1. Introduction
I Drive Express Private Limited (“we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.
2. Data We Collect
2.1 Information you provide
- Account: Name, mobile number, email, profile photo
- Driver KYC: Driving license, Aadhaar number (masked), bank account details, address proof, character certificate
- Payment: Card/UPI details (processed by Razorpay; we don't store full card numbers)
- Support tickets: Chat messages, call recordings, feedback
2.2 Information collected automatically
- Device: Device model, OS version, IP address, unique device identifiers
- Location: Real-time GPS during active trips (with your permission); pickup and drop locations
- Usage: App interactions, booking history, in-app searches
- Cookies: On our website for analytics and preferences
3. How We Use Your Data
- To provide, personalise, and improve the Service
- To match you with a nearby driver and facilitate trips
- To process payments and issue invoices
- To send booking confirmations, OTPs, and support communications
- To verify driver identity and comply with KYC requirements
- To detect fraud, resolve disputes, and enforce our Terms
- To comply with legal obligations (tax, court orders, regulatory requests)
- To send marketing communications (only with your consent; you can opt out anytime)
4. Data Sharing
We share data only in these limited cases:
- With drivers/customers: Your name, phone (masked), and location are shared with the matched driver/customer for the trip duration.
- Service providers: Razorpay (payments), Twilio (OTP/SMS), Google Maps (routing), MongoDB Atlas (data storage) — all bound by data processing agreements.
- Legal: When required by law, subpoena, or to protect rights, property, or safety.
- Business transfers: In case of merger or acquisition, with prior notice.
We do NOT sell your personal data to advertisers or third parties.
5. Data Security
We implement industry-standard technical and organisational safeguards:
- TLS encryption in transit (HTTPS)
- Encryption at rest for sensitive fields (Aadhaar, bank details)
- Bcrypt-hashed passwords (never stored in plain text)
- Role-based access controls internally
- Regular security audits and vulnerability scans
No system is 100% secure. In case of a data breach, we will notify affected users within 72 hours as required by the DPDP Act.
6. Data Retention
- Active accounts: Data retained as long as the account exists.
- Trip records: 7 years (for tax and regulatory compliance).
- KYC documents: 5 years post-deactivation, per RBI/GoI norms.
- Support chats & call recordings: 1 year.
- Marketing consent: Until you opt out.
7. Your Rights (under DPDP Act)
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correct: Update or correct inaccurate data.
- Erase: Request deletion of your account and personal data (subject to legal retention requirements).
- Withdraw consent: Opt out of marketing communications or specific data processing.
- Portability: Receive your data in a machine-readable format.
- Grievance: Lodge a complaint with our Data Protection Officer.
To exercise these rights, email info@idriveexpress.com. We respond within 30 days.
8. Cookies
Our website uses essential cookies for session management and analytics cookies (Google Analytics, if applicable) to understand usage. You can disable non-essential cookies in your browser settings.
9. Children's Privacy
The Service is not intended for anyone under 18. We do not knowingly collect data from minors. If we discover such data, we delete it immediately.
10. Contact & Grievance Officer
Per the IT Act 2000 and DPDP Act 2023, our Grievance Officer / Data Protection Officer is:
- Email: info@idriveexpress.com
- Post: Data Protection Officer, I Drive Express Private Limited, Gera Imperium II, 601, 6th Floor, Patto, Panjim, North Goa 403001, India
- Response SLA: Within 30 days of receipt