1.Introduction and Identity of the Data Fiduciary

CoolVolt Solutions ("Company", "we", "us", or "our") operates as a data fiduciary in relation to personal data collected through our platform, website and associated mobile applications. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, with whom it may be shared and the rights you hold as a Data Principal under applicable Indian law.

This Policy is issued in compliance with:

The Digital Personal Data Protection Act, 2023 ("DPDP Act")
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
The Information Technology Act, 2000

By accessing or using our platform, you acknowledge that you have read and understood this, Policy. If you do not agree, please discontinue use of our services immediately.

2.Consent Notice (Section 5, DPDP Act, 2023)

In accordance with Section 5 of the Digital Personal Data Protection Act, 2023, a separate Consent Notice will be issued to you as a Data Principal before or at the time of requesting your consent to process your personal data. This Privacy Policy is distinct from and does not substitute for that standalone Consent Notice, which will be presented independently of all other terms, conditions and information as mandated by Section 5 of the DPDP Act.

The Consent Notice will be:

Presented independently of any other terms, conditions, or information.
Written in clear and plain language accessible to any ordinary person.
Available in English and, upon request, in any language specified in the Eighth Schedule to the Constitution of India.

If your personal data was collected prior to the commencement of this Act, we will provide you with a fresh notice as soon as reasonably practicable, and processing will continue until you withdraw consent.

3.Personal Data We Collect

We collect the following categories of personal data in the course of providing our services:

3.1Identity and Contact Information

Full name
Email address
Mobile number
Residential or service address
Date of birth (where applicable)

3.2Account and Profile Data

Username and password (encrypted)
Profile photograph (if uploaded voluntarily)
Service preferences and history

3.3Location Data

Precise GPS location at the time-of-service booking or delivery
Saved or frequently used addresses

3.4Payment and Financial Data

Payment instrument details (credit/debit card, UPI, net banking processed through certified third-party payment gateways)
Transaction records and billing history

3.5Device and Technical Data

Device identifiers (IMEI, device model, operating system)
IP address, browser type, cookies, and session data
App usage logs and interaction data

3.6Communication Data

Messages sent through in-app support or chat features
Feedback, reviews, and ratings

3.7Sensitive Personal Data or Information (SPDI)

The following categories constitute Sensitive Personal Data or Information under the SPDI Rules, 2011, and are collected only with explicit consent and for specified purpose:

Financial information (bank account details, card numbers) collected for payment processing
Biometric data collected only where technologically required for identity verification

4.Purpose of Processing

We process your personal data only for the following specified, lawful, and operational purposes:

Account Registration and Management: To create, verify, and maintain your account on our platform.
Service Delivery: To connect you with professionals, schedule appointments, dispatch technicians, and complete the requested service.
Payment Processing: To facilitate secure transactions through authorized payment gateways and maintain billing records.
Customer Support: To respond to queries, resolve complaints, and manage dispute resolution.
Safety and Fraud Prevention: To verify identities, conduct background checks on service professionals, detect fraud, and ensure platform security.
Legal Compliance: To comply with applicable Indian laws, court orders, government directives, and regulatory obligations including tax and GST filings.
Service Improvement and Analytics: To analyze usage patterns, improve service quality, and develop new features using anonymized or aggregated data wherever possible.
Communications: To send service confirmations, invoices, updates, and (with separate consent) promotional offers.

We will not process your data for any purpose beyond those stated above without providing a fresh notice and obtaining fresh consent.

5.Lawful Basis for Processing

5.1Consent-Based Processing

The primary lawful basis for processing your personal data is your free, specific, informed, unconditional, and unambiguous consent, expressed through a clear affirmative action at the time of registration or service booking, in compliance with Section 6 of the DPDP Act, 2023.

5.2Legitimate Uses

Certain processing activities are carried out under legitimate uses as provided under the DPDP Act. The specific categories of legitimate uses are defined in the DPDP Act, 2023, and include processing activities that do not require consent as enumerated in the statute. Reference should be made to the bare text of the DPDP Act, 2023 and any Rules notified by the Central Government for the complete and authoritative enumeration of such legitimate uses.

5.3Withdrawal of Consent

You may withdraw your consent at any time. Withdrawal is as easy as the original act of giving consent and may be done through your account settings or by contacting our Grievance Officer

Upon withdrawal:

Processing of your personal data will cease within a reasonable period.
Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
Data processors engaged by us will also be directed to cease processing within a reasonable time.

6.Data Minimisation and Purpose Limitation

We collect only such personal data as is necessary for the specific purpose for which it is collected. Collection of additional or optional data is explicitly marked, and you are not obligated to provide it as a condition of service.

7.Data Retention and Deletion

Personal data is retained only for as long as is necessary to fulfil the stated processing purpose, or as mandated by applicable law (including tax, financial records, and regulatory retention obligations).

Upon withdrawal of consent, completion of the purpose, or your erasure request:

Personal data will be deleted or anonymized as soon as reasonably practicable.
Data required to be retained under applicable law will be retained only for the period mandated by such law, after which it will be deleted.

8.Third-Party Disclosure and Data Sharing

We do not sell, rent, or trade your personal data. We may share data in the following limited circumstances:

Service Professionals: Name, contact, and location data is shared with assigned technicians or professionals to the extent necessary for service delivery.
Payment Processors: Financial data is shared with authorized payment gateway providers operating under contractual obligations and applicable RBI guidelines.
Technology Partners: Platform infrastructure and analytics providers who process data solely on our instructions under binding data processing agreements.
Legal Authorities: We may disclose data to government authorities, courts, or law enforcement agencies where legally required by court order, statute, or government direction.
Business Transfers: In the event of a merger, acquisition, or asset sale, data may be transferred subject to equivalent confidentiality protections.

All third-party recipients are contractually bound to process data only for the contracted purpose and to implement adequate security safeguards.

9.Cross-Border Data Transfers

Where personal data is transferred outside the territory of India, such transfer will be carried out only in compliance with the conditions prescribed by the Central Government of India under the DPDP Act, 2023, and in accordance with applicable regulations and Government notifications. The specific conditions and restrictions governing cross-border transfers are subject to Rules yet to be formally notified by the Central Government, and our compliance framework in this regard will be updated upon such notification.

10.Security Safeguards

We implement reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000 read with the SPDI Rules, 2011. The following measures represent our current technical and organisational safeguards, implemented in pursuance of that standard:

Encryption: Personal data in transit is protected using industry-standard TLS/SSL encryption. Stored data is encrypted at rest.
Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
Secure Storage: Data is stored on secure servers with appropriate physical and digital access restrictions.
Incident Response: We maintain a breach response protocol to detect, contain, and notify affected parties in the event of a data security incident.
Vendor Security: Third-party vendors are contractually required to maintain equivalent or higher security standards.

A "body corporate" under the Information Technology Act, 2000 is required to maintain reasonable security practices to safeguard sensitive personal data or information from unauthorized access, modification, or disclosure.

In the event of a security breach or contravention of the Information Technology Act, 2000, the Company acknowledges adjudicatory liability before Adjudicating Officers appointed by the Central Government for claims within the pecuniary jurisdiction prescribed under Section 46 of that Act, and before competent courts for claims exceeding that threshold.

11.Your Rights as a Data Principal

As a Data Principal under the DPDP Act, 2023, you hold the following rights:

Right to Information: Right to know what personal data of yours is being processed and for what purpose.
Right of Access: Right to obtain a summary of your personal data being processed and the processing activities.
Right to Correction and Updation: Right to correct inaccurate, incomplete, or outdated personal data.
Right to Erasure: Right to request deletion of personal data once the processing purpose is fulfilled and retention is no longer required by law.
Right to Withdraw Consent: Right to withdraw consent at any time, with processing ceasing within a reasonable period thereafter.
Right to Grievance Redressal: Right to have grievances addressed by our Grievance Officer within prescribed timelines.

To exercise any of these rights, contact our Grievance Officer (details in Section 13 below).

12.Cookies and Tracking Technologies

Our website and application use cookies, web beacons, and similar tracking technologies to:

Maintain session continuity and login state
Understand user navigation patterns (analytics)
Serve relevant in-platform communications

You may configure your browser or device settings to restrict or disable cookies. Disabling essential cookies may limit functionality of certain platform features.

13.Children's Data

Our platform is not directed at minors. We do not knowingly collect personal data from minors without appropriate parental or guardian consent as may be required under applicable law, including the DPDP Act, 2023 and any Rules notified thereunder. The specific age threshold and parental consent mechanisms are governed by the DPDP Act, 2023 and subordinate legislation notified by the Central Government. If you believe a minor's data has been collected without appropriate consent, please contact our Grievance Officer immediately for deletion.

14.Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in law, technology, or our business operations. Material changes will be communicated through in-app notifications, email, or a prominent notice on our website. Your continued use of the platform following such notice does not by itself constitute valid consent to any revised processing purposes; fresh consent will be obtained where required under the DPDP Act, 2023.

We recommend reviewing this Policy periodically. The "Last Updated" date at the top of this document will reflect the most recent revision.

15.Grievance Officer and Contact Details

In accordance with the DPDP Act, 2023 and the SPDI Rules, 2011, we have designated the following Grievance Officer for all data protection matters:

Grievance Officer / Data Protection Contact

Name: Coolvolt Solutions
Designation: Grievance Officer
Organization: CoolVolt Solutions Private Limited
Email: cvsgrievanceofficer@gmail.com
Address: C/O Fakrujama khan, Vill - Dewaitha, Dewaitha, Ghazipur, Zamania,Uttar Pradesh, India, 232326
Phone: 9541019202
Grievance Response Timeline: Acknowledgement within 48 hours; resolution within 30 days of receipt of complaint.

If your grievance is not resolved to your satisfaction, you have the right to escalate your complaint to the Data Protection Board of India constituted under the DPDP Act, 2023.

16.Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the SPDI Rules, 2011. Any dispute arising out of or in relation to this Policy shall be subject to the jurisdiction of the competent courts at Allahabad, Uttar Pradesh, India.