, issue invoices and keep tax and accounting records, record which agreements you accepted, moderate content and handle reports, prevent fraud and abuse and handle payment disputes, send service email about your orders and account, keep the marketplace secure and running, and, only with your consent, measure and improve our own advertisements on Meta and let a seller's advertising provider know that their advertisement led to a view or a purchase of their product.

Under the DPDP Act we process personal data either with your consent or for a legitimate use recognised by section 7 of the Act:

Where we rely on your consent, it is specific to the purposes in this policy, and you may withdraw it at any time as described in section 9. Withdrawing consent stops future processing for that purpose but does not undo processing already done, and if the processing is necessary to run your account we will close it.

4. Who we share it with

We share the minimum each provider needs to do its job. Each provider acts as our data processor and is bound by a written contract that limits what it may do with the data.

We also share data with the following recipients, who are not our processors:

• Sellers. A seller sees that a sale of their product occurred, its value, and your display name where you have posted a review or question on their product. A seller sees how many times each of their products was downloaded through a subscription, but not by whom. Sellers do not receive your email address, payment details, or any other account data.
• Meta Platforms, our advertising partner, only with your consent. We use Meta's Meta Pixel to measure and improve our own advertisements. If you have accepted advertising cookies on the site you are on, our Meta Pixel runs on the Nmjoy marketplace and on sellers' store sites (a store's subdomain and its own domain), and your browser sends Meta: that you viewed a page, viewed a product, added one to your cart or started checkout, with the product's identifier and price; and for a purchase, the products delivered, the order value, its currency and the order identifier, so the purchase is not counted twice. Meta also collects your IP address and browser user agent as your browser sends them, the page address, and its "_fbp" and "_fbc" cookies. We do not send your name, email address, phone number, account details or payment details.
• Advertising and analytics providers chosen by sellers (Meta and Google), only with your consent. A seller may attach their own Meta Pixel or Google Analytics tag to a product. If you have accepted advertising cookies, then on that product's page, on the marketplace or the seller's store site, and on the seller's store site's order confirmation after a purchase made there, your browser sends the provider the product's identifier, its price or the amount you paid in rupees for that seller's products, and for a purchase an order reference so it is not counted twice. A seller's tags are the seller's responsibility. We do not send your name, email address, account details or payment details. Because your browser loads the tag from the provider, the provider also receives what a browser normally sends, such as your IP address and browser and device information, and may set its own cookies under its own policy. Our Cookie Policy describes this in full.
• Google, if you sign in with it. Google learns that you signed in to Nmjoy, as with any site that offers Google sign-in. We send Google nothing else; its own privacy policy governs what it does with that.
• Authorities and professional advisers. Where the law requires it, in response to a lawful order from a court or government agency, or to establish, exercise or defend legal claims.
• A successor business. If we sell or reorganise the business, the data may transfer to the new operator, who must honour this policy.

We do not sell personal data. The only advertising-related sharing is the consent-based reporting described above: to Meta for our own advertisements, and to a seller's provider for the seller's.

5. Processors

Our processors fall into the categories listed in section 4: payment, payout, email, and hosting and database services. A current list naming each provider, its role and where it processes data is available on request from privacy@nmjoy.com. We will tell you before adding a new category of processor by publishing a new version of this policy.

6. Our role and the role of sellers

We are the data fiduciary for the data described in this policy. Sellers are independent businesses. Where a seller receives your display name through a review or question, the sale data described in section 4, or the advertising events sent to their provider with your consent, the seller is a separate data fiduciary for that data and must handle it in accordance with the DPDP Act and our Seller Data Addendum, which forms part of our Seller Agreement. Meta and Google are separate data fiduciaries for what they do with advertising events once they receive them. We do not act as a processor for sellers, and sellers do not act as our processors.

7. Where data is processed

The marketplace serves India, and our providers may store or process data on servers outside India. The DPDP Act permits this except to countries the Central Government restricts by notification; we do not transfer personal data to any such country. Our payment provider keeps payment data in India as the Reserve Bank of India requires. Where you have consented to advertising cookies, Meta and Google process the events described in section 4 outside India, including in the United States. You may ask us at privacy@nmjoy.com where each provider processes data.

8. How long we keep it

What section 2 describes is kept while your account is open and after you close it; closing your account does not delete it. The only personal data we delete on a schedule is:

• Sign-in sessions. Deleted when you sign out of that device or the session expires.
• One-time sign-in tokens for a store's own address. Each works for up to a minute and is deleted once used, or within a day of expiring.
• Device identifiers. Deleted after a year unused.
• Authenticator set-ups never confirmed. Deleted after a day.

Some records must by law be kept for at least a minimum period: orders, payments, earnings, payouts and agreement acceptance records for 8 years from the end of the financial year of the transaction (the Income-tax Act 1961 and the Companies Act 2013), and server logs for 180 days (rule 3(1)(h) of the IT Rules 2021). We keep them for at least that long.

Closing your account. Closing your account signs you out everywhere and stops it being used to sign in. It hides your account, your store and its products, and your reviews, questions and answers from everyone else on the marketplace. It does not delete or anonymise anything: your account details, content, orders, payments and the other records above stay, marked as closed. You can open a new account with the same email address or Google account; it starts empty and is never joined to the closed one. Products you bought from a store that has closed stay in your library. We do not close or delete accounts for inactivity.

9. Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you, how we use it, and who we have shared it with;
• correct, complete or update inaccurate or incomplete data;
• erase data that we no longer need for the purpose it was collected or that we are not required by law to keep;
• withdraw consent at any time, as easily as you gave it;
• nominate another person to exercise these rights on your behalf if you die or are incapacitated; and
• have a grievance heard through our Grievance Officer and, if you are not satisfied, by the Data Protection Board of India.

To exercise a right, email privacy@nmjoy.com from the email address on your account, or use your account settings, where you can correct your details and close your account yourself. Closing your account is not erasure: it keeps your data, as section 8 says, so ask us by email to erase data. We respond within 30 days. We may ask you to verify your identity before acting. Grievances go to our Grievance Officer, Nmjoy Grievance Officer (grievance@nmjoy.com); we acknowledge within 24 hours and resolve within 15 days. You may approach the Data Protection Board of India once you have exhausted this route.

You must give us accurate information and not impersonate anyone or file a false or frivolous grievance; the DPDP Act treats these as duties of a data principal.

10. Security and breach notification

We restrict access to personal data to the people who need it, encrypt it in transit, and keep an audit log of administrative actions. No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected data principal in the manner and within the time the DPDP Act and its rules prescribe, and we report cyber security incidents to CERT-In where the Information Technology Act 2000 requires.

11. Automated decisions

We do not make any decision about you that is based solely on automated processing and that has legal or similarly significant effects on you. Every moderation decision, account suspension and ban is made or reviewed by a person.

12. Children

The marketplace is for people aged 18 and over. The DPDP Act requires verifiable parental consent before a child's personal data is processed, and we have no way to obtain it, so we do not open accounts for anyone younger. We do not knowingly collect data about a child and will delete it promptly if we learn we have.

13. Cookies

We set cookies that are strictly necessary to sign you in and keep your session, one cookie that remembers your cookie choice, and one that remembers a layout preference in the seller and admin workspace. Advertising tags load only after you choose "Accept" in the cookie notice on the site you are on, and never if you decline: our own Meta Pixel, on the marketplace and on sellers' store sites, to measure and improve our advertisements; and a seller's own Meta Pixel or Google Analytics tag, only on that seller's product pages and their store site's order confirmation, where the seller has attached one. You can withdraw your consent at any time through Cookie settings at the foot of any page, which stops both. Our Cookie Policy lists every cookie, what each one does, what the advertising tags send, and how to withdraw your consent.

14. Changes and version history

We publish every version of this policy, numbered and dated, so you can read the exact version that applied at any time. Where a change is material, we will notify you by email or by a notice on the marketplace before it takes effect. This is version 2. Version 2 added the consent-based advertising row in section 3, the advertising providers in section 4, their role in sections 6 and 7, and rewrote section 13, when sellers were able to attach their own advertising tags to their products. It also describes our own Meta Pixel in sections 3, 4 and 13, the record of subscription downloads and streams, and rewrote section 8 to say that closing an account hides it but keeps its data.

15. Contact

Privacy requests and questions: privacy@nmjoy.com. Grievance Officer: Nmjoy Grievance Officer (grievance@nmjoy.com). Our postal address, where set out, is in section 1 and in our Legal Notice.