PRIVACY POLICY

• "Company", "Platform", "Host", "Guest", and "User" shall bear the meanings assigned to them in the Terms and Conditions.
• "Personal Data" means any data about a User by which such User is identifiable, whether directly or indirectly, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• "Sensitive Verification Data" means Aadhaar details, driving licence details, vehicle registration details, and biometric or photographic data submitted for verification purposes.
• "Data Principal" means the User to whom the Personal Data relates. "Data Fiduciary" means the Company, which determines the purpose and means of processing Personal Data.

• This Privacy Policy applies to all Personal Data collected by the Company through the Platform, whether from Hosts, Guests, or visitors, and describes the manner in which such data is collected, used, stored, shared, and protected.
• This Policy is issued in accordance with the DPDP Act, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.

The Company collects: (a) identity information including name, mobile number, and Aadhaar details; (b) Host-specific information including driving licence and vehicle registration certificate details; (c) location and GPS data during active use of the Platform and during a Trip; (d) device and usage information including device identifiers, IP address, application logs, and crash reports; (e) transaction and Coins wallet information; and (f) communications exchanged through the Platform’s in-application chat feature.

Personal Data is collected and processed for the specific and legitimate purposes of: (a) verifying User identity and eligibility; (b) enabling ride matching between Hosts and Guests; (c) facilitating live tracking and emergency safety features; (d) processing Coins transactions; (e) preventing fraud and ensuring platform integrity; (f) complying with legal and regulatory obligations; and (g) improving the Services.

• The Company processes Personal Data on the basis of the free, specific, informed, and unambiguous consent of the Data Principal, obtained at the time of registration and at each subsequent point where new categories of data are collected, in accordance with Section 6 of the DPDP Act.
• A Data Principal may withdraw consent at any time, provided that withdrawal of consent may result in the Company’s inability to continue providing the Services.

• Sensitive Verification Data is transmitted to a third-party verification service provider solely for the purpose of authenticating the document and confirming the corresponding identity attributes. The Company receives and stores only the verification outcome and such masked or minimal data as is reasonably necessary, and does not retain unmasked Aadhaar numbers beyond what is required for verification.
• Sensitive Verification Data shall be processed strictly in accordance with the Aadhaar Act, 2016 and applicable regulations of the Unique Identification Authority of India, to the extent such data is processed pursuant to Aadhaar-based verification.

Location data is collected during an active Trip to enable live tracking by the Host, the Guest, and, where activated, designated emergency contacts. Location data collected for this purpose is retained only for the duration reasonably necessary for safety, dispute resolution, and legal compliance purposes.

The Platform may use cookies, software development kits, and similar tracking technologies to enhance functionality, remember preferences, and analyse usage patterns. A User may control certain tracking preferences through device-level settings, subject to the Platform’s core functionality requiring certain data collection.

• The Company may share Personal Data with: (a) third-party identity verification service providers; (b) payment gateway service providers for processing Coins wallet transactions; (c) law enforcement or governmental authorities, where required by law or judicial order; and (d) professional advisors bound by confidentiality obligations.
• The Company does not sell Personal Data to third parties for independent marketing purposes.

Personal Data is retained only for so long as is necessary to fulfil the purposes described in this Policy, to comply with applicable legal, accounting, or reporting obligations, or to resolve disputes, following which such data shall be securely deleted or anonymised.

The Company implements reasonable security practices and procedures, including encryption in transit, access controls, and periodic security review, to protect Personal Data against unauthorised access, alteration, disclosure, or destruction, commensurate with the sensitivity of the data concerned.

The Company shall, to the extent required by applicable law or sectoral regulation, store and process Personal Data on servers located within India, and any cross-border transfer of Personal Data shall be undertaken only in accordance with the Cross-Border Transfer clause of this Policy.

• A Data Principal shall have the right to: (a) obtain a summary of Personal Data processed and the processing activities undertaken; (b) seek correction, completion, or updating of inaccurate or incomplete Personal Data; (c) seek erasure of Personal Data no longer necessary for the purpose for which it was collected, subject to legal retention requirements; (d) withdraw consent at any time; and (e) nominate another individual to exercise these rights in the event of death or incapacity, in accordance with the DPDP Act.
• Requests to exercise the foregoing rights may be submitted through the grievance mechanism described in the Grievance Officer and Consent Manager clause below and shall be addressed within the timelines prescribed under the Grievance Redressal Policy.

The Platform is not intended for use by, and does not knowingly collect Personal Data from, individuals below the age of eighteen (18) years. Where the Company becomes aware that data of a minor has been collected without appropriate verifiable parental consent, such data shall be deleted forthwith.

The Platform may contain links to third-party websites or services, including payment gateways and insurance partners, whose data practices are governed by their own privacy policies, over which the Company exercises no control and for which it accepts no liability.

Personal Data shall not be transferred outside India except to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act, and only where necessary for legitimate business or technical purposes, subject to appropriate contractual safeguards.

A Data Principal may withdraw consent for the processing of Personal Data by submitting a request through the Platform. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

In the event of a personal data breach, the Company shall notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and rules made thereunder.

The Company shall designate a Grievance Officer for the purposes of this Privacy Policy, whose contact particulars shall be published on the Platform and updated from time to time. Grievances concerning Personal Data shall additionally be governed by the Grievance Redressal Policy.

The Company reserves the right to amend this Privacy Policy at any time. Material changes shall be notified to Users through the Platform, and continued use following such notification constitutes acceptance of the amended Policy.

This Privacy Policy shall be governed by the laws of India, and courts at Vizianagaram, Andhra Pradesh shall have exclusive jurisdiction over any dispute arising herefrom.

By registering on and using the Platform, the User expressly and unambiguously consents to the collection, processing, storage, and disclosure of Personal Data in the manner described in this Privacy Policy.

• eZway's internal admin tools, used only by authorised eZway staff, connect to YouTube through Google sign-in so that the Company can publish videos to, and view analytics for, its own YouTube channel. This section does not apply to Hosts and Guests using the eZway app.
• When a staff member connects a channel, the Company receives the channel ID and title, the channel's subscriber, view and video statistics, and an access token that allows videos to be uploaded and channel data to be read. Only the YouTube upload and read-only permissions are requested.
• This data is used solely to publish content and to show channel analytics inside the eZway admin panel. It is not sold, not shared with third parties, and not used for advertising or to build user profiles.
• Access can be removed at any time by deleting the connected account in the admin panel, which permanently deletes its stored tokens, or by revoking eZway's access at https://myaccount.google.com/permissions.
• eZway's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Use of YouTube features is also subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).