Privacy policy

Last updated: 17 October 2026

This policy explains how The North-Eastern Multi-State Integrated Agro Co-operative Society Ltd. (“NEMSICS”, “the Society”, “we”), registered under the Multi-State Co-operative Societies Act, 2002 (Regd. No. MSCS/CR/150/2002), processes personal data through www.nemsics.org and its marketplace pages. We process digital personal data in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, as applicable. For the purposes of the DPDP Act, NEMSICS is the Data Fiduciary.

1. Personal data we collect

We collect only what you give us through the website forms, WhatsApp or email, and only what is needed for the purpose stated on each form:

• Existing member confirmation: name, state, PIN code, mobile number, email, share folio / certificate / membership number and, if you choose, a copy of the share certificate.
• New member application: name, father’s / spouse’s name, date of birth, address, state, PIN code, mobile, email, occupation, nominee name and relation, copies of Aadhaar, PAN and a photograph, and payment details (payment reference, or UTR / screenshot for offline payments).
• Vendor application (“Sell with us”): applicant / organisation name, type, contact person, mobile, email, state, PIN code, product and marketing details and product links.
• Grievance / information request: name, mobile, email (optional), membership number (optional), details and any document you attach.
• Orders and enquiries: name, phone number, delivery address, PIN code and order details that you send us, including over WhatsApp.
• Status lookup: the reference number and mobile number you enter, used only to show the status of that request.
• Technical data: our hosting provider keeps standard server logs (such as IP address, browser type and pages requested) for security and operation. For spam and abuse protection, our forms keep a one-way (hashed) form of the IP address for a short time.

Online payments are processed by Razorpay. We do not receive or store your card, UPI PIN or net-banking credentials.

2. Why we use it

• to verify and maintain membership records and process membership applications as required under the MSCS Act, 2002 and the Society’s bye-laws;
• to receive payments and keep accounts;
• to review vendor applications and run the marketplace;
• to take, deliver and support orders;
• to answer grievances and information requests;
• to send you acknowledgements and updates about your request; and
• to comply with law and protect the website from misuse.

We process personal data on the basis of your consent, given on each form, or for legitimate uses permitted under section 7 of the DPDP Act (for example, where you voluntarily provide data for a specified purpose, or where processing is needed to comply with a law). We do not sell personal data and we do not use it for advertising.

3. Who we share it with

• Society staff and office-bearers who need it to handle your request;
• service providers who process data on our behalf: website hosting and email, Razorpay (payments) and Google (spreadsheets used for rates and vendor stock);
• for marketplace orders, the vendor who fulfils your order, limited to what is needed for delivery and invoicing;
• government authorities, regulators or courts where the law requires it.

The website also loads fonts from Google Fonts and links to WhatsApp, Razorpay and official government websites. Those services have their own privacy policies.

4. How long we keep it

We keep personal data only as long as it is needed for the purpose for which it was collected, or for longer if a law requires it (for example, the member registers and accounts the Society must keep under the MSCS Act, 2002 and tax laws). Documents you upload through the forms are sent by email to the head office and are not stored on the website. The website keeps a minimal status record (reference, name, contact details, type of request and status) in a private folder that is not publicly accessible. Retention period for these records: To be notified shortly.

5. Security

We take reasonable security safeguards to prevent personal data breaches, including encrypted connections (HTTPS), storing status records outside the public website folder, and limiting access to authorised staff. If a personal data breach occurs, we will inform the Data Protection Board of India and the affected persons as required by law.

6. Your rights

Under the DPDP Act you may:

• ask for a summary of the personal data we process about you and the processing activities;
• ask us to correct, complete, update or erase your personal data. We may keep data that the law requires us to keep, such as member registers;
• withdraw your consent at any time, as easily as you gave it. This does not affect processing already done. Some services, such as processing a membership application, may then not be possible;
• have your grievance addressed by us; and
• nominate another person to exercise your rights in the event of your death or incapacity.

To exercise these rights, write to the Grievance Officer below and give your reference number if you have one. We may need to verify your identity. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance redressal process.

When you share personal data with us, please make sure it is accurate and that you are authorised to share any data about other people (for example, a nominee).

7. Children

Membership and vendor applications are for adults (18 years or older). We do not knowingly process the personal data of children without verifiable consent of a parent or lawful guardian.

8. Cookies

The public website does not use advertising or analytics cookies. Your browser may remember your language choice locally. A security cookie is used only on the staff admin page.

9. Grievance Officer / contact for personal data

10. Changes

We may update this policy. The latest version will always be on this page with its date.