Privacy Policy
Effective Date: August 2026 | Operating Area: Dandeli, Karnataka, India (581325)
Data Fiduciary Transparency Notice
DandeliDrop processes digital personal data as a Data Fiduciary in accordance with the Digital Personal Data Protection Act, 2023. We process your data transparently, strictly for specified, lawful purposes with your affirmative consent.
Welcome to DandeliDrop. We are a hyperlocal marketplace and logistics platform operating in Dandeli, Karnataka. We facilitate the ordering and delivery of goods from neighborhood merchants and local open-market vendors.
1. Information We Collect & Why
Account & Contact Data
Full name, verified Indian 10-digit mobile number, and email address. Required for order confirmations, OTP authentication, and customer support.
Delivery Location Data
Delivery street address, landmark, and coordinates within Dandeli. Used strictly to calculate accurate delivery distances and guide delivery partners.
Payment & Transaction Data
Gateway transaction IDs, order numbers, integer paise amounts, and payment method (UPI, Card, Net Banking). We never store raw credit card numbers, CVVs, UPI PINs, or bank passwords.
Order & Shopping Records
Item names, quantities, user preferences, receipts from local vendors, and delivery handoff audit logs.
Merchant & Rider Onboarding Data
Store license, driving license, vehicle plate number, and bank account/IFSC details required solely for identity verification and payout settlement.
2. Data Protection & Security
All data is securely encrypted in transit and at rest using industry standard AES-256 and SSL/TLS. Customer phone numbers are masked when shared with delivery partners for active orders.
3. Data Retention & Erasure Periods
We retain personal data only for as long as required to provide our hyperlocal services or satisfy statutory accounting and tax requirements:
Orders, Invoices & Financial Records: Retained for 8 years in accordance with Section 44AB of the Income Tax Act, 1961, and Goods and Services Tax (GST) laws.
Account & Contact Data: Retained during active account lifetime; upon receipt of a valid erasure request, all personal identifiers are purged or irreversibly anonymized within 90 days.
Authentication Logs, OTPs & Ephemeral Sessions: Expire automatically within 48 hours and are cleaned up via automated retention audits.
4. Named Third-Party Data Processors
To fulfill orders, verify identities, and process payments reliably, we share strictly necessary data with trusted data processors under binding confidentiality agreements:
5. Your Rights as a Data Principal (DPDP Act, 2023)
Manage in My DataUnder the Digital Personal Data Protection Act, 2023, you hold full legal rights over your digital personal data:
6. Designated Grievance Officer & Redressal
For any inquiries, consent withdrawal, or data rights requests under the DPDP Act, 2023, please contact our designated Grievance Officer:
Commitment: All grievances and data rights requests are acknowledged within 24 hours and addressed within 7 business days.