PRIVACY POLICY

• Marketplace Overview: NewSa (referred to as “NewSa”, “we”, “us”, or “our”) is a trust-based consumer-to-consumer (C2C) digital marketplace designed primarily for individual users to list, negotiate, discover, and purchase pre-owned and new goods.
• Corporate Details: The Platform is owned, managed, and operated exclusively by Circec Solutions Private Limited, a corporate entity legally incorporated under the Companies Act, 2013, with its registered corporate office located at Plot No. 160, HUDA Plots, Sector 56, Gurugram, Haryana, PIN - 122011, India.
• Data Fiduciary Assignment: For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and all other active data protection legislation within the Republic of India, Circec Solutions Private Limited acts strictly as the "Data Fiduciary". We determine the systemic purposes and technical means for processing personal data across the NewSa mobile applications (iOS and Android) and our official website (collectively defined as the “Platform”).
• Intermediary Status Limitation: In alignment with our Terms of Service, NewSa acts strictly as an electronic intermediary under Section 2(1)(w) of the Information Technology Act, 2000. The collection of information under this policy is strictly intended to maintain technology infrastructure, secure payment escrow facilities, and coordinate integrated logistics through third-party partners.

• Target Audience Applicability: This Privacy Policy applies comprehensively to every individual who accesses, browses, downloads, registers an account with, or transacts on the Platform, including Buyers, Sellers, and casual visitors.
• Third-Party Integrations Disclaimer: This policy does not apply to external websites, software programs, or digital services operated by third parties that you may interact with via external links or redirects on the Platform. All integrated third-party systems govern data handling under their respective corporate privacy policies.
• Contractual Affirmation: By downloading the app, utilizing the website, or completing the passwordless registration workflow, you confirm that you have read, understood, and consented to the data collection, transfer, processing, and retention practices outlined in this policy.
• Consent Options: Where local regulations explicitly mandate affirmative consent for processing specific forms of personal data, NewSa will request your express permission before executing the associated feature. You retain the absolute right to modify your device permissions or withdraw your consent, subject to operational limitations.

3.1 Information Directly Shared by the User:

• Authentication and Passwordless Login Credentials: To simplify account creation and protect user identity, initial registration does not require you to provide a verified accurate name. You must provide a valid Indian phone number linked to an active WhatsApp account. We do not collect or utilize passwords; authentication is executed strictly via secure One-Time Passwords (OTPs) delivered directly through WhatsApp.
• Profile Customization Metadata: Once logged in, you may choose to provide a public display name, biographical details, an avatar or profile image, date of birth, and gender to build marketplace trust.
• Interactive Platform Content Data: We collect and process all user-generated content and structural communications exchanged on the platform. This encompasses text logs, message attachments, and specific negotiation vectors transmitted within our in-app chat windows, product comment matrices, and the structured "Make Offer" module.
• Pickup and Destination Addresses: We collect precise delivery addresses from Buyers and physical pickup addresses from Sellers, including location snapshots captured when a Seller initializes a product listing.
• Listing Content and Media Uploads: We collect item titles, detailed descriptions, condition grading assessments, target prices, and any text or "stories" you submit. This includes physical files, photographs, and video clips uploaded directly from your device media library to showcase the asset.
• Transaction History and Negotiation Logs: We track every active operational event on the Platform, including items added to wishlists, instant "Buy Now" purchases, pricing counters recorded via our structured "Make Offer" tool, delivery timelines, and dispute filings.
• Identity Verification (KYC Data): To satisfy regulatory requirements and prevent fraud, NewSa requires identity validation checks before allowing users to utilize listing tools, engage in high-value transactions, or execute escrow fund withdrawals. This involves collecting government-issued identifiers (such as Aadhaar eKYC maps or PAN records) and processing data securely through authorized third-party identity verification service providers.
• Support and Operational Communications: We collect any text logs, media screenshots, or contact details you share when interacting with our support channels, communicating via our WhatsApp service framework, or presenting evidence to our Customer Mediation Team.

3.2 Information Collected via Automated Tracking:

• Device Characteristics and Telephony State: We automatically log device models, unique hardware identifiers, operating system versions, localized language configurations, network access states, mobile carrier names, and your current IP address.
• Stability and App Diagnostics: When an unexpected error or runtime crash occurs, we collect diagnostic data packets—including stack traces, internal application states, device configurations, and error timestamps—through highly secure framework handlers to ensure continuous application stability.
• Geo-Location Tracking: With your active device permission, we capture precise or approximate location coordinates to drive our address autocomplete modules, facilitate map configurations, and accurately calculate shipping fee matrices.
• System Log Files and Access Data: We capture server-side traces, application page views, request timestamps, and rate-limiting flags to secure our systems against automated extraction scripts or distributed denial-of-service attempts.
• Transactional Push Tokens: We generate unique device tokens through transactional notification engines to deliver alerts regarding counter-offers, order adjustments, and escrow payout completions directly to your device screen.

3.3 Data Sourced from Third-Party Partners:

• Financial Settlement Notifications: Because all payments and payouts are managed via our integrated payment gateway partner, Razorpay Software Private Limited, we receive instant data updates detailing the success, pending status, or failure of every transaction.
• Integrated Logistics Tracking: We receive real-time shipping milestones, delivery status confirmations, weight adjustments, and transit exception data from our third-party fulfillment operators.

3.4 Optimization and Advertising Disclosures:

• The Platform contains tracking scripts and analytics tags, including the Meta Pixel Tag, to evaluate overall engagement, map feature usage parameters, measure performance metrics, customize browsing structures, and power optimized marketing retargeting paths. We do not sell your personal data to unaffiliated third parties for their independent commercial use.

• Operational Minimal Access Mandate: The NewSa mobile application requests system permissions only when you interact with specific features. You can manage or revoke these permissions at any time through your operating system settings.
• Camera and Video Capture Access: Required to let you capture live product photographs, record item condition validation clips, or complete secure identity verification checks.
• Photo Library and Media System Picker: Required to let you select pre-recorded images and video assets from your device to attach to your marketplace listings. The application uses secure system pickers and does not scan your full media library.
• Precise and Approximate Location Access: Required to auto-populate shipping forms, calibrate pickup points, and verify that transactions originate within the geographic territory of India.
• Push Notification Routing: Required to deliver transaction alerts, offer updates, tracking notices, and system alerts to your device screen.
• Network, Internet, and Wi-Fi State: Required to maintain a connection to our secure database servers, complete API synchronization, and verify your network connection.
• Basic Telephony and Hardware Status: Utilized to verify app installation contexts and manage secure, token-based sessions without accessing call logs or personal contact books.
• Exclusion of High-Risk Permissions: The application does not request access to your personal contacts list, private SMS inbox, device microphone, Near Field Communication (NFC) modules, or files outside the items you explicitly upload to the Platform.

• Marketplace Operations and Infrastructure: To establish and manage your account framework, display product listings, process "Buy Now" choices, support the "Make Offer" negotiation tool, arrange shipping tracks, and maintain watchlists.
• Authentication and Access Protection: To transmit passwordless WhatsApp authentication OTPs, maintain secure token authorizations, verify device contexts, counter account duplication, and enforce strict rate limits.
• Financial Processing and Escrow Facilitation: To verify buyer payment execution, deduct platform commissions, manage statutory tax collections (TCS and TDS under Indian tax regulations), calculate dynamic shipping fee levels, and disburse escrow settlements to Sellers.
• Trust, Safety, and Dispute Mitigation: To complete identity verification (KYC), evaluate reported communications, filter malicious listings, deploy user block/report mechanisms, and enable our Customer Mediation Team to evaluate evidence.
• Platform Personalization and Marketing Retargeting: All data points, uploads, media assets, and search behaviors you share on the Platform are processed to personalize your browsing experience, display relevant content feeds, and optimize NewSa's marketing retargeting campaigns.
• Stability Upgrades and System Analytics: To evaluate application performance defects, map software stack traces, isolate server bottlenecks, and deploy system optimization patches.
• Legal and Regulatory Compliance: To satisfy statutory obligations under the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020, respond to lawful law enforcement directives, and defend the rights of NewSa and its users.

• Consent-Based Framework: In compliance with the DPDP Act, 2023, we process personal data based on the explicit consent you provide when initializing your account, adjusting app permissions, or updating your profile fields.
• Legitimate Uses and Contractual Fulfillment: We process information without additional consent where required to fulfill a service you have explicitly requested, such as executing a transaction contract between a Buyer and a Seller, collecting escrow funds, or coordinating logistics.
• Statutory Obligations: Data processing is executed where required to satisfy Indian legal mandates, including tax accounting, anti-money laundering regulations, and responding to valid judicial orders.
• Consequences of Consent Withdrawal: You may withdraw your processing consent at any time by contacting our Grievance Officer. If you choose to withdraw your consent, we will stop processing your data going forward, though this does not retroactively impact processing completed under your prior authorization. Certain features will stop working if the associated data is operationally essential.

• Transaction Participants Sharing: To complete C2C sales, we share transaction data between the participating parties. When a price is finalized, the Buyer’s delivery address is shared with the NewSa’s logistics partner, and limited transaction metadata is shared between the Buyer and Seller to facilitate fulfillment. Your public username, avatar image, active listings, and marketplace feedback are visible to all registered users.
• Reliable Data Processors and Service Partners: We share data with specialized third-party service providers who process information on our behalf under strict contractual mandates. We affirm that our partners are carefully selected, maintain a strong professional reputation, and handle data securely as per their terms and conditions. These providers manage transaction notification routing, push token delivery, map rendering, geocoding conversions, application error tracking, diagnostic logging, cloud storage frameworks, and database server infrastructure.
• Explicit Gateway Provider Sharing: All credit card, debit card, UPI IDs, netbanking credentials, and payment details are processed directly by our licensed gateway partner, Razorpay Software Private Limited. NewSa does not collect or store full payment card numbers or bank account log-in details.
• Integrated Logistics Network Sharing: Buyer and Seller contact information, shipping address tags, and packet dimensions are shared with our integrated third-party logistics network operators to manage transit, pickup, and Cash on Delivery (COD) balance collections.
• Regulatory and Legal Disclosures: We will share personal data with external law enforcement agencies, tax divisions, or judicial authorities if required to satisfy applicable law, respond to a subpoena, prevent financial fraud, or protect user safety.
• Corporate Reconstruction Events: If NewSa or Circec Solutions Private Limited undergoes a corporate merger, structural acquisition, asset sale, or financing cycle, user databases may be securely transferred as a business asset, subject to the privacy terms outlined in this policy.

• Direct Razorpay Processing: When a Buyer pays a listed price or settles a dynamic booking fee, their payment credentials are processed directly by Razorpay under its own security protocols.
• Transaction Metadata Retention: NewSa collects and retains transaction-level records, including order valuations, payment status updates, platform commission rates, buyer protection fees, shipping cost allocations, and withheld tax amounts (TCS/TDS). This information is maintained to support marketplace workflows, track escrow releases, and satisfy statutory tax obligations under Indian law.

• Built-in Channel Tracking: The Platform logs text data, uploaded files, and media links shared inside our in-app chat windows, product comment fields, and the structured "Make Offer" module.
• Moderation Auditing and Dispute Review: We actively log and moderate in-app communications along with all forms of user-generated content to verify compliance with our Platform Code of Conduct, identify off-platform transaction solicitations, evaluate reported user behavior, and enable our Customer Mediation Team to resolve active disputes.
• Off-Platform Disclaimer: As established in our Terms of Service, any communications or payment interactions conducted outside our platform fall entirely outside our terms. NewSa disclaims all liability for transaction losses, data compromises, or security issues resulting from off-platform user behavior.

• Pre-owned Hardware and Product Data Disclaimer: Users acknowledge that pre-owned digital hardware, electronic devices, storage media, or items transacted on the platform may contain residual personal data, configuration details, or files belonging to the original owner or third parties. NewSa acts strictly as an intermediary infrastructure conduit and disclaims all liability, accountability, or responsibility for any personal data loss, security exposure, data theft, or privacy infractions arising out of any residual or un-erased data shared, accessed, or transmitted via products transacted between users on the Platform.
• Local Caching Mechanisms: To support offline functionality and speed up browsing speeds across product listings, the NewSa mobile application caches specific data packets locally on your smartphone.
• On-Device Storage Frameworks: This includes maintaining secure, token-based login sessions within your device's native secure storage layer (such as the Android Keystore or iOS Keychain), storing localized configuration choices, and managing image caches. This cached information remains stored on your device and is cleared when you log out or uninstall the application.

• Statutory Tax and Financial Retention Window: To satisfy mandatory tax and accounting legislation within the Republic of India (including compliance parameters under the Central Goods and Services Tax Act, 2017, and the Income-tax Act, 1961), all transaction histories, invoicing records, fee ledgers, and identity validation (KYC) details are archived for a mandatory retention window of eight (8) financial years from the date of the transaction.
• Active User Account Data: General account profiles and biographical details are maintained while your account remains active.
• Long-Duration Authentication Sessions: To provide a convenient login experience, secure WhatsApp-delivered authentication tokens do not expire quickly; they are configured with a long expiration window of 365 days, unless revoked by logging out.
• Investigation and Active Dispute Lockups: If an account becomes involved in an open platform dispute, a fraudulent transaction claim, an active mediation review, or a law enforcement investigation, all associated records are placed on a strict compliance hold. This data is preserved regardless of account deletion requests until the dispute or investigation is fully resolved.
• Temporary Media Uploads Cleanup: Images or files uploaded to temporary staging servers that are not confirmed by publishing a product listing are automatically deleted within twenty-four hours.
• System Diagnostic Lifespans: System performance trace logs and application stability error files are retained for a limited window in accordance with industry-standard diagnostic platform baselines, after which they are automatically purged.
• Anonymization Framework: When personal records pass their respective statutory retention windows and are no longer required for legal compliance, NewSa will permanently delete the information or completely anonymize the datasets.

• Data Transfer Encryption: All network communication between the NewSa mobile applications or web servers is encrypted in transit using industry-standard Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.
• Platform Security Safeguards: We use secure cryptographic hashing for authentication tokens, maintain role-based internal access permissions, deploy security headers, log admin actions, and use request rate-limiting to counter automated threats.
• Statutory Breach Notification: While we use modern safeguards, no electronic system can be guaranteed completely secure against sophisticated threats. If we become aware of a personal data breach that impacts your records, NewSa will notify you and the relevant regulatory authorities within the timelines mandated under the DPDP Act, 2023.
• User Accountability: You must protect your device against unauthorized access and keep your WhatsApp communication channel secure to prevent unauthorized account access.

• Right to Summary and Access: You may request a plain-language summary of the specific personal datasets NewSa maintains regarding your identity, along with a list of the data processors with whom your records have been shared.
• Right to Correction and Completion: You possess the right to update inaccurate entries, modify outdated details, and complete partial data fields. Much of this information can be updated directly within your mobile app profile settings.
• Right to Erasure: You can request the deletion of your personal data where it is no longer operationally required to maintain your account. This can be executed via the explicit path: Profile -> My Profile -> Danger Zone -> Delete Account. This erasure remains subject to the 8-financial-year statutory archiving window for financial and tax records.
• Right to Consent Withdrawal: You can withdraw your processing consent at any time, recognizing that specific app features may become unavailable if the underlying data is required to run the service.
• Right to Nominate: In accordance with the DPDP Act, 2023, you retain the right to nominate another individual to exercise your privacy rights in the event of death or legal incapacity.
• Grievance Redressal Routes: You possess the right to escalate data handling complaints to our designated Grievance Officer. If a privacy issue cannot be resolved through our internal mediation framework, you can escalate the matter to the Data Protection Board of India.

• Adult Marketplace Limitation: The NewSa Platform is intended for use by individuals who are at least 18 years of age. We do not knowingly collect personal data from or maintain accounts for minors under the age of 18.
• Guardian Accountability: As set forth in our Terms of Service, if a minor accesses the platform via a parent or guardian's account, that guardian assumes full liability for all actions and financial obligations. If we discover that a minor's data has been collected without valid legal consent, we will delete the associated records. If you believe a minor has registered an account, please contact our support team immediately.

• Primary Domestic Hosting: Your personal data is stored and processed on secure cloud infrastructure located within the geographic territory of the Republic of India.
• Cross-Border Processing Disclosures: Certain specialized software services may process data elements on secure cloud systems outside India—such as tracking diagnostic app bugs or managing notifications. Where international data transfers occur, NewSa ensures that the transfer aligns with the compliance rules established under the DPDP Act, 2023, and that your information is protected under security terms that match this policy.

• Unilateral Modification Rights: NewSa reserves the absolute right to update, amend, or rewrite this Privacy Policy at any time at its sole discretion.
• Effective Date Application: Any updates or modifications become effective immediately upon the revised policy text being posted on the Platform.
• Notification Procedures: For significant updates, we will update the "Last Updated" timestamp at the top of this page and place a prominent alert banner inside the mobile application interface. Your continued account usage beyond the posting date constitutes acceptance of the modified Privacy Policy.

• Statutory Officer Assignment: In strict compliance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, all privacy questions, data deletion requests, or data handling complaints must be directed to our designated Grievance Officer:
• Name of the Officer: Harsh Ranjan
• Official Designation: Co-founder & Grievance Officer
• Physical Corporate Address: Circec Solutions Private Limited, Plot No. 160, HUDA Plots, Sector 56, Gurugram, Haryana, PIN - 122011, India
• Electronic Mail Address: support@newsa.in
• Direct Contact Number: +91-96508 74004
• Corporate Response Timelines: Our compliance division will officially acknowledge data privacy grievances within 24 hours of receipt, and a comprehensive resolution or formal response will be issued within 30 days. For general help queries, please reach out to support@newsa.in.