Privacy Policy

1. Data Collection

Hudukey ("we", "our", "Company") collects personal data from Users ("you") when you register an account, plan a ride, or use our platform. The categories of personal data we collect include:

• Identity data: name, username, date of birth, government-issued ID (where required by law)
• Contact data: email address, mobile number, residential address
• Location data: GPS coordinates, route history, departure and arrival locations
• Device data: device identifiers, operating system, browser type, IP address
• Usage data: pages visited, features used, query logs, ride preferences
• Payment data: payment method details (processed via PCI-DSS compliant third parties; we do not store full card numbers)
• Communication data: messages sent through the platform, support tickets

Collection occurs through direct interaction (account registration, ride booking), automated technologies (cookies, beacons), and third-party sources (social logins, mapping providers).

2. Purpose of Processing

We process your personal data for the following purposes, each grounded in a lawful basis under the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

1. Account management and authentication — necessary for the performance of our contract with you
2. Ride planning and route intelligence (VYOM) — necessary for the performance of our contract with you
3. Safety and emergency response — legitimate interest to protect the safety of our Users
4. Customer support and dispute resolution — legitimate interest and legal obligation
5. Product improvement and analytics — legitimate interest (aggregated, pseudonymised data)
6. Marketing communications — consent-based; you may withdraw consent at any time
7. Legal compliance — compliance with applicable Indian laws and regulations
8. Fraud detection and platform integrity — legitimate interest

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

3. Sharing of Personal Data

We share personal data only in the following circumstances:

Service providers

We engage trusted third-party vendors (hosting, payment processing, mapping, analytics, push notifications) who process data on our behalf under data processing agreements and are bound to confidentiality obligations.

Ride participants

When you join or organise a group ride, your display name, profile photo, and ride-related information are visible to other ride participants.

Legal and regulatory

We disclose personal data when required by law, court order, or lawful request from Indian law enforcement or regulatory authorities, including under the DPDP Act.

Business transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquirer subject to equivalent data protection obligations.

We do not sell, rent, or trade personal data to third parties for their independent marketing purposes.

4. Data Retention

We retain personal data for the period necessary to fulfil the purposes for which it was collected, as follows:

• Account data: retained for the duration of your account and for 3 years after account deletion (for fraud prevention and legal compliance)
• Ride and route history: retained for 2 years from the date of the ride
• Communication data: retained for 1 year from the date of communication
• Payment records: retained for 7 years as required by Indian financial record-keeping laws
• Legal hold: data subject to ongoing legal proceedings or regulatory inquiry is retained until resolution

After the applicable retention period, personal data is securely deleted or anonymised. You may request early deletion of your data in accordance with your rights set out below, subject to our legal obligations to retain certain records.

5. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:

Right to access

You may request a summary of the personal data we hold about you and the purposes for which it is being processed.

Right to correction and erasure

You may request correction of inaccurate or incomplete personal data, or erasure of personal data where it is no longer necessary for the purpose for which it was collected.

Right to grievance redressal

You may raise a complaint regarding processing of your personal data with our Grievance Officer (details below). If unsatisfied with our response, you may escalate to the Data Protection Board of India.

Right to nominate

You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise your rights, contact our Grievance Officer at {{GRIEVANCE_OFFICER_EMAIL}} or submit a request through the Hudukey app under Settings > Privacy > Data Requests. We will respond within the timelines prescribed by the DPDP Act.

6. Grievance Officer

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer:

Name

{{GRIEVANCE_OFFICER_NAME}}

Designation

{{GRIEVANCE_OFFICER_DESIGNATION}}

Email

{{GRIEVANCE_OFFICER_EMAIL}}

Postal Address

{{GRIEVANCE_OFFICER_ADDRESS}}

The Grievance Officer shall acknowledge receipt of your complaint within 48 hours and endeavour to resolve it within 15 days of receipt. For data protection complaints, the Grievance Officer will coordinate with our Data Protection Officer where required under the DPDP Act.