This Privacy Policy explains how [Legal business name] ("KisanCard", "we") collects, uses and protects personal data on kisanfarmerid.in. We follow the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.
1. Data we collect
From operators (account holders)
- Full name, mobile number (verified by OTP), email address (optional) and password (stored only as a secure one-way hash).
- Records of cards created, payments made and actions taken in the account.
About farmers (entered by the operator with the farmer's consent)
- Name (English and Marathi/Hindi), father's/guardian's name, date of birth, gender, mobile number, Farmer ID number, village, taluka, district, state, PIN code, land survey details and photograph.
- Aadhaar number — stored encrypted. We also keep the last four digits and a one-way keyed hash so the operator can find the farmer's card by Aadhaar without the full number being readable.
- A record of the farmer's consent (date, time and the operator who recorded it).
Payments
- Transaction reference, amount, status and payment method, received from our payment gateway (PayU).
- We never receive or store card numbers, CVV, UPI PIN, net-banking passwords or bank account details — these are handled directly by the payment gateway under its own security standards.
Website usage
- Pages visited, device type and referring website, linked to an anonymous visitor code made from a one-way hash. We do not store visitors' IP addresses in our analytics, and we exclude automated bots.
- Cookies: only essential cookies — your login session, a security (CSRF) token and your language choice. We do not use advertising or third-party tracking cookies.
2. Why we use it
- To provide the service: create the operator's account, generate and correct Farmer ID information cards, and let anyone verify a card by its QR code.
- To process payments and refunds, prevent fraud and keep records required by law.
- To provide support and send service messages such as OTPs.
- To improve the website using anonymous usage statistics.
We do not sell personal data and we do not use it for advertising.
3. Consent
Operators must take the farmer's informed consent before entering their details; the application form requires the operator to confirm it, and we record when it was given. A farmer may withdraw consent at any time by contacting the operator or us; we will then stop using their data, except where the law requires us to keep a record.
4. Sharing
- Payment gateway (PayU) — the operator's name, mobile number, email and the payment amount, to process the payment.
- Hosting and infrastructure providers in India that store our servers and backups, under confidentiality obligations.
- Authorities — only when required by law or a valid legal order.
The public card-verification page shows only the farmer's name, Farmer ID number and the card's issue date — never the Aadhaar number, address or mobile number.
5. Security
Data is transmitted over HTTPS, Aadhaar numbers are encrypted at rest, passwords are hashed, cards and photos are kept in private storage that only the creating operator can download, and access to the system is restricted and logged.
6. Retention
We keep operator and card data for as long as the operator's account is active, so that cards can be re-downloaded and verified, and afterwards only as long as required for legal, tax or dispute purposes. Payment records are retained as required by law.
7. Your rights
Under the DPDP Act, 2023 you may ask us to give you a summary of your personal data, correct or update it, erase it (where no law requires us to keep it), and you may nominate another person to exercise these rights. Write to our Grievance Officer using the details below. We may need to verify your identity before acting on a request.
8. Children
Operator accounts are only for adults (18+). Farmer cards are intended for adult farmers.
9. Grievance Officer
| Name | [Grievance officer name] |
|---|---|
| [Support email] | |
| Phone | [Support phone] |
| Address | [Registered address] |
We acknowledge grievances within 48 hours and resolve them within one month.
10. Changes
We may update this policy; the effective date above will change when we do.