Privacy Policy
This policy explains how BharatNex (“BharatNex”, “we”) handles personal data when you visit our website, request access, or use the BharatNex application to prepare customs filings. It is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules.
1. Who is responsible
BharatNex is used by customs brokers (CHAs) and their staff. Two kinds of personal data are involved, and the responsibility differs:
- Data about the people who use BharatNex (your account, sign-in and support messages): BharatNex decides how this is used and is the Data Fiduciary.
- Data in the customs work your company does (documents and details of importers, exporters, suppliers, buyers and their contacts): your company decides why it is processed and is the Data Fiduciary; BharatNex processes it only on your company's instructions, as its Data Processor. See the Data Processing Addendum. Questions from your own clients about that data should go to your company first.
2. What we collect
| Data | From | Why |
|---|---|---|
| Name, work email, phone, city, company name and message | The “Request access” form | To contact you and set up your company |
| Name, email, role, company; a password stored only as a one-way hash | Your administrator and you | To give you an account and control what you can do |
| Authenticator secret (encrypted) and recovery codes (stored only as hashes) | You, when you set up two-step sign-in | To protect your account |
| Sign-in sessions: IP address, browser and device type, time of last activity | Your browser | To keep you signed in, show you where you are signed in, and detect misuse |
| Activity log: what was done (e.g. a bill generated, a file downloaded), by whom, when, and the IP address | Your use of BharatNex | Security, traceability of filings, and resolving disputes |
| Customs documents and the details in them (invoices, packing lists, transport documents, certificates; names, addresses, IEC, PAN, GSTIN, bank AD codes) | Your company's uploads and masters | To prepare Bills of Entry, Shipping Bills, checklists, IGM / EGM and flat files (as Data Processor) |
| Emails from ICEGATE in a mailbox your company connects, and that mailbox's app password (encrypted) | Your company's mailbox, only if connected | To read SB / BE numbers and status that ICEGATE sends |
| A client's typed name, decision, note and IP address on a checklist approval link | The importer or exporter answering the link | To record that the client approved or asked for changes |
| Support messages and screenshots you send | You | To answer you |
| Usage information: pages opened and time on them, errors shown, Help searches. Never the values you type or document contents; emails, file names and long numbers are removed | Your use of BharatNex | To find where people have difficulty and improve BharatNex |
We do not collect more than this, we do not use your data for advertising, and we do not sell it.
3. Legal basis
We process data about users for the legitimate uses permitted by the DPDP Act, in particular to provide the service your company has signed up for and you have chosen to use, to meet legal obligations, and for security. Where we rely on your consent (for example, the Request access form), you may withdraw it at any time by writing to the Grievance Officer; this does not affect processing already done.
4. Who we share data with
Only with the service providers BharatNex needs to run, under contracts that require them to protect it, and only what each needs:
- Cloud hosting and storage: our cloud hosting provider, with servers in India. All application data and uploaded files are stored here, encrypted at rest.
- Anthropic, PBC (United States), the provider of the Claude AI model: when a document cannot be read by BharatNex's own rules (spreadsheets and most text PDFs are read without AI), that file is sent to Anthropic's API to read its contents. Anthropic processes it to return the result to us under its commercial terms, which do not permit it to train its models on this data. This is a transfer of personal data outside India; it is made only to provide the service, and not to any country restricted by the Government of India under section 16 of the DPDP Act.
- Government systems you use through BharatNex: DGFT (IEC details) and ICEGATE / eSanchit are opened in your own browser, with your own login. BharatNex does not send your data to them on its own, and never stores your ICEGATE password.
- Authorities, when the law requires it, for example a lawful order from a court or a government agency.
Public reference data (customs tariff, notifications, exchange rates, the district list) is fetched from government websites; no personal data is sent to fetch it.
5. How long we keep it
- Your account: while it is active. Sign-in sessions end after 7 days, or 12 hours without activity.
- Usage information: 90 days.
- Your company's customs data, activity log and support messages: for as long as your company uses BharatNex, then 30 days after the account is closed (so it can be downloaded first), after which it is deleted, unless the law requires us to keep part of it longer. Customs brokers have their own record-keeping duties under the Customs Brokers Licensing Regulations; keep your own copies of filings.
- Backups are overwritten on a rolling basis and may hold deleted data for a short time.
6. Security
Connections are encrypted (HTTPS). Files and data are encrypted at rest. Passwords are stored as Argon2 hashes; secrets such as authenticator keys and mailbox app passwords are encrypted. Administrators must use two-step sign-in. Accounts are locked after repeated failed sign-ins, requests are limited per user, files are checked by content, and downloads of filings are logged and traceable. Only people who need to (your company's users, and BharatNex staff for support and operations) can see data, and access is logged. If a personal data breach occurs, we will inform the Data Protection Board of India and the affected people as the DPDP Act requires, and your company where it concerns your data.
7. Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data about you we process and with whom we have shared it;
- correct, complete or update it, or erase it when it is no longer needed for the purpose (subject to legal retention);
- withdraw consent you have given;
- nominate someone to exercise these rights if you die or become unable to;
- resolve a grievance. Write to the Grievance Officer (below); we will respond within the time the law requires. If you are not satisfied, you may complain to the Data Protection Board of India.
For data in your company's customs work, ask your company (the Data Fiduciary); we help them respond.
8. Children
BharatNex is a business service and is not meant for anyone under 18. We do not knowingly process children's data.
The BharatNex Chrome extension
The extension does one thing: when you click “Fetch from DGFT” in BharatNex, it opens DGFT's public “View any IEC” page, enters the IEC you asked for, and, after you type DGFT's captcha yourself, passes the details DGFT shows (firm name, address, branches, status) back to your BharatNex tab. It works only on BharatNex and on dgft.gov.in. It sends nothing to any other site, collects nothing else, keeps no history, and holds the one request in progress only until the details come back (at most 15 minutes). The details become part of your company's IEC master in BharatNex, as described above.
9. Cookies
We use only the cookies needed to sign you in, and remember your light / dark choice in your browser. No advertising or third-party tracking. See the Cookie Policy.
10. Changes
We may update this policy. We will show the new date above and, for significant changes, tell your company administrators in BharatNex or by email before they take effect.
11. Contact and Grievance Officer
Grievance Officer, BharatNex. Write to BharatNex support (Contact support, after signing in).