Privacy Policy

This Privacy Policy is issued by Bharat Atom Renewable Resources Energy Limited (“BARREL”, “we”, “us” or “our”), a public limited company incorporated in India under the Companies Act 2013, CIN U35100PN2024PLC230800, GSTIN 27AASCM0958L1ZQ, LEI 335800FULVEJISCWKA06, with its registered office at RH 11, Mayfair Eleganza - II, NIBM Road, Kondhwa Kh., Pune 411048, Maharashtra, India. BARREL is a StenJaan Group enterprise.

For the personal data described in this policy, BARREL is the data fiduciary within the meaning of the Digital Personal Data Protection Act 2023 (the “DPDP Act”): we decide why and how that data is processed. The one important exception is customer data inside BARREL OS, where we act as a data processor for the customer organisation (see BARREL OS customer data).

You can reach us at contact@barrel.energy or +91 90755 77366, or by post at RH 11, Mayfair Eleganza - II, NIBM Road, Kondhwa Kh., Pune 411048, Maharashtra, India. Our website is www.barrel.energy. Questions and complaints about personal data go to our Grievance Officer (see Grievance Officer).

This policy tells you what personal data we collect, why, on what legal basis, with whom we share it, how long we keep it, how we protect it, and what rights you have. It is our notice under section 5 of the DPDP Act and our privacy policy under the Information Technology Act 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (the “SPDI Rules”).

It applies to personal data we process through:

• all websites and portals on the barrel.energy domain and its sub-domains, including www.barrel.energy, platforms.barrel.energy, shop.barrel.energy (BARREL Shop), os.barrel.energy (BARREL OS), BARREL PIP (Project Intelligent Platform), pm.barrel.energy (Project Manager), office.barrel.energy, and the staff consoles admin.barrel.energy and superadmin.barrel.energy;
• the Power Trading Exchange and Power Asset Exchange services, including listings, non-disclosure agreements and data rooms;
• enquiries, quotations and correspondence received offline — by telephone, email, letter, messaging apps or in person;
• events, exhibitions, site visits, webinars and meetings we organise or attend;
• recruitment, including job applications, CVs and interviews;
• visits to BARREL premises and project sites, including visitor registers and CCTV where installed;
• the delivery of our projects and services (EPC and turnkey delivery, engineering and consultancy, O&M and AMC, QA/QC supervision, equipment rental), to the extent personal data of contact persons is involved.

It does not cover websites, apps or services run by others, even if we link to them or they are integrated with our services — for example a payment provider’s checkout page or, when it is launched, the eRupee Global Wallet, which is operated by its own operator under its own licences and privacy terms.

This policy should be read with our Terms of Use and Cookie Policy. Where a specific service has its own privacy terms or a signed agreement with you, those terms apply in addition to this policy and prevail for that service if they conflict.

Personal data

Any data about an individual who is identifiable by or in relation to that data, as defined in the DPDP Act.

Data principal or you

The individual to whom the personal data relates. For a child or a person with a disability, it includes the parent or lawful guardian acting on their behalf.

Data fiduciary

The person who alone or with others decides the purpose and means of processing personal data. For this policy, BARREL, unless stated otherwise.

Data processor

A person who processes personal data on behalf of a data fiduciary.

Processing

Any wholly or partly automated operation on personal data, such as collection, recording, storage, use, sharing, disclosure, restriction, erasure or destruction.

Sensitive personal data

Information listed in rule 3 of the SPDI Rules, including passwords, financial information such as bank account, card or other payment instrument details, and the other categories listed there. We also treat KYC documents (PAN, GSTIN certificates, identity and address proofs) with the same care.

Platforms

BARREL Shop, BARREL OS, BARREL PIP, the Project Manager, the Power Trading Exchange, the Power Asset Exchange and any other portal on *.barrel.energy that requires sign-in.

Customer organisation

A company or other organisation that licenses BARREL OS and uses it to run its own business.

Board

The Data Protection Board of India established under the DPDP Act.

Law

All laws of India that apply, as amended, and rules, regulations and directions made under them, including the DPDP Act and the Digital Personal Data Protection Rules 2025 to the extent in force.

Words such as “including” mean “including without limitation”. Headings are for convenience only.

We collect personal data in three ways: you give it to us (forms, sign-in, uploads, emails, calls); it is created automatically when you use our websites (logs); and, occasionally, we receive it from others (your employer who names you as a contact, a counterparty on a platform, a referee you name, or public registers such as the MCA or GST portals used to verify a business). The table below lists everything we collect, by channel.

We do not ask for more than a channel needs. If you choose not to give a required field, we may be unable to answer your enquiry, register your business or provide the service. Please do not send us personal data of other people unless you are entitled to share it and they know you are doing so.

BARREL OS is a multi-organisation software service that other energy businesses can license. When a customer organisation uses BARREL OS, BARREL PIP or the Project Manager to run its own business, the personal data its users enter (for example about its staff, clients, vendors or site workers) belongs to that organisation. The customer organisation is the data fiduciary for that data and BARREL is its data processor.

In that role we:

• process that data only on the customer organisation’s documented instructions, as set out in its licence agreement, and to provide, secure, support and maintain the service;
• keep each organisation’s data logically separated from every other organisation’s data;
• do not use that data for our own purposes, do not combine it with other data for profiling, and do not sell or disclose it except as the customer organisation instructs or the law requires;
• apply the security measures described in How we protect personal data;
• tell the customer organisation without delay if we become aware of a personal data breach affecting its data, so that it can meet its own duties;
• return or delete the data at the end of the licence as the agreement provides, subject to backups that expire on their normal cycle and records the law requires us to keep.

If your data is held in BARREL OS by an organisation you deal with, please send requests to access, correct or erase it to that organisation. If you write to us, we will forward your request to it and help it respond.

Some onboarding and transaction steps need sensitive personal data within the meaning of the SPDI Rules, mainly bank account details and KYC documents (PAN, GSTIN certificate, identity and address proofs of proprietors, partners, directors or authorised signatories). We collect these only when a step genuinely needs them — for example to verify a supplier, to settle payments to a merchant, to meet GST and tax obligations, or to meet know-your-customer duties under the Prevention of Money-Laundering Act 2002 where they apply to a transaction.

We handle this data as follows:

• it is collected with your consent and for the purpose stated at the point of collection, or where the law requires it;
• it is stored only on our servers in India, access is restricted to staff whose role needs it, and every access through our consoles is logged;
• we do not store full card numbers, CVV or net-banking credentials; card and online payments, when offered, are handled by licensed payment providers on their own secure pages;
• we do not ask for or store passwords — sign-in works by one-time password;
• we share it only with the parties listed in Who we share personal data with and only as far as the purpose needs (for example, a bank or payment provider to make a payout);
• we never publish it or show it to other users of the Platforms, except that a business’s GSTIN and legal name may be shown on invoices and listings because GST law requires it.

You may decline to give sensitive personal data or withdraw consent at any time. If you do, we may be unable to complete onboarding, settle payments or provide the service that needs it.

We use personal data only for these purposes:

• Answering you: to reply to enquiries, prepare proposals and quotations, run calculators, and follow up on conversations you started.
• Providing the Platforms: to sign you in, keep your session, run BARREL Shop (listings, RFQs, orders, invoices, delivery and settlement), the Power Trading Exchange and Power Asset Exchange (listings, matching, NDAs, data rooms), BARREL OS, BARREL PIP and the Project Manager.
• Onboarding and verification: to register and verify partners, suppliers, merchants, service providers and buyers, including checks against public registers, and to prevent fraud and misuse.
• Delivering projects and services: EPC and turnkey delivery, engineering and consultancy, O&M and AMC, QA/QC supervision and equipment rental, including site access, safety and communication with your team.
• Recruitment: to assess applications, arrange interviews, check references with your knowledge and make offers.
• Security and integrity: to protect our systems, users and premises; to detect, investigate and prevent attacks, fraud, abuse and breaches; to keep logs required by the CERT-In Directions of 28 April 2022.
• Legal and regulatory compliance: GST (including e-invoicing, e-way bills and tax collected at source by e-commerce operators), income-tax (including tax deducted at source), the Companies Act 2013, the Consumer Protection (E-Commerce) Rules 2020, anti-money-laundering law, and lawful requests of authorities.
• Running and improving our business: capacity planning, fixing faults, improving content and services, internal reporting and audits — using aggregated statistics wherever possible.
• Service messages: OTPs, order and payment updates, security alerts, and changes to terms or policies. These are not marketing.
• Business updates you asked for: newsletters or product information only if you opted in. You can opt out at any time through the link in the message or by writing to contact@barrel.energy.
• Legal claims: to establish, exercise or defend legal claims and enforce our agreements.

If we want to use personal data for a new purpose that is not compatible with these, we will give you notice and, where the law requires, ask for your consent first.

Under the DPDP Act we process personal data on one of two grounds:

1. 1Consent (section 6). Where you give consent that is free, specific, informed, unconditional and unambiguous, by a clear affirmative action such as ticking a box or submitting a form after seeing the notice. Most website forms, partner registrations, careers applications and newsletters rely on consent.
2. 2Legitimate uses (section 7). Where the DPDP Act allows processing without separate consent, including: where you voluntarily provide your data for a specified purpose and have not indicated that you object to its use (for example, sending us an email asking for a quotation); to comply with any law or any judgment or order; for employment-related purposes and to safeguard the company from loss or liability, such as preventing corporate espionage, maintaining confidentiality of trade secrets and providing services to employees; and to respond to a medical emergency or ensure safety during a disaster or breakdown of public order, including on project sites.

For data processed on behalf of a customer organisation in BARREL OS, the lawful basis is the customer organisation’s responsibility as data fiduciary.

Where the SPDI Rules require written consent for sensitive personal data, your electronic acceptance at the point of collection is that consent, given under section 10A of the Information Technology Act 2000.

Each form and portal that collects personal data shows a short notice at the point of collection, explaining what is collected and why, with a link to this policy. Where we rely on consent, the form asks for it separately from acceptance of any terms, and does not bundle consent for unrelated purposes. You can read this notice and policy in English and, as the DPDP Act requires to the extent in force, in the languages offered on our website.

You may withdraw consent at any time, as easily as you gave it: by using the unsubscribe or settings option where one exists, by writing to contact@barrel.energy with the subject line “Withdraw consent”, or by contacting the Grievance Officer. We will stop the processing based on that consent within a reasonable time and, in any case, within the time the law sets.

Withdrawing consent does not affect processing done before the withdrawal, or processing we must or may continue on another lawful ground (for example, keeping invoices that tax law requires). If you withdraw consent needed for a service, we may have to close your registration or account for that service.

Where a consent manager registered with the Board becomes available and you choose to use one, you may give, manage and withdraw consent through it.

Our websites and Platforms are intended for businesses and adults. We do not knowingly process the personal data of anyone under 18 years of age (a “child” under the DPDP Act), except with the verifiable consent of a parent or lawful guardian obtained in the manner the DPDP Rules 2025 prescribe.

We do not track or monitor the behaviour of children, do not direct advertising at children, and do not carry out any processing likely to have a detrimental effect on a child’s well-being.

If you believe a child has given us personal data without verifiable parental consent, please write to the Grievance Officer. We will delete it promptly, unless the law requires us to keep it.

Recruitment is open only to persons who may lawfully be employed. Where an apprenticeship or internship involves a person under 18, we collect their data only through and with the consent of their parent, guardian or educational institution.

BARREL:

• does not show third-party advertising on its websites or Platforms;
• does not use advertising cookies, advertising pixels or cross-site tracking technologies;
• does not sell, rent or trade personal data;
• does not build profiles of visitors for advertising, and does not combine data across unrelated contexts (for example, your use of our public website with data held for a customer organisation in BARREL OS) to profile you;
• does not take decisions about you based solely on automated processing that produce legal or similarly significant effects. Where our systems help match a power requirement with a listing or rank quotations, a person reviews the outcome and you may ask for an explanation.

We do operate business Platforms where users’ business data is processed to run those services — for example, showing a buyer’s RFQ to relevant sellers, or showing a listing to admitted parties. That is the service you ask us to provide, not advertising.

We share personal data only where needed for the purposes in this policy, only to the extent needed, and, for processors, under a written contract that requires them to protect it and use it only on our instructions.

We remain responsible for personal data that our processors handle for us, as the DPDP Act provides.

We store website and Platform data in India. Some processing takes place outside India: in particular, emails are sent through Brevo, an EU-based provider, and you may correspond with us using international email or messaging services you choose. Where a counterparty you transact with is outside India, the data needed for that transaction is necessarily shared with them.

Section 16 of the DPDP Act permits transfer of personal data outside India except to countries or territories that the Central Government restricts by notification. We will not transfer personal data to any restricted country or territory, and we will comply with any stricter sector-specific rule under Indian law (for example, RBI requirements that payment data be stored only in India). Where we use a processor abroad, our contract with it requires security at least equal to that described in this policy.

We keep personal data only as long as the purpose needs it or the law requires, and then erase it or anonymise it so that it no longer identifies anyone. The table shows our normal retention periods.

Personal data in backups is erased when the backup expires. If we must keep data longer because of a legal hold, dispute or investigation, we keep only what is needed and only until the matter ends.

We take reasonable security safeguards, as section 8(5) of the DPDP Act and the SPDI Rules require, appropriate to the nature of the data and the risk. Our measures include:

• Encryption in transit: all our websites and Platforms are served only over HTTPS (TLS). The connection between our application server and database server is encrypted.
• Separation: the database runs on a separate server that only our application server can reach over a private network; it is not reachable from the internet.
• Access control: role-based permissions; staff see only what their role needs; sign-in by one-time password; session cookies are HttpOnly and Secure.
• Network-restricted staff consoles: admin.barrel.energy and superadmin.barrel.energy can be reached only from a restricted private network, and are refused from the public internet.
• Logging and monitoring: web access logs, sign-in records and console activity logs, to detect and investigate unauthorised access.
• Backups with test restores: nightly encrypted backups, each automatically restored to a test database to prove it works, and a copy kept by the company.
• Hardening: firewalls that open only the ports a service needs, key-only administrative access, regular updates, and secrets kept outside the code.
• People and contracts: confidentiality obligations for staff and processors, and training on handling personal data.

No system is completely secure. We cannot guarantee that personal data will never be accessed without authorisation, but we will act promptly and transparently if it is (see Personal data breaches). Please help by keeping access to your email and mobile number secure, since they are used for sign-in, and by signing out of shared devices.

A personal data breach is any unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.

If we become aware of a breach of personal data for which we are the data fiduciary, we will:

1. 1contain it, investigate it and take steps to limit harm;
2. 2report cyber security incidents of the types listed in the CERT-In Directions of 28 April 2022 to CERT-In within 6 hours of noticing them;
3. 3intimate the Data Protection Board of India without delay, and give it the detailed report the DPDP Rules 2025 require (to the extent in force, within 72 hours of becoming aware of the breach, or any longer period the Board allows);
4. 4inform each affected data principal without delay, in plain language, of the nature and extent of the breach, its likely consequences, what we have done and are doing to reduce the risk, what you can do to protect yourself, and whom to contact;
5. 5where the breach affects data we hold for a customer organisation in BARREL OS, notify that organisation without delay and support it in meeting its own duties.

Subject to the DPDP Act and its exceptions, you have the right to:

• Access (section 11): obtain a summary of the personal data we process about you and the processing activities, the identities of other data fiduciaries and processors with whom we have shared it and a description of what was shared, and any other information the law prescribes.
• Correction, completion and updating (section 12): have inaccurate or misleading data corrected, incomplete data completed and data updated.
• Erasure (section 12): have personal data erased that is no longer needed for the purpose for which it was processed, unless the law requires us to keep it (for example, invoices under GST law).
• Withdraw consent (section 6): at any time, as described in Notice, consent and withdrawing consent.
• Grievance redressal (section 13): have your complaint dealt with by our Grievance Officer, and then approach the Board.
• Nomination (section 14): nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

Under the SPDI Rules you may also review the information you have provided and ask for it to be corrected. Many details can be updated directly in your Platform profile.

These rights apply to personal data of individuals. Data about a company is not personal data, although data about its directors, partners and contact persons is.

1. 1Write to contact@barrel.energy with the subject line “Privacy request” (or “Grievance” for a complaint), or use the request option in your Platform account where available. You may also call +91 90755 77366 or write to RH 11, Mayfair Eleganza - II, NIBM Road, Kondhwa Kh., Pune 411048, Maharashtra, India.
2. 2Tell us which right you are exercising, which site or service it concerns and how we can contact you. For a nomination, give the nominee’s name and contact details.
3. 3We will verify your identity, normally by a one-time code sent to the email or mobile number we hold. We may ask for more proof if the request concerns sensitive data or comes from someone acting for you. We will use that proof only to verify the request.
4. 4We will acknowledge your request within 24 hours and respond within 15 days. If a request is complex, we will tell you why within that time and complete it within 30 days, and never later than the time the law allows.

We do not charge for requests. We may decline a request that is manifestly unfounded or repetitive, or where the law allows or requires us to refuse (for example, where disclosure would affect another person’s rights or a lawful investigation), and we will tell you why. If your data is held in BARREL OS for a customer organisation, see BARREL OS customer data.

Grievance Officer: the person designated by BARREL from time to time, reachable at contact@barrel.energy (subject line 'Grievance') and +91 90755 77366, RH 11, Mayfair Eleganza - II, NIBM Road, Kondhwa Kh., Pune 411048, Maharashtra, India.

The Grievance Officer handles complaints about personal data under the DPDP Act, the SPDI Rules, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the Consumer Protection (E-Commerce) Rules 2020. The Grievance Officer will acknowledge a complaint within 24 hours and resolve it within 15 days, or within any shorter time the law sets. Requests to remove unlawful content under the Intermediary Rules are acted on within 72 hours where those rules apply.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner the DPDP Act and the DPDP Rules 2025 provide, to the extent in force. Section 13(3) of the DPDP Act requires you first to exhaust the opportunity of redressing your grievance with us, so please contact our Grievance Officer first. Nothing in this policy limits any right you have before the Board, a consumer commission or a court.

Section 15 of the DPDP Act places duties on data principals. When you use our services you must:

• comply with the law;
• not impersonate another person while providing your personal data;
• not suppress any material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State;
• not register a false or frivolous grievance or complaint with us or the Board;
• provide only verifiably authentic information when you exercise your right to correction or erasure.

When you give us personal data of other people — colleagues named as contacts, employees in BARREL OS, owners of land you list, referees in a CV — you confirm that you are entitled to do so and that they have been told about it.

Our websites may link to, or embed content from, other websites — for example maps, videos, a translation service, regulators’ portals, a payment provider’s page or, when launched, the eRupee Global Wallet. Those websites are run by others under their own privacy policies, and may set their own cookies (see our Cookie Policy). We are not responsible for their practices. Please read their policies before giving them personal data.

We are responsible for complying with this policy and the law. To the extent the law permits, BARREL is not liable for loss caused by events beyond its reasonable control, by your own failure to keep your email, mobile number or devices secure, or by third-party websites and services that are not our processors. Nothing in this policy limits liability that cannot be limited under the law, including for fraud, wilful misconduct or gross negligence, or any right you have under the DPDP Act or consumer law. Limits of liability for the use of our services are set out in the Terms of Use.

This policy is governed by the laws of India. Subject to your rights before the Data Protection Board of India and consumer commissions, the courts at Pune, Maharashtra have exclusive jurisdiction over disputes arising from it.

We may update this policy when our services, processors or the law change. The version and effective date at the top of the page show the current version. If a change is significant — for example a new purpose, a new category of data, or a new kind of recipient — we will tell you in advance by a notice on the website or by email to signed-in users and, where the law requires, ask for fresh consent. Previous versions are available on request from contact@barrel.energy.

Version 1.0, effective 10 November 2026.

Bharat Atom Renewable Resources Energy Limited, RH 11, Mayfair Eleganza - II, NIBM Road, Kondhwa Kh., Pune 411048, Maharashtra, India. Email contact@barrel.energy, telephone +91 90755 77366, website www.barrel.energy. For privacy requests use the subject line “Privacy request”; for complaints, “Grievance”.