Privacy Policy

1. Introduction

Ridepe Technologies Private Limited (CIN: U52290UP2026PTC244786) ("Company", "we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, store, disclose, and protect your personal data when you visit our website (ridepe.co), use our services, or interact with us in any capacity.

This Policy is compliant with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act). We will update this Policy whenever changes in law or our practices require it, and we will display the revised "Last Updated" date at the top of this page.

2. Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Data Principal" means the individual to whom the personal data relates.
• "Data Fiduciary" means Ridepe Technologies Private Limited, which determines the purpose and means of processing personal data.
• "Processing" includes collection, storage, use, sharing, disclosure, and deletion of personal data.
• "Consent" means a clear, informed, and unambiguous agreement by the Data Principal to processing of their personal data.

3. What Data We Collect

3.1 Information You Provide

• Name, email address, phone number
• Business name and address
• Payment and billing information
• Communications you send us (email, contact forms, messages)
• Any other information you voluntarily provide

3.2 Automatically Collected Information

• IP address and browser type
• Pages visited and time spent on site
• Device type and operating system
• Referral URLs and search terms
• Cookie data (see Section 8)

3.3 Sensitive Personal Data (as per IT Rules 2011)

We may collect the following sensitive personal data only where strictly necessary and with your explicit consent:

• Financial information (for payment processing only)
• Government-issued identity and licence documents (see Section 3.4)
• Any other sensitive data as required for specific service delivery

3.4 Identity and Driving Licence Verification

Since Ridepe Technologies facilitates bike rental bookings, certain transactions require identity and driving credential verification before a vehicle is handed over. As part of this process, we may collect:

• Government-issued photo identity proof (Aadhaar, Voter ID, Passport, or equivalent)
• Valid driving licence details
• A live photograph for identity confirmation at the time of vehicle pickup

4. How We Use Your Data

We process your personal data for the following lawful purposes:

• To provide, manage, and improve our services
• To process transactions and send related information (invoices, receipts)
• To respond to your inquiries and customer support requests
• To send service-related communications
• To send promotional communications (only with your consent)
• To comply with legal obligations under applicable Indian law
• To detect, prevent, and address technical issues or fraud
• To process refunds, cancellations, and resolve booking disputes
• To verify identity and prevent misuse of accounts or multiple bookings under one account
• To analyse usage patterns and improve our website and services

5. Legal Basis for Processing

Under the DPDP Act, 2023, we process personal data on the following grounds:

• Consent: Where you have given clear, informed consent for processing.
• Contractual Necessity: Where processing is necessary for the performance of a contract with you.
• Legal Obligation: Where we are required by law to process your data.
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided such interests do not override your rights.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your data in the following limited circumstances:

6.1 Service Providers

We may share data with trusted third-party service providers who assist us in operating our website and services (e.g., payment processors, hosting providers, analytics services). These parties are bound by confidentiality obligations and may not use your data for their own purposes.

6.2 Bike Rental and Hotel Booking Partners

As Ridepe operates a marketplace connecting users to bike rental vendors and hotel partners, relevant booking details (name, contact number, identity proof, driving licence, and stay/rental dates) are shared with the specific partner fulfilling your booking, strictly to the extent required to complete that booking. Partners are contractually bound to use this data only for fulfilling the booking and not for independent marketing or resale.

6.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or to protect the rights, property, or safety of our Company, our users, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred. We will provide notice before your data is subject to a different privacy policy.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Transaction records: 7 years (as required under Indian tax laws)
• Customer communication records: 3 years
• Identity and driving licence verification records: Duration of booking + 1 year (as required under Motor Vehicles Act, 1988 and RTO compliance obligations)
• Refund and cancellation records: 7 years (for accounting and tax compliance)
• Website usage data: 12 months
• Consent records: Duration of service relationship + 3 years

8. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files placed on your device.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for the website to function properly. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics). These are enabled only with your consent.
• Preference Cookies: Remember your settings and preferences. Enabled only with your consent.

8.2 Cookie Consent and Control

When you first visit our website, you will be presented with a cookie consent banner. You may choose to accept all cookies, accept only essential cookies, or customise your preferences. You may withdraw or change your cookie consent at any time through the cookie settings option available on our website.

You can also control and manage cookies through your browser settings at any time. Please note that disabling non-essential cookies will not affect the core functionality of our services.

9. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Secure Socket Layer (SSL) encryption for data transmission
• Access controls and authentication mechanisms
• Regular security assessments
• Employee training on data protection

9.1 Data Breach Notification

In the event of a personal data breach that is likely to affect your rights, we will notify the Data Protection Board of India within 72 hours of becoming aware of the breach, and affected Users will be informed as soon as reasonably practicable thereafter, including details of the nature of the breach and the measures taken to mitigate it, as required under the DPDP Act, 2023.

9.2 Cross-Border Data Transfer

Where we use third-party service providers (such as cloud hosting, analytics, or payment gateway providers) whose servers may be located outside India, your personal data may be transferred to and processed in countries other than India. We ensure that such transfers are subject to appropriate safeguards, including contractual obligations requiring the recipient to maintain data protection standards equivalent to those applicable in India. By using the Platform, you consent to such cross-border transfer of your personal data to the extent necessary for the provision of our services.

10. Your Rights as a Data Principal

Under the DPDP Act, 2023 and applicable Indian law, you have the following rights:

• Right to Access: Obtain confirmation of whether we are processing your personal data and access a summary of such data.
• Right to Correction: Request correction or updating of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to applicable legal retention obligations.
• Right to Grievance Redressal: File a grievance with our designated Grievance Officer (see Section 13).
• Right to Withdraw Consent: Withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to withdrawal.
• Right to Nominate: Nominate another individual to exercise your rights in case of your death or incapacity.

11. Children's Privacy

Our services are not directed to individuals under the age of 18 years. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such data. Processing of personal data of children requires verifiable parental consent as mandated under the DPDP Act, 2023.

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of such websites and encourage you to review their privacy policies before providing any personal data.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we have designated a Grievance Officer to address any concerns regarding this Privacy Policy or the processing of your personal data:

14. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be effective upon posting the revised policy on our website with an updated "Last Updated" date at the top of this page. We encourage you to review this Policy periodically. Continued use of our services after any changes constitutes your acceptance of the updated Policy.

15. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Varanasi, Uttar Pradesh, India.