Privacy Policy

Anyone who browses Cartzuno, opens an account, gets in touch, sends us a project brief or purchases a service is covered here. We have prepared it with the Digital Personal Data Protection Act, 2023 (DPDP Act) in mind, together with the rules on reasonable security practices issued under the Information Technology Act, 2000.

You will see two DPDP Act terms repeatedly. As the individual the information is about, you count as the Data Principal. As the organisation deciding the purpose and means of processing, and answerable for keeping it safe, we act as the Data Fiduciary.

It does not extend to external sites we link to, outside platforms where you hold a separate login, or your own systems that we operate within while delivering a service. That final situation is dealt with in section 6.

Cartzuno is run by CARTZUNO INNOVATIONS PRIVATE LIMITED, Plot No 71, Jubilee Enclave, LVS Arcade, HITEC City, Hyderabad, Hyderabad, Telangana, 500081, which acts as the Data Fiduciary.

Our Grievance Officer, whose details are in section 16, deals with formal requests and complaints. A named individual takes ownership of every request as soon as we receive it.

The information we hold falls into five groups, limited to what an IT services provider genuinely requires.

• Account data — your name, email, mobile number, organisation name if you give one, and your password, stored only as a one-way hash. Passwords are never kept in a readable form, so they stay unreadable to us and to anyone who might get hold of the database.
• Billing data — the billing name, street address, city, state and PIN code, plus your GSTIN if you enter one. A valid tax invoice cannot be raised without these.
• Order data — which services you purchased, the amounts, order numbers, whether payment cleared, invoices, gateway transaction references and any refunds.
• Project brief content — the information you share so we can carry out the work, such as product and repository links, objectives, who is involved, notes on access and anything else you include. Most of it is business information, though people’s names and their work email addresses can appear in it.
• Site and device data — your IP address, the type of device and browser, the pages you open, where you arrived from and a rough location, gathered via analytics tools and server logs.

We do not gather or keep net-banking logins, UPI PINs, CVV codes or card numbers. Identifiers like Aadhaar or PAN are requested only when a particular legal obligation calls for them, and in that case we would explain the reason when asking.

Every purpose listed is narrowly defined. Information gathered for one of them is not put to some other, unconnected use.

Personal data is never sold, rented out or traded by us, and we neither compile advertising profiles nor carry out behavioural retargeting.

Our processing rests on one of two grounds recognised by the DPDP Act.

• Consent — freely given, specific, informed and unambiguous, which you provide when you send a form, register an account, send in a brief or sign up for updates. Every such request tells you the purpose before you hand anything over.
• Legitimate uses — processing that delivering your paid service requires, and processing the law obliges us to do, tax record-keeping being one example.

Consent can be withdrawn whenever you like, with no more effort than it took to give, by sending a message to the Grievance Officer. Doing so ends any further consent-based processing; it does not undo lawful processing that has already happened, nor does it erase records we are legally bound to retain. Should withdrawal stop us finishing a service you have already paid for, we will let you know before we act on it.

We always ask for marketing consent on its own. Saying no has no effect on any order, and each marketing email carries an unsubscribe link, which we act on without delay.

There are two distinct capacities in which we may handle data, and it helps to keep them apart.

• Information we keep on you. We store brief, order, billing and account information on our own systems and are its Data Fiduciary. Everything else in this policy concerns that processing.
• Data on your users, stored in your systems. If a service means working within your cloud accounts, databases or repositories, the Data Fiduciary role stays with you, and we follow only the instructions you have documented. When personal data is involved in that work, a data processing agreement is signed with you beforehand, dealing with security, purpose limitation, breach notification, sub-processing and deletion.

Our starting request is always for synthetic, masked or anonymised data. If live personal data is unavoidable, access to it should be granted to named people, confined to what the task requires, set to expire, and withdrawn once handover is complete.

Personal data goes only to processors that support the running of our business, solely for the purpose given, and under contracts obliging them to keep it safe. They are grouped by category below, since an individual supplier can be replaced while the category and its safeguards stay unchanged.

Outside those categories, we share data with the team members assigned to your service (only the brief and whatever access the task needs); with our auditors and accountants when statutory filings are due; and with a court, government authority or law enforcement body when valid legal process compels it. For such demands we insist on a written request, release only the legally required minimum, and notify you unless the law forbids it.

Processors are not permitted to put your data to any use of their own.

A number of our processors, such as providers of hosting, analytics and email delivery, may run infrastructure in other countries, which means some personal data could be handled outside India.

In such cases we send data only to countries that the Central Government has not restricted under section 16 of the DPDP Act, we keep each transfer to what its purpose requires, and we hold the processor to the protection standard described here. Should a restriction be notified, the affected processing will be relocated.

Data is kept only while its purpose or a legal requirement calls for it; after that it is deleted or anonymised so that it cannot be reversed.

When you ask for erasure, we remove all data that no statutory retention period above applies to, and explain to you which items had to stay and the reason.

The safeguards we use are reasonable security practices suited to the information we hold. They include:

• delivering every page over HTTPS so that information is encrypted while it travels;
• keeping passwords only in salted, one-way hashed form that nobody, us included, can reverse;
• shielding account forms from cross-site request forgery;
• never letting payment credentials touch our servers, because the payment gateway deals with them;
• restricting customer data to the people whose role requires it;
• asking clients to keep passwords and keys out of the brief form, email and chat, and collecting any sensitive credentials over a secure channel;
• placing all staff with access to client data under a duty of confidentiality.

Absolute security does not exist. If you spot what looks like a security flaw on this site, please report it via the section 16 contact details; we will look into it quickly.

The site sets a limited number of cookies and uses similar browser storage, which fall into two groups.

• Strictly necessary — security and session cookies which keep you logged in, hold your selection together as you move between pages, and shield forms from cross-site request forgery. Because the site depends on them, no consent is needed.
• Analytics — set only where analytics is switched on, to tally page views and spot journeys that break. They are pseudonymous and, wherever consent is legally needed, they wait until you have given it.

Services you pick before checkout are saved in your browser’s own storage, not on our servers, so they disappear if you clear site data. Your browser settings let you block or delete cookies whenever you wish.

The DPDP Act entitles you to the following:

• Access — an overview of what personal data we keep on you, how it is used, and which categories of processor have received it;
• Correction and completion — to have wrong data fixed, missing data filled in and out-of-date data brought current;
• Erasure — deletion of data once its purpose has been served, except where a statutory retention period in section 9 applies;
• Withdraw consent — for processing that relies on consent, with no more effort than giving it took;
• Nominate — name someone who may exercise these rights for you if you die or become incapacitated;
• Grievance redressal — an accessible route for complaining to us, with replies given inside a timeline we publish, before you go to the Data Protection Board.

Data Principals also carry duties under the Act: supply genuine information, never pose as someone else, and avoid lodging false or frivolous complaints.

Making a request. Email our Grievance Officer, Kumbhakonam Muniraja and Prasad Bandi Reddy, at info@cartzuno.net using the address linked to your account and say which right you want to use. Before acting, we may need to ask you some questions to confirm it is really you. You will get a reply within 30 days; where more time is needed, we will let you know inside that 30-day period, giving the reason and a likely completion date.

Using any of these rights costs you nothing.

Our services are sold to organisations, and the site is not aimed at children. We never knowingly gather personal data from anyone below 18 years of age, and we never track or profile children or direct advertising at them.

Should you think a child has shared personal data with us, let us know and it will be deleted quickly. If an account has to be run for a child, or for a disabled person acting through a lawful guardian, the parent or guardian must first give verifiable consent, in line with the DPDP Act.

In the event of a personal data breach, we will look into it, contain it, and inform both the Data Protection Board of India and every affected Data Principal, using the format and timing laid down by the DPDP Act and the rules under it.

The notice you receive will set out in plain language what went wrong, what data was affected, the probable consequences, what we have done in response and the steps we suggest you take.

This policy is revised whenever the law or the way we process data shifts. The date shown at the top always reflects the version in force. Significant changes are flagged on this page, and if a change calls for fresh consent, we will request it. Previous versions can be supplied if you ask.

Privacy questions, data requests and complaints can be sent to:

• Grievance Officer — Kumbhakonam Muniraja and Prasad Bandi Reddy: info@cartzuno.net · 7207001790
• General support: info@cartzuno.net
• By post: Plot No 71, Jubilee Enclave, LVS Arcade, HITEC City, Hyderabad, Hyderabad, Telangana, 500081

We confirm receipt of a complaint within 48 hours and send a full reply within 15 days. Our Grievance Redressal page sets out every escalation step, including the outside bodies available to you.

Once you have raised a concern with our Grievance Officer, you may take an unresolved complaint to the Data Protection Board of India. The laws of India govern this policy.