Effective Date: 28 June 2026
PeddalDrop ("we", "us", or "our") is a Udyam-registered, cycle-only, low-emission last-mile delivery service operating in Pune, Maharashtra. We are registered as a sole proprietorship under Rashmi Bapat. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our platform, website (www.PeddalDrop.com), mobile application, or related services (collectively, the "Platform").
This Policy is prepared in compliance with the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and applicable provisions of the Digital Personal Data Protection Act, 2023 ("DPDP Act").
We do not intentionally collect sensitive personal data as defined under the SPDI Rules (e.g., passwords, financial account details, biometric data) except as strictly necessary for payment processing. PeddalDrop does not store card numbers, UPI credentials, or net banking passwords. All payment transactions are processed via our authorised payment gateway partner, and such data is governed by their PCI-DSS-compliant infrastructure.
To guarantee transparency and protect privacy, we apply a tiered retention approach to delivery location data generated during active delivery assignments (including pickup coordinates, route data, and drop-off points):
Retained for operational tracking, support, and immediate dispute resolution.
Moved from live databases to secure, restricted-access archival storage.
Permanently and irreversibly deleted from all PeddalDrop backup and storage servers.
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:
Please Note: While we enforce rigorous safety audits, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
We retain personal data only for as long as is necessary for the purposes set out in this Policy or as required by applicable law. Delivery location data is subject to the specific retention schedule set out in Section 4 above. Other data categories are retained in accordance with our internal data lifecycle policy and applicable statutory periods.
Subject to applicable Indian laws, you have the right to:
Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data (subject to legal obligations).
Withdraw consent for processing activities based on consent.
Notice: Deletion of your data or withdrawal of consent may result in you not being able to utilise PeddalDrop services that depend on such details.
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us promptly so we may delete it.
Our Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of such third parties. We encourage you to read their privacy policies before providing any personal information.
In accordance with Rule 5(9) of the SPDI Rules and applicable provisions of the IT Act, we have designated a Grievance Officer to address privacy-related concerns:
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website or sending a communication via your registered contact details. Continued use of our Platform after the effective date of any changes constitutes your acceptance of the revised Policy.