Privacy Policy

We, at Oodles Technologies, are committed not only to the letter of the law, but also the spirit of the law. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (www.oodles.com) and tell you about your privacy rights and how the law protects you.

Oodles Technologies Private Limited is the data controller and responsible for your personal data (collectively referred to as “we”, “us” or “our” in this privacy policy). This Privacy Policy is incorporated into and forms part of our Terms and Conditions. By using the Site, you confirm that you have read and understood this Privacy Policy.

Applicable Laws and Legal Framework

This Privacy Policy is designed to comply with the following applicable laws and regulations:

• The Digital Personal Data Protection Act, 2023 (DPDP Act), India — our primary applicable data protection law.

• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

• The General Data Protection Regulation (GDPR) — to the extent we process personal data of individuals in the European Economic Area (EEA).

• Any other applicable data protection laws in jurisdictions where we operate.

What information we may collect about you:

• Identity Data includes first name, maiden name, last name, marital status, title, date of birth and gender.
• Contact Data includes address, email address and telephone numbers.
• Financial Data includes bank account and payment card details. Financial Data is treated as Sensitive Personal Data or Information (SPDI) under Indian law and is subject to additional safeguards described in the Data Security section below.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data includes your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• Account Data: Retained for the duration of your account and for 3 years thereafter, unless you request earlier deletion.
• Transaction Data: Retained for 7 years for accounting and legal compliance purposes.
• Technical/Usage Data: Retained for up to 12 months from collection.
• Marketing Data: Retained until you withdraw consent or opt out.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymized.

How we use your personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal obligation.

• To send invoices and payment requests for money owed to us by you.

• To provide better user experience, troubleshoot, and maintain our website.

• To evaluate website performance, including most visited parts and frequency of visits.

• To sign you up for our services with the registration of your details.

• To validate your use of our services.

• To contact you and respond to your queries about our services.

• To evaluate your application for a job posted by us.

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you without your explicit consent.

How do we secure your information?

The safety and protection of your personal information are critical for our business operations. We have put in place a host of security measures including data encryption.

Your personal data and the personal data of others that you provide us with will not be sold, rented, or disclosed to third parties for other commercial reasons such as for marketing purposes.

With respect to Financial Data and other Sensitive Personal Data or Information (SPDI) as defined under the SPDI Rules: such data is collected only with your explicit prior written consent, stored in encrypted form, and is accessible only on a strict need-to-know basis. We use payment processors who are PCI-DSS compliant, and we do not store full card details on our servers.

Despite the reasonable measures undertaken by us to protect your information, internet transmissions, computer systems and wireless connections are susceptible to vulnerabilities.

European Economic Area (EEA) Residents:

Our data practices comply with GDPR requirements. Your use of our services involves the transfer of your personal information to countries outside the EEA to third parties. We use Standard Contractual Clauses to safeguard the transfer of data outside the EEA. For further information on these safeguards or to obtain a copy, please contact us at the address below.

Your rights as a Data Principal (India — DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data processed by us:

• Right to Access: You have the right to obtain a summary of your personal data being processed by us and the processing activities undertaken.
• Right to Correction and Erasure: You have the right to correct inaccurate or incomplete personal data and to erase personal data that is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
• Right to Grievance Redressal: You have the right to have grievances addressed by our designated Grievance Officer (see Contact section below).
• Right to Nominate: You have the right to nominate another individual who shall exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of the above rights, please contact our Grievance Officer at legal@oodles.io. We will respond to your request within 30 days.

Your rights (EEA / GDPR)

Your personal information belongs to you. You have the right to access, correct, delete or transfer your information possessed by us. You also have the right to object to the way your information is processed. You can withdraw consent you have provided us to use your personal information.

EEA residents may also lodge a complaint with their local data protection supervisory authority if they believe their rights have been infringed.

Disclosure of your personal information

If required, we may disclose your information to:

• Oodles Technologies-controlled affiliates

• Business Partners

• Authorized third-parties

The categories of third-party service providers to whom we may disclose personal data include: cloud hosting providers (primarily located in the US, UK, Australia, and Asia), analytics providers, payment processors, and email/communication service providers. We require all third-party processors to process personal data only on our documented instructions and to maintain appropriate security measures.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Cookies Management:

We and our partners use multiple technologies to collect and store information so you can continue using our services conveniently. It includes the use of cookies, pixels and other tracking technologies.

• Storing your preferences and settings

  Settings that enable our website optimally and as per your preferences.

• Security

  We use cookies to ensure the security of our website and services.

• Analytics

  We use cookies and other identifiers to count the number of site visits and unique visitors to improve the efficiency of our website.

We classify cookies as follows: (a) Strictly Necessary Cookies — required for the operation of the Site; (b) Analytics/Performance Cookies — help us improve the Site; (c) Marketing/Targeting Cookies — used to deliver relevant advertising. Non-essential cookies (categories b and c) are only placed with your prior consent, which you may withdraw at any time via our Cookie Preference Centre. Please see our Cookie Policy for further details.

Your Consent:

By using the website and/or providing your information, you consent to the collection and use of the information you disclose on the Website in accordance with this Privacy Policy. Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time by contacting us at legal@oodles.io or by using the opt-out mechanisms provided on the Site. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

If we decide to change our Privacy Policy, we will post those changes on this page so that you are always aware of what information we collect, how we use it and under what circumstances we disclose it.

Inquiries, Concerns and Grievances:

Should you have any concerns, grievances or issues with the use of the website, the products sold, any related services or this Privacy Policy, you can write to us at: legal@oodles.io

Designated Grievance Officer (as required under the IT Rules, 2011 and DPDP Act, 2023):

• Name: Amit Gaba
• Email: legal@oodles.io
• Address: Oodles Technologies Pvt. Ltd., DG-18-009, Tower B, Emaar Digital Greens, Sector-61, Gurugram, Haryana 122011, India
• Response Time: We will acknowledge your grievance within 5 business days and resolve it within 30 days of receipt.

Data Protection Officer (for GDPR purposes): If you are located in the EEA and have queries about how we handle your personal data, you may contact our Data Protection Officer at: legal@oodles.io

Data Protection Board of India

Under the DPDP Act, 2023, you have the right to approach the Data Protection Board of India if you are not satisfied with our response to your grievance. Information about the Data Protection Board will be made available on the Ministry of Electronics and Information Technology (MeitY) website once fully operational.