This Privacy Policy (“Policy”) governs the collection, use, disclosure, and protection of personal information by Carmaa Car Care (“Company”, “Carmaa”, “we”, “us”, or “our”) through its mobile application, website ( www.carmaacarcare.com), and other platforms it owns and operates (collectively, the “Platform”). This Policy is published in compliance with the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and is binding on all users, visitors, and service providers who access or use our Platform.

1. 1. Scope & Applicability

This Policy applies to:

• Users/Customers booking services via the Carmaa platform.

• Service Providers/Partnersregistered on Carmaa.

• Anyone accessing our app or website.

• By using the Platform, you consent to the collection, storage, and processing of your personal data in accordance with this Policy.

2. 2. Data We Collect

A. Personal Information

We may collect:

• Name

• Phone number

• Email ID

• Residential or service address

• Vehicle details (make, model, registration number)

B. Sensitive Personal Data or Information (SPDI)

• Location data (with permission)

• Payment details (Razor-pay gateway; we do not store card or UPI data)

• OTP verification codes

• KYC documents (for Partners)

C. Device & Technical Information

• Device identifiers, IP address, browser type

• App crash logs, session data

• Website cookies and analytics data

3. 3. Purpose of Data Collection

We collect and process your data for:

• Booking and fulfilment of services

• Service provider matching based on geo-location and ratings

• Identity verification and fraud detection

• Transaction processing

• Customer support and dispute resolution

• Marketing offers, referral rewards (with opt-out option)

• Regulatory compliance

We do not sell or rent your personal data to third parties.

4. 4. Lawful Basis for Processing

We process your personal data based on:

• Your consent (explicit, via app/web interaction)

• Contractual necessity (for fulfilling booked services)

• Legal obligation (such as KYC verification)

• Legitimate interest (platform improvements, fraud prevention)

5. 5. Data Sharing & Disclosure

We may disclose your information:

• To verified service providers (limited to name, vehicle, location)

• To our payment gateway partner (Razor-pay)

• To government authorities, law enforcement, or courts (as required by applicable law)

• Internally, to Carmaa employees, under strict confidentiality No third-party marketing agency is granted access to your personal data without consent.

6. 6. Data Retention

We retain your data:

• As long as your account remains active

• For up to 3 years post account closure (for regulatory and audit purposes)

• For shorter periods if deletion is requested and permitted by law

7. 7. Data Security Measures

We implement reasonable security practices and procedures including:

• SSL encryption for all API and app traffic

• End-to-end secure payment integration

• Role-based internal access to customer data

• Encrypted storage and backup

• Regular security audits and patching

In case of a data breach, we will notify affected users and the relevant authority within 72 hours, as per law.

8. 8. User Rights

You have the following rights under Indian law:

• Right to access your data

• Right to correction or update

• Right to data portability(on request)

• Right to withdraw consent(may limit service functionality)

• Right to deletion of your personal data (except where retained for legal reasons)

Requests can be sent to: grievanceofficer@carmaacarcare.com

9. 9. Cookies & Third-Party Tools

Our website uses:

• Cookies to remember login preferences and measure performance

• Google Analytics, Facebook Pixel, and other tools to optimize marketing and UX

You may disable cookies through browser settings.

10. 10. Children’s Data

Our services are not intended for minors under the age of 18 . We do not knowingly collect data from minors. If found, such data will be deleted immediately.

11. 11. Grievance Redressal

As per Rule 5(9) of the SPDI Rules, we have appointed the following Grievance Officer:

Email: grievanceofficer@carmaacarcare.com

We acknowledge all grievances within 48 hours and aim to resolve them within 15 working days.

12. 12. Policy Updates

We may revise this Privacy Policy from time to time to reflect changes in law, technology, or company practices. The latest version will always be available on our Platform. Continued use constitutes acceptance of the revised Policy.

13. 13. Contact Us

For privacy questions, concerns, or deletion requests, contact:

grievanceofficer@carmaacarcare.com