Privacy Policy

1. Company Identity and Platform Description

1.1 Data Fiduciary

Nakshatra Innovative Solutions Private Limited (hereinafter "Company", "RODO", "we", "our", or "us"), incorporated under the Companies Act, 2013, bearing CIN U62099KA2025PTC213229, is the Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 (DPDP Act). The Company's registered office is located in Karnataka, India.

1.2 Nature of Platform

RODO is a technology-based service aggregator platform that connects Customers with independent Service Providers for work-related services. RODO does not employ Service Providers and does not provide services directly. RODO's role is limited to facilitating the connection between Customers and Service Providers.

RODO is a platform intermediary under Section 2(w) of the IT Act, 2000. However, RODO does not disclaim liability for its own acts as a Data Fiduciary under the DPDP Act, 2023.

1.3 Platform Scope

This Privacy Policy applies to RODO's mobile application, website, and all related services (collectively, "Platform"). It applies to all Users including Customers and Service Providers operating within India.

2. Data Principal Rights and Consent Framework

2.1 Lawful Basis for Processing

In accordance with Section 4 of the DPDP Act, 2023, RODO processes personal data only:

• With the free, specific, informed, unconditional, and unambiguous consent of the Data Principal; or
• For legitimate uses as enumerated under Section 7 of the DPDP Act (including compliance with any law, order of a court, or legal obligation)

2.2 Consent Notice

Prior to collecting personal data, RODO provides a clear and plain-language notice to the Data Principal specifying: categories of personal data to be collected, purposes for which data shall be processed, how the Data Principal may exercise their rights, how consent may be withdrawn, and the identity and contact details of the Data Protection Officer (DPO).

2.3 Withdrawal of Consent

The Data Principal may withdraw consent at any time. Withdrawal shall not affect the lawfulness of processing based on consent prior to withdrawal. To withdraw consent, contact our DPO at support@rodo.co.in. Withdrawal may result in restricted or unavailable services.

2.4 Consent Records

RODO maintains a record of consent obtained from each Data Principal, including the timestamp, platform version, and the specific notice presented at the time of consent, in accordance with applicable rules under the DPDP Act.

3. Categories of Personal Data Collected

3.1 Account Data

• Full legal name
• Mobile number (used for OTP-based authentication)
• Email address
• Profile photograph (optional; user-initiated)
• Service address or delivery location

3.2 Verification Data

• OTP verification records for mobile number authentication
• Voluntarily provided profile information

RODO does not collect Aadhaar numbers, biometric data, financial credentials, or other sensitive personal information as defined under SPDI Rules, 2011, except where required by law or explicitly consented to.

3.3 Location Data

Customer Location Data: Service request address entered by the Customer; map-based service location for matching with Service Providers.

Service Provider Live Location Data: Real-time GPS coordinates, collected only after the Service Provider accepts a service request. Location tracking remains active only for the duration of the accepted service and is automatically terminated upon completion or cancellation. RODO does not engage in continuous or background location tracking beyond the active service period.

Live location tracking requires explicit consent from the Service Provider prior to activation.

3.4 Device and Technical Data

• Device make, model, and operating system version
• App version
• Internet Protocol (IP) address
• Session logs, crash reports, and performance diagnostics

3.5 Transactional Data

• Wallet recharge history and transaction records
• Platform fee records
• Service request and fulfilment history

3.6 Communications Data

Records of support requests, dispute filings, and communications with RODO's grievance mechanisms may be stored for audit and compliance purposes.

4. Purpose Limitation and Use of Data

RODO collects and processes personal data strictly for the following purposes. Data shall not be used for any purpose incompatible with the purpose for which it was collected, in accordance with the principle of purpose limitation under the DPDP Act.

4.1 Core Platform Functions

• Account creation, authentication, and management
• Matching Customers with available Service Providers
• Enabling live location tracking for active service requests
• Facilitating in-platform communication between Customers and Service Providers
• Processing wallet recharges, platform fees, and related transactions

4.2 Safety, Fraud Prevention and Security

• Detection, prevention, and investigation of fraud, misuse, and suspicious activity
• Account security and authentication integrity
• User and Service Provider safety during active services

4.3 Service Improvement

• Improving app performance, reliability, and user experience
• Internal analytics and quality assurance

4.4 Legal and Regulatory Compliance

• Compliance with applicable Indian laws, regulations, and court orders
• Responding to lawful requests from government authorities
• Dispute resolution and grievance redressal

RODO does not sell, rent, or monetise personal data. RODO does not use personal data for targeted advertising or profiling for commercial purposes unrelated to the Platform's core functions.

5. Data Sharing and Disclosure

5.1 Within the Platform

Customers may view the Service Provider's name, profile photograph, rating, and real-time location during an active service. Service Providers receive the Customer's service location details upon accepting a request. No other personal data is shared between Customers and Service Providers without explicit consent.

5.2 Third-Party Service Providers

RODO engages third-party processors for specific platform functions. All third-party processors are contractually obligated to maintain confidentiality and comply with applicable data protection laws. Current processors include:

• Google Maps Platform: Navigation, ETA estimation, and live tracking visualisation
• Payment Gateway Providers: Wallet recharge and transaction processing (regulated under RBI guidelines)
• Cloud Hosting and Infrastructure Providers: Secure storage and application hosting
• Analytics and Crash Reporting Tools: Performance monitoring

5.3 Legal Disclosures

RODO may disclose personal data without prior notice where required by a court order, statutory or regulatory body with lawful authority (e.g., MEITY, law enforcement), or Section 7 of the DPDP Act.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity. Data Principals will be notified prior to such transfer.

5.5 No Cross-Border Transfers Without Compliance

RODO does not transfer personal data outside India unless in compliance with Section 16 of the DPDP Act. Currently, RODO processes all personal data within India.

6. Data Storage, Security, and Retention

6.1 Security Measures

RODO implements reasonable technical and organisational security safeguards in accordance with the SPDI Rules, 2011 and the DPDP Act, including:

• End-to-end encrypted communications (TLS 1.2 or higher)
• Encrypted data storage with restricted access controls
• Role-based access management for internal personnel
• Regular security audits and vulnerability assessments
• Incident response and data breach notification procedures

In the event of a personal data breach, RODO shall notify the Data Protection Board of India and affected Data Principals in accordance with Section 8(6) of the DPDP Act, without undue delay.

6.2 Retention Policy

• Active account data: Retained for the duration of account existence
• Transaction records: Retained for 8 years from the date of the transaction
• Location tracking data: Temporary; not stored beyond the active service period, unless required for dispute resolution, security investigation, or legal compliance
• Communications and support records: Retained for 3 years, or as required by applicable law
• Consent records: Retained for the duration of the Data Principal's account and 3 years thereafter

6.3 Data Erasure

Upon account deletion or receipt of a valid erasure request, RODO will delete or anonymise personal data within 30 days, subject to retention obligations under applicable law. Users may initiate account deletion via the in-app 'Account Deletion' feature or by submitting a request at https://www.rodo.co.in/accountDeletion.

6.4 Account Deletion Procedure

In compliance with Rule 4 of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023:

• Users may request account deletion via (a) the in-app Account Settings menu, or (b) the dedicated deletion portal at https://www.rodo.co.in/accountDeletion
• RODO will acknowledge the deletion request within 48 hours via email or in-app notification
• Account deletion will be processed within 30 days of the verified request
• Deletion results in permanent removal of the User's profile, authentication credentials, and non-legally-mandated personal data from RODO's active systems
• Wallet balances remaining at the time of account deletion are subject to the terms in Section 6 of the Terms and Conditions
• Deletion requests may be delayed or declined where RODO is subject to a legal obligation, court order, or active investigation

For any queries regarding account deletion, contact support@rodo.co.in.

7. Rights of Data Principals

In accordance with Chapter III of the DPDP Act, 2023 (Sections 11–14), Data Principals have the following rights:

7.1 Right to Access (Section 11)

You have the right to obtain a summary of personal data processed by RODO and the processing activities undertaken, within 48 hours of a request submitted via the Grievance Portal or email to support@rodo.co.in.

7.2 Right to Correction and Erasure (Section 12)

You may request correction of inaccurate or incomplete personal data, or erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to RODO's legal retention obligations.

7.3 Right to Grievance Redressal (Section 13)

You have the right to file a grievance with RODO's Grievance Officer. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India (when operationalised) under Section 28 of the DPDP Act.

7.4 Right to Nominate (Section 14)

You may nominate another individual to exercise your rights in the event of death or incapacity, in accordance with the rules prescribed under the DPDP Act.

7.5 Withdrawal of Consent (Section 6)

You may withdraw consent for any non-mandatory processing at any time, without affecting the lawfulness of prior processing.

7.6 Consumer Rights

Users may also exercise rights under the Consumer Protection Act, 2019, including the right to be heard, right to seek redressal, and the right to file a complaint with the NCDRC or Karnataka State Consumer Disputes Redressal Commission, as applicable.

8. Grievance Redressal Mechanism

In compliance with Rule 5 of the SPDI Rules, 2011, Section 13 of the DPDP Act, and Rule 3(11) of the Consumer Protection (E-Commerce) Rules, 2020, RODO has designated a Grievance Officer / Data Protection Officer:

Grievances will be acknowledged within 48 hours and resolved within 30 days of receipt. Unresolved grievances may be escalated to the Data Protection Board of India, Karnataka State Consumer Disputes Redressal Commission, NCDRC, or Cyber Crime Cell, Bengaluru.

9. Location Data — Specific Compliance Provisions

• Location data is categorised as personal data under the DPDP Act
• Explicit, separate consent is obtained from Service Providers before enabling live GPS tracking
• Customers are clearly informed in-app when live tracking is active for their service request
• Live tracking is technically disabled upon service completion — this is a system-enforced restriction, not merely a policy commitment
• RODO does not share location data with third parties for advertising, profiling, or any purpose unrelated to service delivery
• Location data is not used for automated decision-making that produces legal or similarly significant effects on Data Principals

10. Children's Privacy

RODO's Platform and services are not directed at, and are not intended to be used by, persons under the age of 18 years (minors). In compliance with Section 9 of the DPDP Act, 2023:

• RODO does not knowingly collect personal data from minors
• RODO does not engage in tracking, behavioural monitoring, or targeted advertising directed at minors
• Age verification mechanisms are implemented at the point of registration
• If RODO discovers that personal data of a minor has been collected without verifiable parental consent, such data will be deleted immediately

Parents or guardians who believe their minor child's personal data has been inadvertently collected should contact support@rodo.co.in immediately.

11. Cookies and Tracking Technologies

RODO's Platform may utilise cookies, device identifiers, and similar tracking technologies for the following limited purposes:

• Session authentication and management
• Core platform functionality and personalisation
• Performance monitoring and crash analytics

RODO does not use tracking technologies for cross-platform behavioural advertising. Users may manage cookie and tracking preferences through their device or browser settings. Restricting certain cookies may impair functionality.

12. Third-Party Links and Services

RODO's Platform may contain links to third-party websites or services. RODO is not responsible for the privacy practices, data handling, or content of such external platforms. Users are strongly encouraged to review the privacy policies of any third-party service they interact with.

RODO's integration with Google Maps is subject to Google's Privacy Policy and Terms of Service. By using RODO's location features, you also accept Google's applicable terms.

13. Automated Decision-Making

RODO does not use personal data for fully automated decision-making processes that produce legal effects or similarly significantly affect Data Principals. Service matching is facilitated by platform logic and is subject to Service Provider acceptance, ensuring human involvement in the process.

14. Amendments to this Privacy Policy

• Users will be notified via email and/or in-app notification at least 15 days prior to the effective date of any change
• The updated Policy will be published on the Platform with a revised effective date
• Continued use of the Platform after the effective date constitutes acceptance of the revised Policy
• Where changes require fresh consent under the DPDP Act, fresh consent shall be obtained

Data Principals who do not consent to material changes may withdraw consent and request account deletion in accordance with Section 7.5 above.

15. Governing Law and Dispute Resolution

• Parties shall first attempt to resolve disputes through good-faith negotiation within 30 days
• If unresolved, disputes shall be referred to arbitration under the Arbitration and Conciliation Act, 1996, with the seat of arbitration in Bengaluru, Karnataka, India
• The language of arbitration shall be English
• Consumer-related disputes may alternatively be raised before the appropriate Consumer Disputes Redressal Forum under the Consumer Protection Act, 2019
• Bengaluru, Karnataka courts shall have exclusive jurisdiction for matters not subject to arbitration

16. Contact Information

17. Plant Contribution Programme — Disclaimer of Proprietary Interest

17.1 Nature of the Programme

RODO operates a Plant Contribution Programme ("Programme") through which Users may make a one-time monetary donation towards the planting of a plant or tree ("Plant") on a designated site.

17.2 Disclaimer of Ownership — Plant

A monetary contribution under the Programme does not confer upon the Contributor any right, title, interest, claim, or ownership — whether legal or equitable — in or over the Plant itself. The Plant, upon being planted, shall remain the sole property of RODO or its designated partner organisation, NGO, government body, or landowner, as applicable.

17.3 Disclaimer of Ownership — Land

A monetary contribution under the Programme does not confer upon the Contributor any right, title, interest, claim, or ownership in or over the land, plot, site, or immovable property upon which the Plant is or shall be planted. Nothing in this Programme shall be construed as a transfer of immovable property under the Transfer of Property Act, 1882, or any other applicable law.

17.4 Nature of Contribution — Donation

A contribution made under the Programme constitutes a voluntary, one-time monetary donation for environmental and social purposes. It is not a purchase of goods, a financial instrument, an investment, or a security of any kind. Contributors shall not be entitled to any financial return, revenue share, carbon credit ownership, profit, dividend, or compensation.

17.5 No Guarantee of Specific Plant

RODO does not guarantee that a specific Plant will survive, grow, or remain in the designated location. RODO shall not be liable for the death, removal, destruction, or displacement of any Plant after planting due to natural causes, third-party acts, governmental action, or force majeure events.

17.6 Acknowledgement and Certificate

Where applicable, RODO may issue a digital acknowledgement or certificate to the Contributor as a token of participation. Such a certificate is symbolic only and confers no legal rights, title, or interest of any nature in the Plant or the land.

17.7 Governing Law

This Section is governed by the laws of India, including the Transfer of Property Act, 1882, the Indian Contract Act, 1872, and FCRA, 2010, as applicable. Any dispute shall be resolved in accordance with Section 15 of this Policy.

18. Declaration of Consent

By creating an account and using the RODO Platform, the Data Principal confirms that:

• They have read, understood, and agree to be bound by this Privacy Policy
• They provide free, specific, informed, unconditional, and unambiguous consent to the collection, use, storage, and sharing of personal data as described herein
• They are at least 18 years of age or have valid parental or guardian consent
• They acknowledge that consent may be withdrawn at any time in the manner described in this Policy, without prejudice to processing activities conducted prior to withdrawal
• They acknowledge that this Privacy Policy forms a binding agreement between the Data Principal and Nakshatra Innovative Solutions Private Limited

This Privacy Policy was prepared with reference to the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the IT (SPDI) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020. RODO recommends that this document be reviewed by qualified legal counsel admitted to practise in Karnataka, India, prior to deployment.