Privacy policy

1. Who we are

Datbot Technologies, a partnership firm at First Floor, 191, OJ Mansion, Santhi Nagar, Alagapuram Periya Pudur, Salem 636016, Tamil Nadu, India, runs Datbot Market. We decide how your personal data is used here. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary. Where the EU General Data Protection Regulation or the UK GDPR applies to you, we are the controller.

2. What we collect

When you sign in. Your name, email address and an identifier from our sign-in service, which Microsoft runs for us. We never see your password.

When you register or claim a company. The company's details, and the contact person's name, email address and phone number. For a claim, the contact email and phone you give are kept with the claim.

When you ask to be introduced to a company. Your name, work email address, organisation, role or title if you give one, country, the purpose you select, and what you write. Submitting the form lets us review the request and reply to you; nothing in it is sent to the company, and your details are not shared with anyone unless you agree first. If you choose a business contact to share, we keep it. The country you give is recorded as your account's country if you have not set one.

When you post a requirement. Your name, work email, organisation, role if you give one, and country; what you need, materials, sector, quantity, frequency, date needed, delivery country and region, quality needs, budget band, and whether we may compare suppliers.

When you add a business contact. The address or number you type.

When you contact us. Whatever you choose to tell us.

When you use the Service. Pages viewed, searches made, and technical data such as browser type and time of access. We record actions taken on company records (who submitted what, and who approved it) as an audit trail. To limit abuse we keep short-lived counters keyed to a scrambled form of your network address. On our forms, Cloudflare Turnstile checks that you are not a bot; it receives your network address and browser signals.

Search words are counted anonymously: when a product search finds companies, we count the words and how many different visitors used them, without recording who searched, and show the most searched as popular searches. The counts are deleted after 56 days at most.

Records we must keep. The version of our Terms you accepted and when; and the results of checking company names, and the organisation name you type on a request, against the UN and US OFAC sanctions lists.

Usage measurement. On the public pages we use Umami, a cookieless analytics tool, to count page views. Each counted view carries the page address and the page title — on a company page the title is that company's name and city — the page you arrived from, an approximate location the tool works out from your network address (your country, and often your region and city), and your browser, operating system, device type, screen size and language. It never carries search text, form content or anything else you type. Umami also counts directory search outcomes together with the rough length of the search term, which filters were used, presses of the claim button, and — as bare counts carrying nothing else — how often the introduction request form was shown and how often one was successfully submitted. We measure only if you agree, and never under a Do Not Track or Global Privacy Control signal. Umami gives each visit a random identifier, so this is pseudonymous data, not anonymous data. It sets no cookies, records no session replays, builds no advertising profiles and does not follow you across other websites. It is switched off entirely for browsers that send a Do Not Track or Global Privacy Control signal, runs only on public pages — never on signed-in pages such as your dashboard or capability workspace — and is not linked to your account. We do not receive or store your IP address from it, and the measurement data is deleted by our analytics provider after six months at most.

3. Company records from public registers

Datbot Market lists companies from official business registers. For each company we load only its name, registry number, legal form, status, registered activity, registration date, and town, district or postal area. We load companies and other incorporated bodies only (in the United Kingdom that includes limited liability partnerships, which are bodies corporate), never sole traders or other partnerships. We never load the names of directors, officers, owners or members, street addresses, or dates of birth. Company pages show the company's public registration number from the official register.

Sometimes a company's own name contains a person's name. If it contains yours, ask us to remove the listing, through the contact form or at privacy@datbots.com: it is free, and we do it within 7 days. We remove the company's name, location and description and stop showing the page.

The registers we use:

• India: the Ministry of Corporate Affairs company master data, published on the Open Government Data Platform.

The full licence notices are in our Terms, section 3.

4. Why we use it, and on what basis

• To run your account and the services you ask for (introductions, requirements, company pages): because you asked us to, under our Terms (contract).
• To share your business contact with a supplier: only with your consent, which you can withdraw before it is shared.
• To publish company records from public registers: our legitimate interest in a directory of businesses, which the registers publish for that purpose. Company records are about companies; where one names a person, you can ask us to remove it.
• To screen company and organisation names against sanctions lists, and to keep the records of it: to meet the sanctions laws that apply to us and to the parties.
• To keep our Terms acceptances and the audit trail of who changed what: to show what was agreed and to trace published records to their source (legitimate interest; legal claims).
• To prevent abuse (counters, form protection): our legitimate interest in keeping the Service working.
• To measure use of public pages, and to record which link brought you to register a company: your consent.

5. What is public and what is not

Public. A company's name, its registered activity and status as the register records them, and its location, website and description, once published.

Never public. Contact person names, email addresses and telephone numbers. These are shown only to the company's own authorised representatives, to us, and — with consent — to a specific buyer at the point of an introduction.

We do not publish contact details on any page reachable without signing in.

6. Who we share it with

We do not sell personal data.

We share it with: the other party to an introduction, when both of you agree; our service providers, who act on our instructions: Microsoft (hosting, sign-in and email), Google (our mailboxes), Umami Software (usage measurement), and Cloudflare (form protection; Cloudflare also uses some of the signals for its own bot detection); and authorities, where the law requires it.

Umami receives no name, no email address, no company text and no message content.

7. Where it is stored

Our servers are in Sweden (European Union), with Microsoft Azure. A nightly backup copy is kept in India. Our team works from India. Umami stores the measurement data in the United States, and Cloudflare, Microsoft and Google may process data there.

Where data leaves the EU or the UK for a country without an adequacy decision, the transfer is covered by the European Commission's standard contractual clauses (and the UK addendum to them) in our providers' terms. The Digital Personal Data Protection Act, 2023 permits data collected in India to be stored outside India except where the Central Government restricts transfer to a particular country; no such restriction applies to where we store data.

8. How long we keep it

• Your account: until you close it. When you close it, your name, email address and the personal details in your requests, claims and contacts are removed.
• Company records: kept indefinitely. We do not delete company records (no part of this system is able to), so a listing we take down stops being public but the record of it is kept. A listing removed because its name is yours is kept emptied of its name, location and description (section 3). The removal route is below.
• Audit records: who submitted, changed or approved a company record — for at least seven years from the event. These outlive the listing because they are what makes a published record traceable to its source.
• Correspondence with us: when you write to us through the contact form, your name, email address and message are stored with it and kept until they are removed — at your request, or by us once they are no longer needed to answer you. Nothing here expires on a timer, so we publish no period for it. Removing them leaves the record that a message arrived and what was done about it.
• Introduction requests and requirements: when you ask to be introduced to a company or post a requirement, what you enter is stored with it and kept until it is removed, at your request or by us once it is no longer needed. Nothing here expires on a timer, so we publish no period for it. Removing it leaves the record that a request was made, about which listing, and how it ended.
• Usage measurement: the measurement data described in section 2 is deleted by our analytics provider after six months at most. We keep one number for each company page: its approximate views over the last 30 days, shown only to that company's owner. We keep nothing about individual visitors.
• Server logs: 30 days.
• Backups: daily copies for 35 days and monthly copies for up to 400 days. Something removed from Datbot Market stays in older backups until they expire.
• Kept without a fixed end: the record that you accepted our Terms, and sanctions-screening records.

If a listing about your company should not be here, tell us through the contact form.

A person reads every message. Where we take a listing down it stops appearing in the directory and in search. Nothing is erased: the record that the listing existed, and of who submitted it, is kept.

9. Your rights

You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it (including the publication of a register record), and to receive it in a reusable format. You can withdraw consent at any time. You can download your data and close your account from your account page. Under the Digital Personal Data Protection Act, 2023 you can also nominate someone to exercise these rights if you die or become incapacitated.

Write to privacy@datbots.com. We acknowledge within 72 hours and answer within 30 days. If a request under the GDPR or UK GDPR is complex, we may need up to two more months; we will tell you within the first 30 days. We may ask you to confirm your request from the email address the data is held under.

If you registered a company and withdraw consent, tell us, and we take the listing down: it stops appearing in the directory and in search. Records of what was published, and of who published it, are kept as described above.

If you are unhappy with our answer, you can complain to a supervisory authority: in the UK, the Information Commissioner's Office; in the EU, the authority where you live or work. In India you can raise a grievance with us, and then approach the Data Protection Board of India.

10. What we cannot erase

Some records stay even when you ask us to erase your data: the record that you accepted our Terms, sanctions-screening records, and the audit trail that lets a published company record be traced to its source. A business contact already given to the other party in a completed introduction stays with that party. Where any of this applies we tell you which records and why.

11. Cookies and browser storage

See the Cookies page.

12. Security

Access to personal data is restricted and logged. Sign-in is handled by an identity provider; we do not hold passwords. No system is perfectly secure, and we do not claim otherwise.

13. Children

The Service is for business use. It is not intended for anyone under 18.

14. Changes

We will publish any updated policy with a new effective date and tell registered users where the change is significant.

15. Contact

privacy@datbots.com, or write to us at the address above.