1Introduction

DrycleanEx ("we," "us," or "our") acts as a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our platform, mobile application, or physical stores.

By using our Platform or providing your personal data, you, as a Data Principal, consent to the collection and processing of your data as described in this Policy. You may withdraw consent at any time, subject to the consequences described herein.

Applicability: This Policy applies to all personal data collected digitally — through our website, app, online forms, and digital communications. For data collected in non-digitised form and subsequently digitised, this Policy also applies.

2Data We Collect

2.1 Data You Provide

• Identity Data: Full name, email address, mobile number, date of birth (optional)
• Contact Data: Delivery address, billing address, location pin code
• Order Data: Service selections, garment descriptions, special instructions, order history
• Payment Data: Transaction ID, payment method (we do not store card numbers — processed by PCI-DSS compliant gateway)
• Communication Data: Messages, reviews, feedback, support requests
• Account Data: Login credentials (passwords are hashed and never stored in plaintext)

2.2 Data Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device identifiers
• Usage Data: Pages visited, time spent, click patterns, search queries within the Platform
• Location Data: Approximate location for store-finder and pickup/delivery (only with your permission)
• Cookie Data: Session identifiers, preference cookies, analytics identifiers (see Cookie Policy)

2.3 Data from Third Parties

We may receive data about you from:

• Payment processors (transaction status, fraud flags)
• Social media platforms (if you connect via Google/Facebook login)
• Analytics providers (aggregated, anonymised usage data)

3How We Use Your Data

We process your personal data only for the specific purposes for which consent was obtained or for legitimate uses as defined under the DPDP Act:

We will not use your data for any purpose other than those listed above without obtaining fresh consent from you.

4Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data on the following legal bases:

• Consent (Section 6, DPDP Act): For marketing communications, optional features, and non-essential data collection. You may withdraw consent at any time via account settings or by contacting our DPO.
• Legitimate Use (Section 7, DPDP Act): For processing necessary for the performance of a contract (your order), for compliance with legal obligations, for protecting your vital interests, or for purposes specified under government notifications.

Where we rely on consent, we will present a clear, specific, and granular request explaining what data will be processed and for what purpose. Consent is voluntary and may be withdrawn without affecting your access to core services.

5Data Sharing

We do not sell, trade, or rent your personal data. We may share your data with the following categories of recipients:

5.1 Service Providers (Data Processors)

• Delivery partners— name, address, and order details for last-mile delivery
• Payment gateways— transaction data for payment processing
• SMS/Email service providers— contact details for order notifications
• Cloud infrastructure providers— data hosting on servers in India
• Analytics providers— anonymised usage data only

All Data Processors are contractually bound to process your data only on our instructions, maintain confidentiality, and implement appropriate security measures in accordance with the DPDP Act.

5.2 Legal Disclosures

We may disclose your data to:

• Law enforcement, regulatory authorities, or courts when required by Indian law
• The Data Protection Board of India in connection with any complaint or investigation
• Professional advisors (lawyers, auditors) bound by confidentiality obligations

5.3 Business Transfers

In the event of a merger, acquisition, or sale of our business, your data may be transferred to the successor entity, subject to the same privacy protections set out in this Policy.

6Data Storage & Security

Your personal data is stored on secure servers located in India. We implement the following reasonable security measures as required under the DPDP Rules, 2025:

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 where applicable)
• Access controls: Role-based access with regular access log reviews
• Pseudonymisation: Where feasible, personal identifiers are decoupled from service data
• Regular security assessments: Periodic vulnerability assessments and penetration testing
• Data backups: Regular backups to ensure continuity in case of data loss
• Staff training: All staff with data access undergo data protection training

7Your Rights Under the DPDP Act

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights. Requests must be submitted through your account settings or to our Data Protection Officer. We will respond within 7 days (as required under DPDP Rules Rule 14):

• Right to Access (Section 11): Obtain a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to Correction (Section 12): Request correction of inaccurate, incomplete, or outdated personal data.
• Right to Erasure (Section 12): Request deletion of your personal data when it is no longer necessary for the purpose for which it was collected, or when you withdraw consent.
• Right to Withdraw Consent (Section 6): Withdraw any consent previously given. Withdrawal will not affect the lawfulness of processing done before withdrawal.
• Right to Nominate (Section 14): Nominate an individual to exercise your data rights in the event of your death or incapacity.
• Right to Grievance Redressal (Section 13): Raise a complaint with our Grievance Officer. If not satisfactorily resolved, you may approach the Data Protection Board of India.

To exercise any of these rights, contact: drycleanEx.com@gmail.com

Note: Some rights are subject to exceptions under the DPDP Act, such as when data is required for legal compliance, fraud prevention, or national security purposes.

8Cookies & Tracking Technologies

Our Platform uses cookies and similar tracking technologies to enhance your experience. We use:

• Essential cookies: Required for the Platform to function (session management, authentication). Cannot be disabled.
• Preference cookies: Remember your settings and preferences. Can be declined.
• Analytics cookies: Help us understand how you use the Platform (Google Analytics, anonymised). Require consent.
• Marketing cookies: Used to show relevant offers. Require explicit opt-in consent.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality. A cookie consent banner is displayed on your first visit.

9Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. In accordance with Section 9 of the DPDP Act, if you are under 18, please do not use our Platform or provide any personal data without verifiable parental or guardian consent.

If we discover that we have collected data from a minor without appropriate consent, we will promptly delete such data. Parents or guardians who believe we may have data about their child should contact us at drycleanEx.com@gmail.com.

10Cross-Border Data Transfers

We store all personal data of Indian residents on servers located within India in compliance with applicable data localisation requirements. Where data must be shared with service providers located outside India (such as global analytics platforms), such transfers are made only to countries notified by the Central Government as having adequate data protection standards under Section 16 of the DPDP Act, or under appropriate contractual safeguards.

We currently use third-party services that may process data in countries including the United States. Where such transfers occur, we ensure contractual obligations consistent with DPDP Act requirements are in place.

11Data Retention Policy

We retain your personal data only for as long as necessary for the purposes outlined in this Policy:

• Account data: Retained until you delete your account plus 90 days for backup and legal hold purposes
• Order data: Retained for 7 years for GST/tax compliance under the GST Act
• Communication data: Retained for 1 year from the date of communication
• Analytics data: Retained in anonymised form for up to 2 years
• Security logs: Retained for at least 1 year in compliance with DPDP Rules requirement for breach detection

After the applicable retention period, data is securely deleted or anonymised in a manner that makes re-identification impossible.

12Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights, we will:

• Notify the Data Protection Board of India of any breach irrespective of its gravity, as required by the DPDP Act
• Notify affected Data Principals in the format and manner prescribed by the DPDP Rules
• Take all reasonable steps to contain and remediate the breach
• Maintain records of all breaches for investigation and audit purposes

13Contact & Data Protection Officer

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India at www.meity.gov.in.

Effective Date: 1 April 2025. We may update this Policy from time to time. Material changes will be communicated via email or in-app notification. Continued use after such notification constitutes acceptance.