Privacy Policy & Data Protection Notice
Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023, India), the Information Technology Act, 2000, and RBI Payment Aggregator Guidelines.
1 Preamble & Statutory Scope
This Privacy Policy constitutes an official statutory notice under Section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") of India. This document explains how SDM Panel (operating at https://sdmpanel.co.in), acting as a Data Fiduciary, collects, processes, stores, secures, and transfers digital personal data belonging to natural persons ("Data Principals" or "Users").
By creating an account, browsing our website, depositing funds, or submitting orders through our automated API or graphical interface, you signify your free, specific, informed, unconditional, and unambiguous consent to the processing of your personal data in accordance with this Policy.
2 Categories of Personal Data Collected
In accordance with the principle of data minimization (processing only what is necessary), we collect and process the following categories of personal data:
- Full Name and Username
- Valid Email Address
- Encrypted Password Hash (Argon2id / bcrypt)
- Two-Factor Authentication Secret Keys (TOTP)
- Optional WhatsApp / Telegram / Skype Handles
- Payment Gateway Reference IDs (UTR, Transaction Hash)
- UPI VPA handles or payer identity metadata
- Deposit timestamps, amounts, and currency denominations
- Note: We NEVER store raw debit/credit card numbers or banking passwords.
- Target Public URLs submitted for promotion (Instagram, YouTube, Telegram)
- Order start count, quantity, and delivery progress logs
- We NEVER request or store your private social media account passwords.
- Internet Protocol (IP) Address and Geolocation (City/Region)
- Browser User-Agent, Device Fingerprint, Operating System
- API request headers, rate-limiting counters, and session cookies
3 Lawful Purpose of Data Processing (Sections 6 & 7)
We process personal data strictly under lawful grounds recognised by the DPDP Act 2023:
- Contractual Execution & Order Processing: To register your account, route automated wholesale orders through API dispatchers, credit wallet deposits, and maintain order logs.
- Fraud Prevention & Cyber Defense: To block credential stuffing, SQL injection, API abuse, multi-account abuse, and unauthorized chargeback attempts.
- Statutory Compliance & Tax Obligations: To comply with Indian taxation requirements, GST invoicing laws, and RBI regulatory oversight.
- Customer Support & Ticket Resolution: To authenticate account ownership and resolve customer support tickets and refill requests.
4 Rights of the Data Principal under DPDP Act 2023
The DPDP Act confers specific statutory rights upon you as a Data Principal. You may exercise any of these rights free of charge by contacting our Grievance Redressal Officer:
You have the right to obtain a summary of personal data being processed by us, the processing activities undertaken, and the identities of third-party data processors with whom such data has been shared.
You have the right to request correction of inaccurate data, completion of incomplete data, or permanent erasure of personal data that is no longer necessary for the purpose for which it was processed (subject to statutory financial retention limits).
You have the right to have readily available means of grievance redressal regarding our performance of obligations under the DPDP Act. Our Grievance Officer is mandated to respond within statutory periods.
You have the right to nominate any other individual who shall, in the event of death or incapacity of the Data Principal, exercise your rights in accordance with the provisions of the DPDP Act.
You have the right to withdraw your consent at any time with the same ease with which it was given. Upon receipt of such withdrawal, we will cease processing your personal data unless required or authorized under Indian law.
5 Protection of Children's Personal Data (Section 9)
In strict compliance with Section 9 of the DPDP Act 2023, SDM Panel does not knowingly enroll or process the personal data of any child (defined as any individual below eighteen years of age).
We do not engage in targeted advertising, behavioral tracking, or profiling directed at minors. Any account discovered to have been registered by a minor without verifiable parental consent will be terminated immediately and associated personal data purged.
6 Technical & Organizational Security Safeguards (Section 8(5))
SDM Panel deploys industry-grade organizational and technical measures to protect personal data against unauthorized access, alteration, disclosure, or accidental destruction:
- Cryptographic Password Protection: All passwords are salted and hashed utilizing state-of-the-art Argon2id / bcrypt algorithms. Passwords cannot be reverse-engineered or read in plaintext by any staff.
- Transport Layer Security (TLS 1.3): All network communications between your browser and our servers are encrypted via HTTPS (SSL/TLS 256-bit).
- SQL & Injection Defense: All database queries utilize parameterized prepared statements, preventing SQL and NoSQL injection vulnerabilities.
- Defensive Session Management: Session identifiers are locked with
HttpOnly,Secure, andSameSiteflags, neutralizing Cross-Site Scripting (XSS) session hijacking. - Rate-Limiting & Account Protection: Automated bot defense throttles brute-force login attempts and locks suspicious IPs.
7 Data Retention & Automatic Purging Schedule
Personal data is retained only for the duration necessary to satisfy the purpose for which it was collected, or as required by applicable Indian statutory laws:
| Data Classification | Retention Timeline | Statutory / Operational Rationale |
|---|---|---|
| Active Account Credentials | Duration of active account lifecycle | Contractual performance & user access |
| Financial & Invoicing Records | 7 years from date of transaction | Mandated under Indian Income Tax Act & GST compliance |
| Completed SMM Order URLs | 180 days post-completion | Refill validation, warranty period & dispute defense |
| Server Security Access Logs | 90 days rolling purge | CERT-In cybersecurity incident forensic guidelines |
8 Third-Party Data Processors & Cross-Border Transfers
We do not sell, rent, trade, or monetize your personal data. We share personal data solely with trusted third-party Data Processors bound by contractual confidentiality and security commitments:
- Regulated Payment Gateways: Paytm Payments Bank, Razorpay, PhonePe, and Cashfree for secure payment processing under RBI norms.
- Upstream Automated API Nodes: Wholesale fulfillment servers strictly for delivering order links and quantities. No personal passwords or payment details are ever transmitted to API providers.
- Law Enforcement & Court Orders: We disclose personal data only when strictly mandated by a lawful subpoena, judicial warrant, or written directive issued by a court of competent jurisdiction in India.
9 Prepaid Wallet Deposits, Order Cancellations & Refund Policy
In alignment with Indian Consumer Protection guidelines and RBI Digital Payment Aggregator standards, SDM Panel operates under a transparent, automated prepaid digital wallet system:
Designated Grievance Redressal Officer (Section 13)
In accordance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact details of our designated Grievance Officer are set forth below: