Privacy Policy

1. Who we are

Buy My Venture ("BMV", "we", "us", "our") is a marketplace operated by Cross-Link Square LLP, a limited liability partnership incorporated under the Limited Liability Partnership Act, 2008, having:

• Registered office: 1-GA-10, Jawahar Nagar, Jaipur, Rajasthan 302004
• Correspondence address: A-4, Deepak Marg, Adarsh Nagar, Jaipur, Rajasthan 302004
• PAN: AAQFC4254L  |  GSTIN: 08AAQFC4254L1ZZ
• Email: admin@buymyventure.com  |  Phone: +91-8005971717

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Cross-Link Square LLP is the Data Fiduciary in respect of personal data processed through the Platform. You are the Data Principal.

2. Scope

This Policy applies to the website buymyventure.com, all sub-domains, the seller portal, the buyer portal, the advisor portal, the admin console, and all associated communications (collectively, the "Platform").

This Policy should be read together with our Terms and Conditions, Confidentiality Policy, Cookie Policy, Refund & Cancellation Policy and Data Deletion Policy.

3. Personal data we collect

3.1 Information you give us

3.2 Information we collect automatically

IP address, browser type and version, device and operating system, referring URL, pages viewed, session duration, clickstream, approximate location derived from IP, and cookie identifiers. See our Cookie Policy.

3.3 Information from third parties

Payment status and limited payer details from our payment gateway; advertising and attribution identifiers from Google and Meta where you arrive via an advertisement; and publicly available business records (MCA, GST portal, company websites) used to verify a listing.

3.4 What we do not collect

We do not knowingly collect Aadhaar numbers, biometric data, health data, sexual orientation, caste, religion, or political affiliation. Please do not upload documents containing such data. If you must upload a KYC document, redact any field not required for the transaction.

3.5 The two valuation tools — an important distinction

We operate two separate valuation tools, and they behave differently.

(a) The free calculator on the home page. This is free, requires no sign-up, and captures nothing. The inputs you enter (sector, revenue, growth, margin, quality attributes) are processed in your session to produce an indicative range and are not stored, not logged against you, and not linked to any identifier, cookie or business. No personal data is collected. You may use it anonymously as often as you wish.

(b) The Valuation page used for marketing campaigns. This is a separate page, reached from our advertising and campaign links. It does collect and store information — your name, email, mobile number, business details and valuation inputs — only after you give consent through an express opt-in on that page. The notice on that page tells you what is collected and why before you submit. We use this data to send you your valuation report, to contact you about listing your business, and — where you have separately opted in — to send you promotional communications under Section 5. You may withdraw consent and request erasure at any time under Section 12.

If you want a valuation without giving us any data, use the home-page calculator.

4. Why we process your data

We process personal data for the following purposes:

1. To create and administer your account and verify your identity and eligibility.
2. To prepare, verify, curate and publish listings, including the buyer-facing Deal Pack.
3. To match buyers with sellers and to facilitate introductions, meetings and negotiations.
4. To process payments, raise invoices and comply with GST and income-tax obligations.
5. To administer NDAs, confidentiality gates and access controls.
6. To provide customer support and respond to grievances.
7. To send transactional and service communications.
8. To send promotional and marketing communications, where you have consented (see Section 5).
9. To detect, prevent and investigate fraud, impersonation, circumvention and misuse of the Platform.
10. To measure and improve the Platform, including analytics and advertising measurement.
11. To comply with law and to establish, exercise or defend legal claims.

5. Communications — transactional, promotional, email and RCS

5.1 Transactional communications

Once you register, we will send you service communications that are necessary to operate your account — verification codes, OTPs, payment receipts, invoices, listing status updates, NDA execution notices, buyer-interest alerts, security notices and policy changes. These are not promotional and you cannot opt out of them while your account remains active, because they are integral to the service. If you no longer wish to receive them, you must close your account.

5.2 Promotional and marketing communications

With your consent, we may contact you with marketing content — new listings matching your stated preferences, market reports, valuation insights, offers, discount coupons, webinars, product announcements and case studies. We may do this through:

• Email (including newsletters and drip campaigns);
• SMS;
• RCS (Rich Communication Services) business messaging, which may include rich cards, images, carousels, suggested replies and click-through buttons delivered to your default messaging application;
• Voice calls made by us or by an agency on our behalf;
• Push and in-app notifications;
• Personalised and re-targeted advertising on Google and Meta platforms.

5.3 Consent, DLT registration and opt-out

• We obtain your express, informed and specific consent before sending promotional communications. Consent is collected through an unticked opt-in checkbox at registration, or through a separate preference toggle in your account. Consent to marketing is never a condition of using the Platform.
• Where you supply your mobile number, you consent to receive SMS and RCS messages from us at that number, and you confirm that you are the lawful subscriber of that number.
• Our commercial communications are sent through registered telemarketer infrastructure and header/content templates registered on a DLT (Distributed Ledger Technology) platform in accordance with the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCP) and applicable directions. RCS business messages are sent through a verified sender profile.
• You may withdraw consent at any time, as easily as you gave it, by:
  • clicking Unsubscribe in the footer of any marketing email;
  • replying STOP to any SMS or RCS message from us;
  • using the block or unsubscribe control inside the RCS conversation in your messaging application;
  • updating Account → Communication Preferences on the Platform; or
  • writing to admin@buymyventure.com with the subject line "Withdraw Marketing Consent".
• We will action a withdrawal within 7 (seven) working days. You may continue to receive already-queued messages during this window.
• Withdrawing marketing consent does not affect the lawfulness of processing carried out before withdrawal, does not stop transactional communications, and does not by itself close your account.
• You may separately register your number under the National Customer Preference Register (NCPR / DND) with your telecom service provider. We honour NCPR preferences in addition to our own opt-out list.
• We do not sell, rent or licence your contact details to third parties for their own marketing.

6. Legal basis for processing

We process personal data on the basis of:

• Your consent, obtained through the notice presented at the point of collection, for marketing communications, optional cookies and any processing not covered below; and
• Legitimate uses under Section 7 of the DPDP Act — in particular, where you have voluntarily provided data for a specified purpose, for compliance with law or an order of a court, and for the performance of a contract with you.

7. How we share your data

We share personal data only as set out below.

7.1 Between users of the Platform

Seller identity and financial detail is withheld at browse stage. Listings are published as blind profiles — sector, geography, revenue band and headline metrics only. A Buyer sees identifying and financial detail only after completing profile verification, accepting the click-wrap NDA and paying the applicable unlock fee. See our Confidentiality Policy.

7.2 Service providers (processors)

Some rows below still need your confirmation — see the note after this document.

Each provider is bound by contract to process data only on our instructions, to maintain appropriate security, and not to use the data for its own purposes.

7.3 Professional advisers

Chartered accountants, valuers, company secretaries and lawyers engaged by us to verify a listing or advise on a transaction, in each case under a duty of confidentiality.

7.4 Legal and regulatory

Where disclosure is required by law, by a court or tribunal, or by a governmental, tax or law-enforcement authority; and where necessary to enforce our Terms, protect our rights, recover fees, or prevent fraud.

7.5 Business transfer

If Cross-Link Square LLP is itself reorganised, merged, or transfers the BMV business, your data may transfer to the successor, subject to this Policy.

8. Storage location and cross-border transfer

Your data is primarily stored on servers located in India (Mumbai region). Certain service providers listed above process limited data outside India. Where data is transferred outside India, we do so only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and under contractual safeguards requiring a standard of protection materially equivalent to this Policy.

9. Data security

We maintain reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000 and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the security safeguards required under Section 8(5) of the DPDP Act. Our measures include:

9.1 Technical measures

• Encryption of all data in transit using TLS 1.2 or higher; HSTS enforced on all endpoints.
• Encryption of data at rest, including uploaded documents, using AES-256.
• Row-Level Security (RLS) policies enforced at the database layer, so that a user's session can read only the records that user is authorised to see.
• Signed, short-lived URLs for access to uploaded documents; no public bucket access.
• Hashed and salted credential storage; multi-factor authentication available on user accounts and mandatory for all administrative accounts.
• Rate limiting, bot protection and input validation on all public forms.
• Automated encrypted backups with defined retention, and periodic restore testing.
• Logging and monitoring of administrative access to seller financial data.

9.2 Organisational measures

• Role-based access control on the principle of least privilege; staff access to seller financial documents is restricted to named personnel performing verification or Deal Pack curation.
• Confidentiality undertakings signed by every partner, employee, intern and contractor with access to user data.
• Written contracts with all processors imposing equivalent security obligations.
• Periodic access reviews, vulnerability assessment and patching.
• Segregation of production and testing environments; no live user data is used in test environments.

9.3 Your responsibilities

You are responsible for keeping your password confidential, for enabling multi-factor authentication, and for all activity under your account. Notify us immediately at admin@buymyventure.com if you suspect unauthorised access.

9.4 Limits of security

No method of transmission or storage is completely secure. While we implement the measures above, we cannot guarantee absolute security, and we do not accept liability for a breach occurring despite reasonable security practices, except as required by law and subject to the limitation of liability in our Terms and Conditions.

10. Personal data breach

In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act and the rules made under it, without undue delay after becoming aware of the breach. Our notice will describe the nature and extent of the breach, its likely consequences, the measures we have taken, and the steps you should take to protect yourself.

11. Retention

We erase or irreversibly anonymise personal data once the purpose is no longer served and no legal obligation requires retention.

12. Your rights

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and the processing activities undertaken;
• Correction, completion, updating and erasure of your personal data;
• Withdraw consent at any time, including marketing consent;
• Nominate another individual to exercise your rights in the event of your death or incapacity;
• Grievance redressal through the mechanism at Section 15 below, before approaching the Data Protection Board of India.

To exercise a right, write to admin@buymyventure.com from your registered email address. We will respond within 30 days. We may ask you to verify your identity before acting. Erasure may be refused or deferred where retention is required by law, or where the data is needed to complete a live transaction, defend a claim, or recover fees due.

Your duties. Under Section 15 of the DPDP Act, you must not impersonate another person, must not suppress material information, must not file a false or frivolous grievance, and must furnish only authentic and verifiably correct information.

13. Cookies

We use cookies and similar technologies. Please see our Cookie Policy for full details and for how to manage your preferences.

14. Children

The Platform is intended only for persons who are 18 years of age or older and competent to contract under the Indian Contract Act, 1872. We do not knowingly process the personal data of children. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we learn that a child has registered, we will delete the account and associated data.

15. Grievance Officer

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act:

We will acknowledge every complaint within 48 hours and dispose of it within one month of receipt.

16. Changes to this Policy

We may amend this Policy from time to time. The revised version will be posted at buymyventure.com/privacy with an updated "Last updated" date. Where the change is material, we will notify registered users by email at least 7 days before it takes effect. Continued use of the Platform after the effective date constitutes acceptance.

17. Governing law and jurisdiction

This Policy is governed by and construed in accordance with the laws of India. Subject to the grievance mechanism above, the courts at Jaipur, Rajasthan shall have exclusive jurisdiction over any dispute, claim or proceeding arising out of or in connection with this Policy, and you and we irrevocably submit to that jurisdiction and waive any objection on the ground of venue or forum non conveniens.

18. Contact

Cross-Link Square LLP
A-4, Deepak Marg, Adarsh Nagar, Jaipur, Rajasthan 302004
admin@buymyventure.com | +91-8005971717