Privacy Policy & Data Protection Statement

1 Introduction & Identity of Data Fiduciary

Suryam Pvt.Ltd (CIN: U35105BR2026PTC087978), having its primary registered office at NH28, Banjari Road, Gopalganj, Bihar 841428 ("Company", "we", "our", or "us"), operates as an empanelled solar engineering, procurement, and construction (EPC) vendor facilitating rooftop solar enrollments under the Central Government's PM Surya Ghar: Muft Bijli Yojana.

This Privacy Policy sets forth our practices regarding the collection, handling, storage, encryption, and deletion of personal identifiable information (PII) collected from consumers, applicants, and field representatives in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2 Information We Collect & Lawful Purpose

We collect and process only the minimal personal data required to assess engineering feasibility, execute Discom technical clearance, and facilitate Central & State direct benefit transfer (DBT) subsidy approvals:

• Applicant Identity: Full Name, Father's Name, contact phone number, and email address.
• Property & Installation Location: Physical consumer address, district, state, pincode, and approximate rooftop area.
• Electricity CA Connection Details: Consumer Account (CA) number, Discom division (e.g. NBPDCL / SBPDCL), existing sanctioned load (kW), and meter classification (Single/Three Phase).
• KYC & Subsidy Compliance: Aadhaar number (collected with explicit consent solely for linkage to the National Solar Portal at pmsuryaghar.gov.in), copy of electricity bill, and bank passbook for direct subsidy credit.

3 Technical Data Security & Encryption at Rest

All sensitive customer records (including Aadhaar numbers, phone numbers, electricity account numbers, and bank records) are encrypted at rest using authenticated AES-256-GCM (Galois/Counter Mode) with random 96-bit initialization vectors. Encryption keys are securely managed through environment variables and are never stored in public repositories.

Our systems enforce strict Role-Based Access Control (RBAC). Field executives can only inspect applications assigned directly to their authorized ID, with sensitive identifiers masked (e.g. •••• •••• 1234 for Aadhaar numbers). Staff members cannot export complete customer datasets. Administrative access is restricted to verified Directors via multi-factor password hashing (bcrypt, 12 rounds) and session invalidation.

4 Government Portals & Authorized Disclosures

We do not sell, rent, commercialize, or trade customer data with any third-party marketing agency. Consumer application data is transmitted exclusively to:

• National Solar Rooftop Portal (Ministry of New and Renewable Energy - MNRE) for direct Central Government DBT subsidy verification.
• North / South Bihar Power Distribution Company Ltd (NBPDCL / SBPDCL) for bi-directional net-metering feasibility and synchronization clearance.
• Empanelled Public Sector / Scheduled Commercial Banks (e.g. SBI, Canara Bank, PNB) only when the applicant explicitly opts for zero-down collateral-free solar loan facilitation.

5 Subsidy Disclaimer & Regulatory Truth in Advertising

6 Consumer Rights (Correction, Access & Erasure)

Under Section 11 of the DPDP Act 2023, every consumer has the following rights regarding their digital personal data:

• Right to Access: Request a summary of personal data held and processed by us.
• Right to Correction: Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure: Request deletion of data that is no longer required for the statutory purpose of solar installation or warranty maintenance.
• Right to Grievance Redressal: File a concern with our Data Protection Officer.

7 Grievance Officer & Contact Details