Login / Register

Privacy Policy

How The Loha Bazaar website and mobile apps collect, use, share and protect your personal data, and how to exercise your rights or delete your account.

Last updated: 23 October 2026

This Privacy Policy explains how The Loha Bazaar ("we", "us", "our") collects, uses, stores, shares and protects your personal data when you use our website https://thelohabazaar.com and our mobile apps for Android and iOS called "The Loha Bazaar" (together, the "Platform"). It also explains your rights and how to contact us.

The Loha Bazaar is a business-to-business (B2B) marketplace for iron and steel products such as TMT bars, billets, scrap and sheets. Buyers request quotations and sellers list products. Our team reviews listings and mediates every deal.

We process personal data in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules made under them. Under the DPDP Act, we are the "Data Fiduciary" for the personal data described in this policy, and you are the "Data Principal".

1. Who we are

2. Personal data we collect

We collect only the data we need to run the marketplace.

2.1 Data you give us

  • Account details: mobile phone number (used to log in), your name, email address, and whether you register as a Buyer or a Seller.
  • Business details: business or company name, GST number (optional), TAN number (optional, sellers), business address and state.
  • Messages: quotation requests, support requests and any messages you exchange with our team on the Platform, including the product they relate to.
  • Product listings (sellers): product name, HSN code, price, quantity, weighment preference, description and product photos you upload.
  • Forms and enquiries: details you enter in contact or enquiry forms on our website, such as your name, phone number, email and message.
  • Account deletion requests: the optional reason you give when you delete your account.

2.2 Data collected automatically

  • Device and app data (apps): a push notification token issued by Google Firebase Cloud Messaging, the platform (Android or iOS), the app version and build, and the device model name. We use these to deliver notifications, keep you signed in on that device and tell you when an update is required.
  • Login session data: a secure login token (stored on our servers only as a one-way hash), and the time it was last used.
  • Server logs: like most websites, our servers record technical information such as IP address, browser type, the pages or API endpoints requested and the date and time. We use this for security, abuse prevention (for example, limiting how many OTPs can be requested) and troubleshooting.
  • Cookies (website): our website uses essential cookies to keep you logged in and to keep the site secure. We do not use advertising cookies.

2.3 Data we do not collect

  • We do not collect your location, contacts, call logs or calendar.
  • Our apps do not read your SMS inbox. On Android, when you log in, Google Play services can show you a prompt asking whether the app may read the single OTP message we sent. The code is filled in only if you tap "Allow". On iPhone, the keyboard can suggest the code for you to enter. In both cases, only the OTP code is used and it is not stored by the app.
  • We do not use advertising identifiers, show ads, or track you across other companies' apps or websites.
  • We do not process payments on the Platform and do not collect card, UPI or bank account details.

3. Why we use your data (purposes)

  • To create and manage your account and verify your phone number using a one-time password (OTP).
  • To let buyers request quotations and let sellers list products and raise support requests.
  • To review and moderate product listings before they are published.
  • To communicate with you about your quotations, listings, deals and support requests by in-app message, push notification, SMS, email or phone.
  • To send service announcements to users (for example, about changes to the Platform).
  • To keep the Platform secure, prevent fraud and misuse, and enforce our Terms of Service.
  • To meet our legal obligations, including tax and GST record-keeping, and to respond to lawful requests from authorities.

We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

4. Consent and legal basis

We process your personal data on the basis of your consent, which you give when you register or use the Platform after reading this policy, and for the "legitimate uses" allowed under the DPDP Act, such as meeting legal obligations. You may withdraw your consent at any time by deleting your account (see section 8) or by writing to us. Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw consent, we may not be able to keep providing the services that depend on that data.

5. Who we share data with

We share personal data only as described below.

  • Our team: authorised staff of The Loha Bazaar who handle quotations, listings and support.
  • The other party to a deal: we mediate every deal. We share business details (such as company name, GST number, delivery state or address and contact details) with a buyer or seller only when it is needed to arrange a deal you have asked us to arrange. Buyers and sellers do not see each other's contact details on the Platform; our team shares only what is needed once both sides agree to proceed.
  • Service providers (data processors) who act on our instructions and only for the purposes below:
    • MSG91 (Walkover Web Solutions Pvt. Ltd., India): sends OTP and service SMS messages. Receives your phone number and the message text.
    • Google Firebase Cloud Messaging (Google LLC): delivers push notifications to the apps. Receives your device's push token and the notification content (for example, "New reply on Q-0010").
    • Hostinger: hosts our website, API and database on secure servers.
    • Hostinger email: sends service emails, such as replies to your enquiries.
  • Authorities: when required by law, court order or a lawful request from government agencies, or to protect the rights, property or safety of our users, the public or us.
  • Business transfers: if our business is merged, acquired or reorganised, your data may be transferred to the successor, who will remain bound by this policy.

Some service providers (such as Google) may process data on servers outside India. When that happens, we rely on their contractual safeguards and will follow any restrictions the Government of India notifies under the DPDP Act.

6. How long we keep your data

  • While your account is active: we keep your account, business details, messages and listings for as long as you have an account.
  • After you delete your account: we immediately remove or anonymise your personal data (name, email, phone number, address, GST and TAN numbers), sign you out on all devices, remove your push tokens and hide your product listings.
  • Records required by law: we may keep limited transaction records, such as quotation and deal records, as required by law, including Indian GST and tax record-keeping rules. These records are kept without your personal contact details and only for the period the law requires (currently up to 8 years). They are then deleted.
  • OTP and security data: OTPs expire within minutes. Login tokens expire after 90 days without use. Server logs are kept for up to 90 days for security purposes.

7. How we protect your data

  • All data sent between your device and our servers is encrypted in transit using HTTPS (TLS).
  • Login tokens are stored on our servers only as one-way hashes. OTPs are short-lived, and the number of attempts is limited.
  • Access to personal data is limited to authorised staff who need it for their work.
  • Uploaded files are checked to make sure they are valid images.

No system is completely secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by law.

8. Your rights

Under the DPDP Act and other applicable law, you have the right to:

  • Access: ask for a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with.
  • Correct and update: you can edit your name, address, state, GST number and (for sellers) company name and TAN number in the app under Profile, or on the website under My Account. To change your phone number or email, contact us.
  • Erase (delete your account): Deletion takes effect immediately, as described in section 6.
  • Withdraw consent: at any time, as described in section 4. You can also turn off push notifications in your device settings.
  • Grievance redressal: raise a complaint with our Grievance Officer (section 9).
  • Nominate: nominate another person to exercise your rights if you die or become incapacitated, by writing to us.

We will respond to requests within 30 days. We may need to verify your identity, for example by sending an OTP to your registered phone number, before acting on a request.

9. Grievance Officer

If you have a question, complaint or request about your personal data, contact our Grievance Officer:

We will acknowledge your grievance within 48 hours and try to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

The Platform is for businesses and adults only. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11. Links to other websites

The Platform may link to other websites, such as maps or partner sites. We are not responsible for their privacy practices. Please read their policies.

12. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top of this page. If the changes are significant, we will also notify you in the app, by notification or by email before they take effect. If you continue to use the Platform after the changes take effect, you accept the updated policy.

13. Contact us

The Loha Bazaar
Email: info@thelohabazaar.com
Phone: +91 90561 90561
Website: https://thelohabazaar.com/contact