1. Introduction & Statutory Framework

Carzonrent (India) Private Limited ("Carzonrent", "we", "us" or "our") respects the privacy and personal data of its customers, website visitors, mobile application users, chauffeurs, employees of corporate clients, and other individuals whose personal data we process.

This Privacy & Personal Data Protection Notice ("Privacy Notice") explains how Carzonrent collects, processes, stores, shares, protects, and erases personal data while providing mobility, car rental, chauffeur-driven transportation, and related digital services across our platforms.

Carzonrent acts as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023. We determine the purpose and means of processing personal data and ensure all processing is carried out lawfully, fairly, and transparently.

2. Itemized Notice & Multilingual Access

Prior to or at the time of collecting personal data, Carzonrent provides Data Principals with an itemized notice detailing:

• The specific categories of personal data to be collected.
• The explicit operational and legal purposes for processing.
• The mechanism to grant, manage, or withdraw consent.
• Contact details of the designated Data Protection Officer / Grievance Officer for privacy inquiries.

In accordance with Section 5(3) of the DPDP Act 2023, Data Principals may access this Privacy Notice and request consent communications in English or any of the 22 Scheduled Languages under the Eighth Schedule to the Constitution of India.

3. Categories of Personal Data Collected

Depending on the specific service and relationship with Carzonrent, we may process:

• Customer & Profile Information: Name, mobile/telephone number, email address, billing/postal address, account credentials, company name, and employee identification where applicable.
• Booking & Trip Data: Reservation history, pickup/drop-off locations, dates/times, vehicle preferences, rental agreements, trip logs, and service feedback.
• Location & Telematics: Real-time GPS and trip location data collected during active services for route mapping, distance calculation, billing, safety monitoring, and vehicle assignment. Background location is collected via Chauffeur Apps (CorDrive) only with explicit consent.
• Chauffeur Onboarding & KYC: Driver's license, photograph, PAN information, Aadhaar details (strictly processed using masked/redacted formats in accordance with statutory privacy limits), vehicle images, and expense receipts (tolls/parking).
• Technical & Usage Data: IP address, browser type, device identifiers, app usage logs, cookies, security audit logs, and diagnostic information.

4. Specified Purposes of Data Processing

Carzonrent processes personal data solely for specified, lawful, and legitimate purposes, including:

• Creating reservations, managing trips, assigning vehicles/chauffeurs, and fulfilling mobility services.
• Processing payments, generating tax invoices, issuing refunds, and maintaining accounting records.
• Onboarding chauffeurs, conducting background identity verification, and verifying operational readiness.
• Ensuring passenger safety, operational monitoring, preventing fraudulent activity, and securing systems.
• Complying with statutory, tax, regulatory, legal obligations, and judicial orders.
• Delivering promotional and marketing communications, subject to explicit and separate consent.

5. Consent, Consent Managers & Right of Withdrawal

Where processing is based on consent, Carzonrent obtains consent through clear, unambiguous, and affirmative action.

• Separate Consent for Marketing: Consent for optional activities (such as marketing communications) is kept distinct from essential operational consent required to provide transportation services.
• Consent Management Framework: Data Principals have the right to manage, review, or withdraw consent at any time via account settings or by contacting our Grievance Officer. In accordance with the DPDP framework, Data Principals may also exercise consent rights through registered Consent Managers licensed by the Data Protection Board of India (DPBI).
• Effect of Withdrawal: Withdrawal of consent will not affect the lawfulness of processing conducted prior to withdrawal. Upon valid withdrawal, Carzonrent and its authorized Data Processors will cease processing, unless retention is mandated by law.

6. Protection of Children & Persons with Disabilities

Carzonrent does not knowingly collect or process personal data of individuals under 18 years of age without verifiable parental consent.

Where processing of a child's or a person with a disability's data is required, verifiable consent is obtained from the parent or lawful guardian in accordance with DPDP rules.

Carzonrent strictly refrains from undertaking behavioural tracking, targeted advertising, or any data processing that is likely to cause detrimental effects on the physical or mental well-being of children.

7. Third-Party Sharing & Data Processor Contracts

Carzonrent does not sell personal data. We share personal data only with authorized recipients under strict legal controls:

• Authorized Data Processors: Third-party cloud providers, IT infrastructure hosts, payment gateways, and communication vendors process data strictly on our behalf under legally binding Data Processing Agreements (DPAs) enforcing DPDP compliance.
• Corporate Accounts: Trip details are shared with corporate clients where travel is organized under corporate account arrangements.
• Legal & Regulatory Compliance: Personal data is disclosed to government, regulatory, tax, or law enforcement agencies when mandated by applicable law or judicial orders.

8. Cookie Policy & Tracking Governance

Carzonrent utilizes cookies and similar web technologies categorized as:

• Necessary Cookies: Essential for site navigation, security, and user authentication.
• Functional Cookies: Save user preferences and structural configurations.
• Analytics Cookies: Measure site traffic, feature usage, and technical performance.
• Marketing Cookies: Deliver targeted promotional campaigns with explicit user consent.

9. Data Retention, Erasure & Proactive Deletion

Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected or as required under applicable statutory laws.

In accordance with DPDP rules, upon purpose completion or user account inactivity for the specified statutory period, Carzonrent will issue a proactive notification at least 48 hours prior to permanent data deletion or anonymization, allowing users to request lawful retention if applicable.

You may request the deletion of your personal data by contacting us at privacy@carzonrent.com. Please note that certain data may be retained for a limited period after your request to fulfill legal obligations or for legitimate business purposes.

10. Data Principal Rights Framework

Data Principals are entitled to the following statutory rights under the DPDP Act 2023:

• Right to Access Information: Obtain a summary of personal data being processed and the identities of all third parties with whom data has been shared.
• Right to Correction & Completion: Request correction of inaccurate data, completion of incomplete records, or updating of personal information.
• Right to Erasure: Request erasure of personal data when processing is no longer necessary or consent is withdrawn.
• Right to Nominate: Nominate any individual to exercise data protection rights in the event of death or incapacity.
• Right to Grievance Redressal: Access readily available grievance redressal mechanisms provided by Carzonrent.

11. Security Safeguards & Statutory Breach Notification

Carzonrent maintains rigorous administrative, technical, and physical security measures — including end-to-end encryption, role-based access controls, multi-factor authentication, and firewall protections — to safeguard personal data.

In the event of a personal data breach, Carzonrent will notify the Data Protection Board of India (DPBI) and affected Data Principals within the mandatory 72-hour statutory window, specifying the nature of the breach, potential consequences, and remedial measures taken.

12. Contact Us & Grievance Redressal Mechanism

Data Principals may exercise their rights or register privacy grievances by contacting our Data Protection Officer / Grievance Officer:

Grievance Resolution Timelines

If a privacy grievance remains unresolved or if you are dissatisfied with our response, you have the statutory right to lodge a complaint with the Data Protection Board of India (DPBI).