DPDP Act, 2023 Compliant

Privacy Policy & Data Notice

At Dooribaaz.com, we are committed to processing your digital personal data with transparency, dignity, and high security. This policy serves as your itemized privacy notice in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India).

Last Updated: October 2026 | Effective Date: Immediately

1. Personal Data Collected & Lawful Grounds (DPDP §4, §5, §6)

We process personal data strictly where you have provided free, specific, informed, unconditional, and unambiguous affirmative consent, or for fulfilling a contract requested by you (e.g. order delivery):

Category	Data Elements	Purpose	Lawful Basis
Identity & Contact	Full Name, Email Address, 10-Digit Mobile Number	Account creation, authentication (OTP/password), order tracking notifications	Consent (DPDP §6)
Fulfillment & Delivery	Shipping Street Address, City, State, Postal PIN Code	Packaging, shipping courier dispatch, return pickup coordination	Contractual Fulfillment
Financial & Billing	Order Total, Payment ID, Invoice Records	Payment verification via Razorpay; tax & GST invoice compliance	Legal Obligation (GST Act)
Technical / Session	IP Address (masked in logs), User-Agent, Session Cookies (`jwt`, `refreshToken`)	Session security, brute-force mitigation, account protection	Security Safeguard (DPDP §8)

Dooribaaz NEVER collects, logs, or stores sensitive financial credentials such as complete Credit/Debit Card numbers, CVVs, UPI PINs, or Net Banking passwords. All card and UPI payments are cleared directly by our RBI-licensed gateway partner, Razorpay.

2. Authorized Third-Party Data Processors (DPDP §8)

We engage vetted third-party data processors who operate under strict contractual data protection agreements:

Razorpay Software Pvt. Ltd. (Payment Gateway): Processes tokenized payments, UPI intents, and card settlements. Operates under PCI-DSS Level 1 compliance and RBI regulations.
Cloudinary Ltd. (Media & Image CDN): Delivers product lifestyle imagery and catalogue assets globally via encrypted HTTPS CDNs.
Google Workspace SMTP Relay: Transmits transactional order confirmations, tracking alerts, and return lifecycle updates using encrypted TLS 1.3 tunnels.
Authorized Courier Logistics Partners: Receives customer shipping name, delivery address, and contact number solely for final-mile package transit and return pickups.

3. Data Retention Schedule (DPDP §8)

Under DPDP Act §8, personal data is not retained beyond the period necessary for fulfilling the specified purpose, except where mandated by statutory law:

Temporary Auth Data

OTP Passcodes & Sessions

OTPs expire and are purged after 10 minutes. Access JWT tokens expire in 15 minutes.

Customer Account Data

Profile & Addresses

Retained while your account is active. Permanently erased upon exercising your Right to Erasure.

Statutory Orders & Invoices

GST & Tax Invoices

Retained for 7 years as mandated by the Indian Central Goods and Services Tax (CGST) Act and Companies Act.

4. Your Statutory Rights as a Data Principal (DPDP §11, §12, §13, §14)

As a citizen and data principal under Indian law, you possess enforceable legal rights regarding your personal records:

Right to Access Information (§11): You may request a summary of personal data processed, identities of all third parties with whom data was shared, and processing details.

Right to Correction & Erasure (§12): You can update inaccurate details directly in your Profile Dashboard or permanently delete your account and associated personal data using the "Request Account Erasure" feature.

Right of Grievance Redressal (§13): You have the right to register complaints with our designated Grievance Officer, with guaranteed resolution within 30 calendar days.

Right to Nominate (§14): In the event of death or incapacity, you have the right to designate an authorized nominee to exercise your data rights.

5. Technical Security Safeguards & Cookies (DPDP §8)

Encryption in Transit: All HTTP traffic is protected by TLS 1.3 encryption with HTTP Strict Transport Security (`HSTS`).
Strictly Necessary Cookies: We utilize `jwt` (15-minute access token) and `refreshToken` (7-day credential) with `HttpOnly`, `SameSite: Lax`, and `Secure` attributes to prevent Cross-Site Scripting (XSS) and CSRF attacks.
Rate Limiting & Masked Logs: Authentication endpoints are rate-limited to defeat automated brute-force attacks. Customer phone numbers and email addresses are masked in operational server logs.

Designated Grievance Redressal & DPO Office (DPDP §13)

For exercising your Right to Erasure, data access inquiries, or reporting grievances under the DPDP Act, contact our designated Grievance Officer:

Officer: Data Protection & Grievance Officer, Dooribaaz

Statutory Resolution SLA: Within 30 Calendar Days

Escalation: Data Protection Board of India (DPBI)

privacy@dooribaaz.com