uDrive uDrive

Privacy policy

Last updated:

Draft — to be reviewed by a lawyer

This page is a working draft and is not yet a final policy. Items in [BRACKETS] must be completed before launch.

This privacy policy explains how [COMPANY LEGAL NAME] ("uDrive", "we", "us") collects and processes your personal data when you use our website, mobile app and rental services. We process personal data in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and the Information Technology Act, 2000.

1. Who is responsible for your data

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], is the Data Fiduciary for the personal data described here. Franchise hubs operating under the uDrive brand process booking data on our instructions.

2. Personal data we collect

  • Identity and contact: name, mobile number, email address, date of birth, address.
  • KYC documents: driving licence (number and images), Aadhaar (we store only the last four digits of the number together with the document image you upload, and you may mask the first eight digits), passport and visa for foreign nationals, and a selfie if requested for verification.
  • Booking data: vehicle, hub, dates, pickup or delivery address and location, add-ons, coupons, handover photos, odometer and fuel readings, damage reports.
  • Payment data: amount, UPI transaction reference (UTR), payment status and refund details. We do not collect or store your UPI PIN, card numbers or bank passwords.
  • Vehicle location: GPS position of the rented vehicle during the rental period, where the vehicle has a tracker.
  • Device and usage data: IP address, device and browser type, app version, pages viewed, and security logs.

3. Why we use it (purposes)

  • To create your account and verify your phone number by OTP.
  • To verify your identity and driving eligibility (KYC) before handing over a vehicle, as required by law and our insurers.
  • To take bookings, collect payments, issue GST invoices and process refunds.
  • To deliver and collect vehicles, provide roadside help and recover vehicles that are overdue, stolen or misused.
  • To handle damage, traffic fines and insurance claims.
  • To send service messages (booking confirmations, reminders, OTPs). Marketing messages are sent only with your separate consent, which you can withdraw at any time.
  • To keep our services secure, prevent fraud and comply with legal obligations and lawful requests from authorities.

We rely on your consent, given when you sign up and book, and on the legitimate uses permitted under the DPDP Act (such as compliance with law and responding to emergencies).

4. Who we share it with

  • The hub (including franchise partners) that fulfils your booking.
  • Service providers acting for us: SMS and messaging providers, cloud hosting, payment and banking partners, GPS tracker providers, and our insurers and surveyors when there is a claim.
  • Police, transport authorities or courts when required by law, or to report a stolen vehicle or a traffic offence committed during your rental.

We do not sell your personal data. Where data is processed outside India, we do so only as permitted under the DPDP Act.

5. How long we keep it

  • KYC documents: for as long as your account is active and up to [365] days after approval, after which images are deleted; rejected documents are deleted within [30] days.
  • Booking, payment and invoice records: for 8 years, as required by tax and accounting laws [CONFIRM].
  • Vehicle GPS data: [90] days after the rental ends, unless needed for an open claim or dispute [CONFIRM].
  • Security logs: [180] days [CONFIRM].

When you delete your account we erase or anonymise your personal data, except records we must keep by law. See Delete your account.

6. Your rights

Under the DPDP Act you can:

  • ask for a summary of the personal data we hold about you and how we process it;
  • ask us to correct, complete or update your data;
  • ask us to erase your data, subject to legal retention requirements;
  • withdraw consent at any time (this does not affect processing already done, and we may be unable to rent you a vehicle without KYC);
  • nominate another person to exercise your rights in case of death or incapacity;
  • raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

7. Security

We encrypt sensitive fields (such as licence numbers, addresses and payment evidence) at rest, serve KYC images only through short-lived signed links to authorised staff, restrict staff access by role and hub, and keep audit logs. No system is perfectly secure; if a personal data breach affects you, we will inform you and the Data Protection Board as required.

8. Children

Our services are for adults who hold a valid driving licence. We do not knowingly process the personal data of children under 18.

9. Grievance officer

[GRIEVANCE OFFICER NAME]
Email: [GRIEVANCE OFFICER EMAIL]
Address: [REGISTERED ADDRESS]

We will acknowledge your grievance within [48 hours] and aim to resolve it within [30 days].

10. Changes

We will post any changes on this page and, for material changes, notify you in the app or by SMS.