Privacy Policy & Data Protection Charter
Official DocumentRIFAH Chamber of Commerce and Industry
1. Collection of Business KYC & Personal Credentials
RIFAH collects necessary business identity information, including entity registration documents (GSTIN, Udyam/MSME, PAN, CIN, LLPIN), enterprise contact details, director/authorized signatory KYC proofs, industry classifications, and product/service portfolios required for legitimate Chamber operations.
2. Purpose of Data Processing & Marketplace Visibility
Submitted information is utilized to authenticate enterprise credentials, populate public business directory profiles, enable algorithmic matching for B2B buyer inquiries, issue verified credentials, and facilitate networking introductions across local, state, and international chapters.
3. Membership Classifications, Rights & Corporate Nominees
Members enjoy defined directory privileges, RFQ broadcast limits, and networking entitlements based on their enrolled tier (Basic, Silver, Gold, Platinum, Patron). Corporate members may nominate up to two designated executives (directors, partners, or senior officers) to exercise voting rights and represent the enterprise at official Chamber assemblies.
4. Data Sharing Boundaries & Third-Party Protection
RIFAH does not rent, sell, or commercialize member contact databases to third-party telemarketers or external advertising networks. Data is shared strictly with authorized service partners (such as secure cloud hosting, payment gateways, and SMS/email delivery providers) solely for delivering core Chamber services under strict confidentiality agreements.
5. Official Verified Member Badge Guidelines
Enterprises that complete formal KYC screening are authorized to display the 'RIFAH Verified Member' digital crest on their website, business stationery, and product packaging. This authorization is conditional upon active membership status and immediately terminates upon suspension, non-renewal, or disciplinary revocation.
6. B2B Leads, RFQ Communications & Commercial Confidentiality
Business inquiries, quotation requests (RFQs), and partnership solicitations transmitted through the RIFAH portal are treated as proprietary commercial communications between prospective buyer and seller. While the platform facilitates routing, members are responsible for executing mutual non-disclosure agreements (NDAs) for sensitive proprietary trade secrets.
7. Information Security, Encryption & Access Controls
We implement modern administrative, technical, and physical safeguards—including SSL/TLS data transit encryption, encrypted database storage, role-based access permissions, and periodic vulnerability audits—to protect member KYC data and financial transaction records from unauthorized access, loss, or alteration.
8. Member Data Rights: Correction, Portability & Privacy Settings
Members maintain the right to view, correct, update, or adjust privacy visibility settings for their directory profiles at any time via their profile settings. Members can choose whether personal mobile numbers and executive emails are publicly visible or gated behind verified member login.
9. Chapter Governance, Ethical Review & Disciplinary Actions
The State and National Disciplinary Councils monitor adherence to the Chamber Code of Conduct. The Chamber reserves the right to suspend or expel any entity engaged in financial misrepresentation, harassment, counterfeit goods distribution, or statutory violations, which will result in immediate removal of all public listings and revocation of badges.
10. Statutory Disclosures, DPDP Act Compliance & Grievance Contact
RIFAH processes data in compliance with applicable data protection statutes, including the Digital Personal Data Protection (DPDP) Act. When required by lawful judicial or statutory orders from law enforcement agencies, the Chamber may disclose necessary records. For privacy queries, data requests, or grievances, members can reach the Chamber Data Officer at privacy@rifah.org.
11. Cookies, Analytics & Session Tracking
The RIFAH web platform utilizes standard session cookies, security tokens, and anonymized performance analytics to optimize navigation, maintain member login sessions, and measure directory engagement. Members can configure browser cookie controls, though disabling essential technical cookies may limit portal functionality.
12. Data Retention Schedules & Post-Membership Archival
Active member records are retained throughout the membership lifecycle. Following membership termination or voluntary exit, business profile pages are permanently unpublished. Basic accounting, invoicing, and transaction audit trails are archived for statutory retention periods mandated under corporate, tax, and trust compliance regulations before secure permanent deletion.
13. Photography, Audio-Visual Recordings & Media Consent
By participating in RIFAH conferences, trade expos, networking breakfasts, and public conclaves, members acknowledge that official photography, videography, and livestreaming may take place. The Chamber retains the right to utilize such event media in Chamber newsletters, annual reports, promotional videos, and official social media channels to document and highlight Chamber activities.
14. Cross-Border Data Transfers for International Delegations
When a member registers for international trade delegations, overseas bilateral business summits, or foreign embassy buyer meets, relevant enterprise profiles and delegate passport/KYC details may be transferred to accredited international partner chambers or diplomatic consular bodies solely for visa coordination and official delegation access.
15. Incident Notification & Data Breach Protocol
RIFAH maintains a structured incident management protocol. In the improbable event of a cybersecurity incident or confirmed data breach involving member personal identifiers, the Chamber shall notify affected members and appropriate statutory data protection authorities without undue delay in compliance with applicable data protection laws.
16. Google Account Authentication and Google Drive Integration
RIFAH Chamber of Commerce and Industry provides Google Drive integration within the RIFAH platform to facilitate document management, file uploads, downloads, document access, file organization, and synchronization features where supported. Users can voluntarily connect their Google Account to RIFAH using Google's official OAuth 2.0 authorization process. When a user connects their Google Account, Google displays the permissions requested by RIFAH. Users can review these permissions and choose whether to authorize the connection. RIFAH does not attempt to access Google Accounts without authorization or bypass Google's authentication and consent mechanisms.
17. Google User Data We Access
Depending on the features used and permissions authorized by the user, RIFAH may access the following Google Drive information: (A) Google Account Information — Google Account email address, basic account identification information necessary for authentication, and OAuth authentication and authorization tokens. (B) Google Drive File Information — file names and IDs, file types and MIME types, file sizes and timestamps, folder names and identifiers, file descriptions and metadata, and file ownership and sharing information where required. (C) Google Drive File Content — documents and files accessed through RIFAH, files selected for upload, download, editing, or document management, and file content required to perform an explicitly requested operation. RIFAH currently requests the Google Drive OAuth permission: https://www.googleapis.com/auth/drive. This permission allows RIFAH to view and manage files throughout the connected user's Google Drive. Although this permission enables broad technical access, RIFAH will use Google Drive information only for the disclosed RIFAH features and authorized user-requested operations.
18. Purpose of Accessing Google Drive Data
RIFAH uses Google Drive integration to provide the following functionality: (1) Connecting users' Google Accounts to the RIFAH platform. (2) Uploading documents and files to Google Drive when requested. (3) Viewing and accessing authorized documents. (4) Downloading documents selected by users. (5) Managing and organizing files and folders. (6) Updating or replacing documents when requested and supported. (7) Synchronizing file information between RIFAH and Google Drive where enabled. (8) Retrieving document metadata to display relevant file information within RIFAH. (9) Supporting authorized administrative, membership, operational, and document-management activities. RIFAH accesses Google Drive information only to provide these disclosed features and other specifically authorized functionality. RIFAH does not use Google user data for unrelated purposes.
19. Google Drive Data Storage and Processing
RIFAH may process Google Drive information through its application servers to provide the requested integration features. Depending on the operation, information may be temporarily processed or stored, including file metadata, document content, and authentication tokens. RIFAH will apply appropriate safeguards to protect Google user data, including: secure HTTPS/TLS communication, restricted access to application infrastructure, role-based access controls, secure handling of OAuth access and refresh tokens, protection against unauthorized access, modification, or disclosure, and appropriate security monitoring and incident management procedures. Google Drive files stored in a user's Google Account remain subject to Google's infrastructure, account settings, and applicable Google policies. Any copies or temporary information processed by RIFAH will be retained only as necessary to provide the requested functionality and meet applicable legal or operational requirements.
20. Google User Data Sharing and Limited Use
RIFAH does not sell, rent, trade, or commercially distribute Google user data. RIFAH does not use Google user data for advertising, targeted advertising, or unrelated marketing purposes. Google user data will not be transferred to third parties except where necessary and permitted for: providing the requested RIFAH functionality with the user's consent, operating and maintaining authorized application infrastructure, protecting application security and investigating abuse, complying with applicable legal obligations, or other transfers expressly permitted under Google's applicable policies. Third-party service providers may process information only to the extent necessary to provide authorized services and subject to appropriate confidentiality and data-protection obligations. RIFAH does not allow third parties to use Google user data for independent advertising, data brokerage, or unrelated commercial purposes.
21. Google API Services User Data Policy Compliance
RIFAH's access to and use of information obtained through Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements. In particular: Google user data will only be used for user-facing features that are clearly disclosed within the RIFAH platform; Google user data will not be sold or transferred to data brokers; Google user data will not be used for advertising purposes; Google user data will not be used to develop or train generalized artificial intelligence or machine learning models; Google user data will not be used for unrelated purposes; Google user data will not be disclosed to third parties except as permitted by Google's policies; and human access to Google user data will be restricted to circumstances permitted by Google's policies, including where the user has provided specific consent, where necessary for security investigations, to comply with applicable laws, or for other expressly permitted purposes. RIFAH will ensure that its use and transfer of Google user data remains consistent with the permissions granted by users and Google's applicable requirements. Official Google policy: https://developers.google.com/terms/api-services-user-data-policy
22. Google Account Disconnection and Revocation of Access
Users can disconnect their Google Account from RIFAH at any time. Users can also revoke RIFAH's access through their Google Account permissions settings at https://myaccount.google.com/permissions. After authorization is revoked: RIFAH will stop making new Google Drive API requests using the revoked authorization; associated OAuth tokens will be deleted or invalidated where applicable; Google Drive integration functionality requiring authorization will become unavailable; and users may reconnect their Google Account if they wish to use the integration again. Revoking Google permissions does not automatically delete documents already stored in the user's Google Drive. Users may separately request the deletion of information held by RIFAH.
23. Google Data Retention and Deletion
RIFAH retains Google-related information only for as long as necessary to provide the requested services, maintain security, fulfill operational requirements, or comply with applicable laws. Authentication tokens will be retained only while required for an authorized Google connection and will be deleted or invalidated following disconnection or revocation, subject to applicable requirements. Temporary file content, cached metadata, and other processed Google information will be deleted when no longer necessary for the purpose for which it was accessed. Where users request deletion of their information, RIFAH will process the request in accordance with applicable data protection obligations and legitimate statutory retention requirements. Users may submit deletion requests by contacting: office@rifah.org
24. Google Integration Consent and Privacy Support
Connecting Google Drive is optional and requires the user's authorization. Before granting access, users should review the permissions presented by Google's OAuth consent screen. RIFAH will not access information beyond the disclosed purposes or use Google data for a new purpose without providing the required disclosures and obtaining any necessary renewed consent. For questions regarding Google Account access, Google Drive integration, information processing, data retention, or deletion requests, users may contact RIFAH Chamber of Commerce and Industry, Privacy and Data Protection Contact, at office@rifah.org or visit https://rifahconnect.com or https://rifah.org. Last Updated: November 5, 2026.
