Customer Privacy Policy

1. Data fiduciary notice

Maurya Service (“we”, “us”, “our”) operates a marketplace for product rentals and home services / repairs. When you register or transact as a Customer, we determine the purposes and means of processing certain personal data and act as a Data Fiduciary under the DPDP Act for that processing.

This Customer Privacy Policy explains:

• what personal data we collect about Customers;
• why and how we use it;
• whom we share it with (vendors, technicians, Razorpay, infrastructure providers);
• how long we keep it;
• your rights and how to exercise them; and
• how to contact our grievance officer.

Where we process data strictly on documented instructions of a vendor/technician for their own obligations, we may act as a Data Processor; the primary relationship for your marketplace account remains with us as fiduciary unless stated otherwise.

2. Categories of personal data

Depending on how you use the platform, we may collect the following categories of personal data:

2.1 Identity & account

• Name, email address, mobile number, profile photo (optional), hashed password, account IDs, referral/membership identifiers.
• OTP verification logs, login timestamps, device/browser metadata linked to your session.

2.2 Address & location

• Delivery/service address, landmark, pin code, city, floor/lift details.
• Map coordinates when you pick a location on the map or allow approximate GPS (where supported).
• Location preference cookies/storage for showing nearby products and technicians.

2.3 Orders, rentals & service bookings

• Cart contents, rental SKU, tenure, deposit, delivery/installation selections, return/pickup status.
• Service category, preferred slot, diagnosis notes, photos you upload for disputes, technician assignment history.
• Support tickets, call/chat transcripts, IVR records where recorded with notice.

2.4 Payments & billing

• Transaction amounts, payment status, Razorpay/payment gateway references, mandate/AutoPay registration IDs (not full card numbers).
• Wallet balance movements, refunds, invoice/MS numbers, GSTIN if provided.
• Limited payment instrument metadata (e.g. last four digits, UPI handle mask, bank name) as returned by the gateway.

2.5 Communications & marketing preferences

• SMS/WhatsApp/email delivery status, campaign opt-in/opt-out flags, survey responses, product ratings and reviews.

2.6 Technical & usage

• IP address, browser/app type, pages viewed, crash logs, anti-fraud signals, cookie identifiers.

We do not intentionally collect special categories of personal data (such as biometric templates for Aadhaar authentication on our servers, health data, or political opinions) as part of standard Customer onboarding. If you voluntarily share photos or notes that contain sensitive information in a support ticket, we process them only for resolving that issue.

3. Purposes of processing

We process Customer personal data for the following purposes:

• Account creation & authentication — register you, verify OTP, secure login, password reset.
• Order fulfilment — process rentals and service bookings; share necessary details with assigned vendors/technicians.
• Payments & collections — take payments, manage deposits, refunds, wallets, AutoPay mandates, and dunning reminders.
• Logistics & scheduling — delivery, installation, relocation, pickup, technician routing.
• Customer support & dispute handling — respond to queries, investigate damage/deposit disputes, quality issues.
• Personalisation & serviceability — show relevant catalogue, pricing, and availability for your area.
• Legal & compliance — tax invoices, accounting, fraud prevention, responding to lawful requests.
• Improvement & analytics — aggregated usage analysis, product performance, app stability.
• Marketing — promotional offers where permitted and not opted out.

We process only data adequate and relevant for these purposes and avoid excessive collection.

4. Legal bases & consent

Under the DPDP Act and related frameworks, we rely on one or more of the following, as applicable:

• Consent — e.g. when you register, accept policies, enable marketing, register an AutoPay mandate, or upload optional profile information. You may withdraw consent for optional processing without affecting core services where withdrawal is permitted by law.
• Performance of contract / service — processing necessary to provide rentals, services, payments, and support you request.
• Legal obligation — GST records, responding to court/government orders, mandatory retention.
• Legitimate uses — fraud prevention, network security, enforcing our terms, and protecting rights where recognised under applicable law.

By using the platform as a Customer, you acknowledge this notice. Where explicit consent is required (certain marketing, optional features), we will ask separately. You may manage some preferences in-app or by contacting us.

5. Sharing with vendors, technicians & processors

We share personal data only as needed and under contractual safeguards:

5.1 Vendors (rentals)

Assigned vendors receive fulfilment data such as your name, phone, address, order details, delivery slot, and return/pickup instructions. They must use this data only to deliver, install, maintain, inspect returns, and comply with law—not for unsolicited marketing or off-platform solicitation.

5.2 Technicians (services)

Assigned technicians receive job data such as name, phone, address, service type, issue description, and photos you provide. Access ends when the job is closed, subject to support/quality retention needs.

5.3 Payment & infrastructure partners

• Razorpay and other regulated payment aggregators — payment processing, mandates, refunds.
• Cloud hosting, SMS/WhatsApp/email providers, maps, analytics — as processors under contract and confidentiality terms.

5.4 Legal & business transfers

We may disclose data to authorities when required by law, or to advisers/ acquirers in a merger or restructuring with appropriate safeguards and notice where required.

We do not sell your personal data. We do not share it with unrelated third parties for their independent marketing without your consent.

6. Payment processing (Razorpay)

Card, UPI, netbanking, wallet, and mandate payments are handled by Razorpay Software Private Limited and/or other RBI-authorised partners. Their privacy policies govern payment instrument handling on their systems.

• We receive confirmation tokens, payment IDs, mandate IDs, and limited instrument metadata—not full card numbers or CVV.
• AutoPay registration flows may redirect you to bank/UPI apps for authentication; those interactions are also subject to issuer policies.
• Keep payment disputes factual; raising false “unauthorised transaction” claims may violate mandate terms and law.

7. Cookies & device data

We use cookies, local storage, and similar technologies to:

• maintain login sessions and security tokens;
• remember cart, language, and location preferences;
• measure basic analytics and diagnose errors; and
• prevent fraud and bot abuse.

Essential cookies are required for core functionality. Non-essential analytics or marketing cookies, where used, will be managed per applicable consent requirements. You can control cookies in browser settings; disabling essential cookies may break login or checkout.

8. Data retention

We retain personal data only as long as necessary for the purposes above, including:

• Active account period — while you maintain a Customer account or have open orders/mandates.
• Post-closure — limited retention for invoices, tax, deposit disputes, fraud investigations, and legal claims (often several years as permitted/required by Indian tax and commercial law).
• Support records — typically retained for a defined period to improve service and resolve repeat issues.
• Marketing suppression lists — retained after opt-out to honour your preference.

When retention ends, we delete or anonymise data unless further retention is legally required or archiving is necessary with restricted access.

9. Security measures

We implement reasonable technical and organisational measures appropriate to the risk, including:

• TLS encryption in transit for web traffic;
• hashed password storage and role-based access controls;
• logging and monitoring for suspicious activity;
• vendor/technician access limited to assigned orders;
• periodic review of processor agreements and access lists.

No method of transmission or storage is completely secure. Promptly notify us if you suspect unauthorised account access or a partner misusing your contact details.

In the event of a personal data breach likely to harm Data Principals, we will take steps required under the DPDP Act, including notification to the Data Protection Board and affected individuals where applicable.

10. Your rights (Data Principal rights)

Subject to the DPDP Act and applicable exceptions, you may have the right to:

• Access — obtain a summary of personal data we process and identities of other fiduciaries/processors with whom data has been shared.
• Correction & updating — rectify inaccurate or incomplete data (many fields editable in-app).
• Erasure — request deletion when data is no longer necessary for the stated purpose, consent is withdrawn (where consent was the basis), or processing is unlawful—subject to legal retention and open contractual obligations (e.g. active rental, pending deposit, tax records).
• Grievance redressal — raise complaints via our grievance officer (below).
• Nomination — nominate another individual to exercise rights on your behalf in the event of death or incapacity, as permitted under the DPDP Act.

To exercise rights, email us with verification of identity. We respond within timelines prescribed by law. We may refuse manifestly unfounded or excessive requests where allowed.

11. Grievance officer

In accordance with the DPDP Act and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (where applicable), you may contact our Grievance Officer for privacy complaints:

• Grievance Officer — Maurya Service
• Email: infomauryaservice@gmail.com
• Phone: 098109 52691
• Subject line: “Privacy grievance — Customer account”

Please include your registered mobile number, account email (if any), and order/MS reference. We aim to acknowledge grievances promptly and resolve within statutory timelines. If unsatisfied, you may escalate to the Data Protection Board of India when constituted and available under law.

12. Children

Maurya Service Customer accounts are intended for individuals 18 years and older. We do not knowingly collect personal data from children without appropriate parental consent required by law. If you believe a minor has provided data, contact the grievance officer to request deletion.

13. Cross-border transfers

Our primary systems and support operations are in India. Some processors (e.g. cloud hosting, email, analytics, payment partners) may process data on servers located outside India under contractual clauses and applicable DPDP transfer rules. Where the Central Government specifies countries or territories for transfer, we align transfers accordingly. By using the platform, you acknowledge such transfers may occur for service delivery, subject to safeguards.

14. Changes to this notice

We may update this Customer Privacy Policy for legal, technical, or business changes. The “Last updated” date at the top will change. Material changes may be communicated via email, SMS, or in-app notice. Continued use after the effective date means you acknowledge the updated notice; where fresh consent is required by law, we will obtain it.

15. Contact & related documents

Questions about privacy or data requests:

• Email: infomauryaservice@gmail.com
• Phone: 098109 52691

Related agreements:

• Customer Terms & Conditions
• Platform Privacy Policy
• Platform Terms & Conditions