Privacy Policy

1. DEFINITIONS

1.1 In this Policy, unless the context otherwise requires:

(a) "Consent Notice" means a notice presented by the Company on the Platform, separately from this Policy and the Terms, by which the consent of a Data Principal is requested for a specified purpose.

(b) "Data Fiduciary" has the meaning assigned to it in the DPDP Act.

(c) "Data Principal", "you" or "your" means the individual to whom Personal Data relates, and includes a Customer who is an individual, a Customer Representative, an authorised signatory or employee of a Business Customer, and a visitor to the Platform.

(d) "Data Processor" means any person who processes Personal Data on behalf of the Company.

(e) "Personal Data" means any data about an individual who is identifiable by or in relation to such data.

(f) "Personal Data Breach" has the meaning assigned to it in the DPDP Act.

(g) "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, sharing, disclosure, restriction, erasure and destruction; and "process" shall be construed accordingly.

(h) "Sensitive Personal Data or Information" has the meaning assigned to it in rule 3 of the SPDI Rules, and includes passwords and financial information such as bank account, credit card, debit card or other payment instrument details.

2. SCOPE AND APPLICATION

2.1 This Policy applies to Personal Data processed by the Company in relation to: (a) Customers who are individuals; (b) Customer Representatives and other individuals whose particulars are furnished by a Customer; (c) authorised signatories, proprietors, partners, directors and employees of Business Customers, and the representatives of a buyer under an Institutional Bulk Supply Agreement with the Company; and (d) visitors to the Platform.

2.2 The Personal Data of drivers and other members of the Delivery Crew is governed by the Delivery Partner Privacy Notice, which forms part of the Delivery Partner Terms and Code of Conduct.

2.3 Information relating to a body corporate, firm or other entity which does not identify an individual is not Personal Data. It is nevertheless held in confidence by the Company in accordance with the Terms.

2.4 The Company is the Data Fiduciary in respect of the Personal Data to which this Policy applies. Its particulars are set out in clause 21.

3. PERSONAL DATA COLLECTED

3.1 The Company collects the following categories of Personal Data:

(a) Identity and contact data: name, mobile number, electronic mail address and postal address.

(b) Account data: the registered mobile number, the record of authentication by one-time password, language preference and Account settings.

(c) Verification data: proof of identity and address, proof of ownership or lawful occupation of the Registered Site and any licence for the storage of petroleum, where the Company requires them of a Customer; and, in the case of proprietors, partners, directors and authorised signatories, the Permanent Account Number, the goods and services tax identification number and documents evidencing authority to act.

(d) Site and equipment data: the address and geographical co-ordinates of the Registered Site, access instructions, photographs of the site and of the Receiving Tank, particulars of Eligible Equipment, and the names and contact numbers of Customer Representatives.

(e) Order and transaction data: Orders placed, quantities, Delivery Slots, invoices, payment status and history.

(f) Payment data: the mode of payment, and the transaction reference and status communicated by the payment aggregator; bank account particulars where furnished by you for the purpose of a refund; and, where a Business Customer applies for credit, such financial particulars of its proprietor or partners as are furnished for the assessment of credit, and the particulars of any e-mandate registered in favour of the Company. The Company does not collect or store card numbers, card verification values, personal identification numbers or UPI PINs.

(g) Delivery records: Meter readings, Delivery Notes, photographs taken at the time of Delivery, the time and location of the Bowser at Delivery, the name of the Customer Representative and the acknowledgement given by him or her.

(h) Device and technical data: device model, operating system, application version, device identifiers, internet protocol address, and crash and diagnostic logs.

(i) Location data: the precise location of your device, where you permit it, for the purpose of fixing the point of Delivery. The customer application does not collect location in the background.

(j) Communications data: correspondence with customer support, complaints, feedback and reviews [and, where you have consented, recordings of calls with customer support].

(k) Cookie and usage data: information collected through cookies and similar technologies on the website, and through software development kits in the mobile applications, as described in the Cookie and Tracking Technologies Policy.

(l) Incident data: where a fire, spillage, injury or other incident occurs in connection with a Delivery, the particulars of the incident and of the persons concerned. Information about an injury is recorded only so far as is necessary for the reporting and investigation of the incident and for any claim arising from it.

3.2 Personal Data is collected: (a) directly from you, when you register, furnish documents, register a site, place an Order, make a payment or communicate with the Company; (b) automatically, through your use of the Platform; and (c) from third parties, namely the payment aggregator (confirmation of payment), verification service providers and public registers (verification of the particulars furnished by you), and a Customer who furnishes your particulars as its representative.

3.3 Where the furnishing of any Personal Data is necessary for the provision of the Service and you decline to furnish it, the Company may be unable to register the Account or to accept or perform an Order.

3.4 The Company does not seek, and requests you not to furnish, any Personal Data that is not required for the purposes set out in clause 4.

4. PURPOSES OF PROCESSING

4.1 The Company processes Personal Data only for the following specified purposes:

(a) Registration and administration of the Account, and authentication of users.

(b) Verification of the identity, constitution and authority of Customers, and approval of Registered Sites and Eligible Equipment.

(c) Acceptance and performance of Orders, including pricing, scheduling, routing, Delivery and proof of Delivery.

(d) Processing of payments and refunds, invoicing, accounting, the assessment and administration of credit extended to Business Customers, and recovery of amounts due.

(e) Safety and regulatory compliance, including the maintenance of records of customers, sites and equipment required under the Licence, the preparation of site-specific emergency plans, the reporting and investigation of incidents, and the furnishing of information to competent authorities.

(f) Customer support, the handling of complaints and grievances, and the investigation of claims relating to quantity or quality.

(g) The establishment, exercise or defence of legal claims.

(h) Security of the Platform, and the prevention and detection of fraud, misuse and unlawful activity.

(i) Communications necessary for the Service, including one-time passwords, Order and Delivery notifications, invoices, safety intimations and notices of changes to the Terms and Policies.

(j) Analysis and improvement of the Platform and the Service, using aggregated or anonymised data wherever practicable.

(k) Promotional and marketing communications, only where you have given separate consent.

(l) Compliance with obligations under Applicable Law, including the laws relating to taxation, accounts, audit and petroleum.

4.2 The Company shall not process Personal Data for any purpose incompatible with the purposes set out above without first notifying you and, where required, obtaining your consent.

4.3 The Company does not sell Personal Data.

5. GROUNDS OF PROCESSING

5.1 The Company processes Personal Data on the following grounds:

(a) Consent: where you have given consent in response to a Consent Notice for a specified purpose.

(b) Voluntary provision for a specified purpose: where you have voluntarily furnished Personal Data to the Company for a specified purpose, such as the placing of an Order, and have not indicated that you do not consent to its use for that purpose.

(c) Legal obligation: where Processing is necessary for the performance of an obligation which any law for the time being in force casts upon the Company to disclose information to the State or any of its instrumentalities, or for compliance with any judgment, decree or order.

(d) Such other grounds as are recognised by Applicable Law.

5.2 Sensitive Personal Data or Information is collected only with your consent, for a lawful purpose connected with the Service, and only where its collection is necessary for that purpose. This does not apply to incident data under clause 3.1(l), which is recorded so far as Applicable Law requires or permits for the reporting of the incident and for the establishment, exercise or defence of legal claims.

6. CONSENT AND ITS WITHDRAWAL

6.1 Wherever consent is the ground of Processing, the Company shall request it through a Consent Notice which describes, in clear and plain language, the Personal Data to be processed and the purpose of Processing, and which explains how consent may be withdrawn, how your rights may be exercised and how a complaint may be made.

6.2 Consent shall be obtained by a clear affirmative action. The Company does not use pre-ticked boxes, and does not treat your acceptance of the Terms or your continued use of the Platform as consent to any Processing for which consent is required.

6.3 Consent to promotional communications, and every other optional consent, is requested separately and is not a condition of the Service.

6.4 You may withdraw any consent at any time, with the same ease with which it was given, through the privacy settings of the Platform or by writing to the Company at the address in clause 21. The withdrawal of consent shall not affect the lawfulness of Processing carried out before withdrawal.

6.5 Upon withdrawal, the Company shall cease, and shall cause its Data Processors to cease, the Processing to which the consent related within a reasonable time, unless the Processing is required or authorised by Applicable Law. Where the Personal Data concerned is necessary for the Service, the Company may be unable to continue to provide the Service or the relevant feature, and shall so inform you.

6.6 Consent Notices and this Policy are available in English [and in Telugu and Hindi]. You may request the Company to make them available in any other language specified in the Eighth Schedule to the Constitution of India.

6.7 The Company maintains a record of every consent given and withdrawn.

6.8 From the commencement of the provisions of the DPDP Act relating to Consent Managers, you may also give, manage, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India.

7. DISCLOSURE OF PERSONAL DATA

7.1 The Company discloses Personal Data only to the following categories of recipients, and only to the extent necessary for the purposes set out in clause 4:

(a) The Delivery Crew assigned to an Order and, where they are engaged through a contractor or fleet operator, that contractor or fleet operator, who receive the particulars of the Registered Site, the Customer Representative and the Order.

(b) Data Processors engaged by the Company under written contract, namely providers of cloud hosting and storage; of mapping and navigation services; of messaging, telephony and electronic mail services; of analytics and crash-reporting services; of customer-support tools; and of verification services.

(c) Payment aggregators, payment system providers and banks, for the making of payments and refunds, and the auditors and professional advisers of the Company. Each is bound by duties of confidence and, to the extent that it determines the purpose and means of Processing, is responsible in its own right under Applicable Law.

(d) The Source Retail Outlet and the OMC, to the extent required under the authorisations under which the Service is provided.

(e) Competent authorities, including the Petroleum and Explosives Safety Organisation, the District Authority, the departments administering civil supplies and legal metrology, tax authorities, courts and law-enforcement agencies, where disclosure is required by Applicable Law or by a lawful order.

(f) Insurers, in connection with any incident or claim.

(g) A successor to the whole or any part of the business of the Company upon a merger, amalgamation, transfer or reorganisation, subject to prior notice to you and to the successor being bound by obligations no less protective than this Policy.

(h) Any other person, with your consent or at your direction.

7.2 Every Data Processor shall be bound by contract to process Personal Data only on the instructions of the Company, to maintain its confidentiality, to implement reasonable security safeguards and afford the Personal Data protection not lower than that stated in this Policy, to notify the Company of any Personal Data Breach, and to erase or return the Personal Data when its engagement ends.

7.3 The identities of the Data Processors and other Data Fiduciaries with whom Personal Data has been shared shall be furnished on a request made under clause 12.

8. PLACE OF STORAGE AND TRANSFER OUTSIDE INDIA

8.1 Personal Data is stored on servers located in [India].

8.2 Certain Data Processors may process Personal Data at locations outside India. In such cases the Company shall ensure that the recipient is bound by contract to observe a standard of protection not lower than that required of the Company under Applicable Law.

8.3 The Company shall not transfer Personal Data to any country or territory to which such transfer is restricted by the Central Government under the DPDP Act.

9. RETENTION AND ERASURE

9.1 The Company retains Personal Data only for as long as is necessary for the purpose for which it was collected or as is required by Applicable Law, whichever is longer, and thereafter erases or anonymises it.

9.2 Subject to clause 9.3, the periods of retention are as follows:

(a) Account, identity and contact data: for the life of the Account and for [one hundred and eighty days] after its closure.

(b) Verification data: for [eight years] from the end of the financial year in which the last transaction with the Customer took place. Where no transaction has taken place, verification data is erased within [thirty days] after the closure of the Account or the refusal of registration. [In the case of a Customer who is an individual, the document furnished is erased [three years] after [it is furnished], and only the record of the result of verification is retained for the balance of that period.]

(c) Order, transaction, invoice and payment data: for [eight years] from the end of the financial year to which they relate, being the period for which books of account and tax records are required to be preserved. [Bank account particulars furnished for a refund are masked, save for the last four digits of the account number, once the refund has been paid.] Financial particulars furnished for the assessment of credit, and the particulars of an e-mandate, are retained for [eight years] from the end of the financial year in which the credit ends.

(d) Delivery records, including Meter readings, Delivery Notes and photographs: for [three years] from the date of Delivery. The particulars of a Delivery Note which support an invoice, namely the date, the Registered Site, the Meter readings and the quantity Delivered, are retained with the invoice under item (c); the names of the Customer Representative and of the Delivery Crew are not.

(e) Site and equipment data: for so long as the site remains a Registered Site and for [three years] thereafter, or for such longer period as the Licence may require. The name and contact number of a Customer Representative are retained as contact particulars only while he or she remains a representative for the site, and are removed when he or she ceases to be one or so requests. His or her acknowledgement of a Delivery is retained as part of the Delivery record under item (d).

(f) Location data of the customer's device: used at the time of fixing the point of Delivery and retained only as part of the address of the Registered Site.

(g) Communications data and records of complaints: for [three years] from the closure of the matter. [Recordings of calls: for [ninety days], unless required for a pending complaint or claim.]

(h) System logs and security logs: for not less than one year. Device and technical data recorded with an Order or a Delivery are retained with that record under item (c) or (d).

(i) Records of consent and of acceptance of the Terms and the Policies, including the device and technical data recorded with them: for the duration of the Processing or contract to which they relate and for [three years] thereafter.

(j) Data processed for promotional communications: until consent is withdrawn.

(k) Cookie and usage data collected for analytics: for [fourteen] months from its collection.

(l) Incident data: for [five years] from the date of the incident or, where later, the closure of its investigation.

(m) Records of a Personal Data Breach or other security incident, so far as they contain Personal Data: for [five years] from the closure of the incident.

9.3 The Company may retain Personal Data beyond the periods stated in clause 9.2 where retention is necessary for compliance with Applicable Law, for the purposes of a pending or reasonably anticipated legal proceeding, investigation or claim, or pursuant to the order of a competent authority.

9.4 Erasure of Personal Data upon closure of the Account is further dealt with in the Account and Data Deletion Policy.

9.5 From the commencement of any provision of the DPDP Rules which requires Personal Data, associated traffic data or logs of Processing to be retained for a minimum period, the Company shall retain them for not less than that period, notwithstanding any shorter period stated in clause 9.2.

10. SECURITY

10.1 The Company maintains reasonable security practices and procedures, including a documented information security programme containing managerial, technical, operational and physical security control measures commensurate with the Personal Data protected.

10.2 The measures maintained by the Company include: (a) encryption of Personal Data in transit [and at rest]; (b) controls on access to Personal Data, granted on the basis of need; (c) logging and monitoring of access, and periodic review of logs; (d) backup of data to preserve continuity of Processing; (e) contractual and other safeguards in respect of Data Processors; and (f) training of personnel who handle Personal Data.

10.3 You are responsible for the security of your device and of the credentials of your Account, and should inform the Company forthwith of any suspected unauthorised use.

10.4 No method of transmission or storage is wholly secure. This statement does not diminish the obligations of the Company under Applicable Law.

11. PERSONAL DATA BREACH

11.1 In the event of a Personal Data Breach, the Company shall, without delay and in the manner required by Applicable Law, inform each affected Data Principal of the nature, extent and timing of the breach, its likely consequences, the measures taken to mitigate it, the steps that the Data Principal may take to protect himself or herself, and the contact particulars of the person who can respond to queries.

11.2 The Company shall also report the breach to the Indian Computer Emergency Response Team and, from the commencement of the provisions of the DPDP Act relating to the intimation of Personal Data Breaches, to the Data Protection Board of India, within the periods and in the manner prescribed by Applicable Law.

12. RIGHTS OF THE DATA PRINCIPAL

12.1 Subject to Applicable Law, you have the following rights in respect of your Personal Data:

(a) The right to obtain a summary of the Personal Data being processed by the Company and of the Processing activities undertaken in respect of it, and the identities of the other Data Fiduciaries and Data Processors with whom it has been shared together with a description of the Personal Data so shared.

(b) The right to have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, and Personal Data updated.

(c) The right to have Personal Data erased, unless its retention is necessary for the specified purpose or for compliance with Applicable Law.

(d) The right to withdraw consent in accordance with clause 6.

(e) The right to readily available means of grievance redressal in accordance with clause 21.

(f) The right to nominate another individual who shall, in the event of your death or incapacity, exercise your rights.

(g) The right to review the information furnished by you and to decline to furnish, or to withdraw, any Sensitive Personal Data or Information.

12.2 A request to exercise any right may be made through the privacy settings of the Platform or by electronic mail to the address in clause 21. The request should state the mobile number or electronic mail address registered in the Account. The Company may take reasonable steps to verify the identity of the person making the request.

12.3 The Company shall acknowledge every request within [forty-eight hours] and shall communicate its decision on it within [fifteen days] of receipt, and in any event within the period prescribed by Applicable Law. No fee is charged for the exercise of these rights.

12.4 Where a request cannot be acceded to in whole or in part, the Company shall inform you of the reasons.

13. DUTIES OF THE DATA PRINCIPAL

13.1 You are requested to observe the duties which Applicable Law casts upon Data Principals, namely: to furnish only information that is authentic; not to impersonate another person; not to suppress any material information when furnishing Personal Data for any document or proof of identity or address; and not to register any false or frivolous grievance or complaint.

14. CHILDREN

14.1 The Platform and the Service are intended only for persons who have attained the age of eighteen years. The Company does not knowingly collect the Personal Data of any person below that age.

14.2 Where the Company learns that Personal Data of a person below the age of eighteen years has been collected without the verifiable consent of a parent or lawful guardian, it shall erase that Personal Data and close the Account concerned.

14.3 The Company does not undertake tracking or behavioural monitoring of children or advertising targeted at children.

15. COOKIES AND TRACKING TECHNOLOGIES

15.1 The use of cookies on the website and of software development kits in the mobile applications is described in the Cookie and Tracking Technologies Policy.

16. DEVICE PERMISSIONS

16.1 The customer application may request the following permissions, each of which is optional and may be revoked at any time through the settings of your device:

(a) Location, while the application is in use, to fix the point of Delivery.

(b) Camera and photographs, to upload documents and photographs of the Registered Site and Receiving Tank.

(c) Notifications, to deliver Order and Delivery notifications.

16.2 The refusal or revocation of a permission may limit the corresponding feature but shall not, of itself, prevent the use of the Platform.

17. THIRD-PARTY SERVICES

17.1 The Platform may contain links to, or incorporate services of, third parties, including payment, mapping and messaging services. The Processing of Personal Data by such third parties in their own right is governed by their respective privacy policies. This clause does not affect the responsibility of the Company for its Data Processors.

18. BUSINESS CUSTOMERS

18.1 A Business Customer which furnishes the Personal Data of its representatives or employees to the Company shall ensure that it is entitled to do so and that the individuals concerned have been informed of this Policy.

19. SIGNIFICANT DATA FIDUCIARY

19.1 If the Company is notified as a Significant Data Fiduciary under the DPDP Act, it shall comply with the additional obligations applicable to that class of Data Fiduciary.

20. CHANGES TO THIS POLICY

20.1 The Company may amend this Policy from time to time. Every amended version shall bear a new version number and effective date and shall be published on the Platform.

20.2 The Company shall notify you of any material amendment not less than [fifteen] days before it takes effect, by notification on the Platform and by electronic mail or short message service. Where an amendment involves Processing for a new purpose for which consent is required, the Company shall request such consent through a Consent Notice.

20.3 Superseded versions of this Policy are retained by the Company and shall be made available on request.

21. GRIEVANCE OFFICER AND DATA PROTECTION CONTACT

21.1 Any question, request or grievance concerning the Processing of Personal Data may be addressed to:

Grievance Officer and Data Protection Contact: [name], [designation].

Petrobazaar.com Private Limited, H. No. 291, 292, Flat No. 103, Sai Krupa Residency, Swarnapuri Colony, Miyapur, Hyderabad, Telangana 500049.

Electronic mail: [●]. Telephone: [●]. Hours: [●].

21.2 Every grievance shall be acknowledged within twenty-four hours of receipt and assigned a unique reference number, and shall be resolved within [fifteen days] and in any event within the period prescribed by Applicable Law.

21.3 A Data Principal who is not satisfied with the response of the Company may, after exhausting the foregoing mechanism, approach the authority which Applicable Law provides, being, from the commencement of the relevant provisions of the DPDP Act, the Data Protection Board of India, or pursue any other remedy available under Applicable Law.

22. GOVERNING LAW

22.1 This Policy shall be governed by the laws of India. A dispute between the Company and a Customer arising under it shall be resolved in accordance with the Terms. In any other case the courts at Hyderabad, Telangana shall have jurisdiction. Nothing in this clause prejudices any right or remedy available to a Data Principal under Applicable Law.