DPDP Act, 2023 Compliant

Privacy Policy

Last updated: October 31, 2026 · Effective immediately

🛡️

Our Non-Negotiable Privacy Pledge

We strictly NEVER sell, rent, lease, or share your mobile number, email address, or personal data with any third-party marketing agency, advertiser, or data broker. Any promotional updates or booking communications you receive come directly and exclusively from Droovee.

1. Data Fiduciary & Regulatory Framework

This Privacy Policy is published by DROOVEE MOBILITY PVT. LTD., operating the platform Droovee (“Droovee”, “we”, “us”, or “our”), having its operational headquarters in Bhubaneswar, Odisha, India. We act as the Data Fiduciary in terms of Section 2(i) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

This policy governs the collection, processing, storage, and protection of digital personal data of customers (“Data Principals”) accessing our website, web application, booking interfaces, and associated mobility dispatch services.

2. Personal Data We Collect

We collect only the minimum necessary personal data required to deliver chauffeur services and maintain account integrity:

Identity & Contact Information: Full name, Indian mobile number (E.164 standard), and email address (optional on booking, collected during account setup).
Booking & Ride Information: Pickup address, trip destination, date and scheduled start time, vehicle make/model, trip duration, and customer service notes.
Account & Security Metadata: Hashed passwords (salted bcrypt; plaintext passwords are never stored or accessible), one-time passcode verification timestamps (OTP hash with automatic expiration), account creation timestamps, and record of successful logins (last login timestamps).
Operational & Support Logs: Audit trails of dispatch assignments, customer feedback, ratings, and customer service interactions via WhatsApp or telephone.

3. Lawful Purpose of Data Processing (DPDP Act, Section 4 & Section 6)

In strict accordance with the DPDP Act, 2023, your personal data is processed solely for specified, lawful, and transparent purposes:

Trip Fulfillment & Driver Dispatch

Assigning background-verified chauffeurs to your private vehicle, facilitating pickup coordination, and calculating trip estimates.

Account Security & Authentication

Verifying account ownership via OTP, maintaining authenticated sessions, tracking login activity, and preventing unauthorized account takeover.

Direct Customer Marketing & Offers

Informing you of launch benefits (e.g. First Hour Free, coupon code FIRST30), seasonal promotions, and service upgrades directly from Droovee via WhatsApp, SMS, or email.

Statutory Compliance & Invoicing

Issuing legally required ride receipts, maintaining operational tax records, and supporting dispute resolution under Indian law.

4. Third-Party Sharing Prohibition

Droovee operates on a strict zero-leakage data architecture:

No Commercial Sale: We do not sell, rent, monetize, or disclose your contact details or ride histories to external advertisers, telemarketers, credit agencies, or data aggregators.
Driver Access Limitation: Your assigned chauffeur receives only your name, pickup location, and contact phone number, and only after the trip is officially assigned. Drivers have zero access to your email, account history, or payment records.
Technical Infrastructure Partners: Data is hosted on ISO 27001 / SOC 2 certified cloud servers and transactional communication providers (e.g., WhatsApp Business API) operating under strict data processing agreements that forbid secondary use.

5. Your Statutory Rights as a Data Principal (DPDP Act, Sections 11–14)

Under India's DPDP Act, 2023, you hold enforceable legal rights regarding your personal data:

Right to Access (Section 11)

You may request a summary of your personal data processed by Droovee and the identities of personnel with whom it was shared.

Right to Correction & Completion (Section 12)

You have the right to correct inaccurate or outdated information or complete any incomplete data record.

Right to Erasure "Right to be Forgotten" (Section 12(3))

You may request deletion of your account, mobile number, and personal records when there is no active booking or pending legal obligation.

Right to Withdraw Marketing Consent (Section 6(4))

You may opt out of promotional messages at any time by replying “STOP” to WhatsApp messages, clicking unsubscribe in emails, or contacting support. Opting out of marketing will never disrupt your ability to book drivers or receive critical ride confirmations.

Right to Nominate (Section 14)

You have the right to nominate any individual to exercise your rights under the DPDP Act in the event of death or incapacity.

6. Technical & Operational Security Measures

We employ state-of-the-art security safeguards in accordance with Section 8(5) of the DPDP Act:

All web traffic is encrypted end-to-end using TLS 1.3 cryptographic protocols.
Passwords are transformed using 12-round salted bcrypt hashes; plaintext passwords never touch our database.
Administrative access to customer records is restricted by fine-grained Role-Based Access Control (RBAC). Every staff query is immutably recorded in our internal audit logs.
Data retention is minimized: expired OTP hashes are automatically purged by database TTL indices after 10 minutes.

7. Data Protection & Grievance Redressal Officer

In accordance with Section 13 of the DPDP Act, 2023, Droovee has appointed a designated Grievance Redressal Officer to resolve any queries, requests, or complaints:

Designation: Data Protection & Grievance Redressal Officer

Entity: DROOVEE MOBILITY PVT. LTD. (Droovee)

Email: droovee.admin@gmail.com

Phone / WhatsApp: +91 81149 94367

Postal Address: Patia / Infocity Road, Bhubaneswar, Odisha 751024, India

Response timeline: All inquiries and erasure requests are acknowledged within 24 hours and resolved within 7 business days. If you are unsatisfied with our resolution, you retain the right to approach the Data Protection Board of India.

View Terms of Service →