This Privacy Policy (“Policy”) explains how [Dropspot legal entity name] (“Dropspot”, “we”, “us”, or “our”) collects, uses, stores, shares, and otherwise processes personal data when you use our website, mobile application, seller/lister panel, reseller/seller panel, APIs, integrations, customer-support channels, complaint portals, and related services (collectively, the “Platform”).

By accessing or using the Platform, or by otherwise providing personal data to us, you agree that your personal data may be processed as described in this Policy, subject to applicable law.

1. Who this Policy applies to

This Policy applies to:

• suppliers, listers, manufacturers, stockists, brands, importers, and other seller-panel users;

• sellers, resellers, marketers, and other reseller-panel users;

• visitors to our website or app;

• customers or end users whose information is shared with us in connection with orders, fulfilment, support, returns, complaints, or platform operations;

• people who contact us, submit complaints, apply to work with us, or otherwise interact with Dropspot.

2. Personal data we collect

Depending on how you use Dropspot, we may collect the following categories of personal data:

2.1 Account and profile information

• name;

• business name;

• username and password;

• email address;

• mobile number;

• address;

• profile details;

• account preferences.

2.2 Business, KYC, and verification information

• GST details;

• PAN or other tax identifiers;

• business registration details;

• bank account and payout details;

• identity and address proof;

• authorisation letters, licences, registrations, and compliance documents;

• store or brand verification materials.

2.3 Transaction and order information

• order details;

• product details;

• shipping and billing information;

• payment and settlement details;

• invoices and tax information;

• returns, refunds, reversals, chargebacks, and complaint records.

2.4 Customer and fulfilment information

Where relevant to platform operations, we may receive or process information relating to end customers, including:

• name;

• phone number;

• email address;

• shipping address;

• order details;

• support and complaint details.

2.5 Communications and support information

• messages sent through the Platform;

• emails, chats, and support tickets;

• complaint submissions;

• grievance details;

• call records or support notes, where permitted.

2.6 Technical and usage information

• IP address;

• device information;

• browser type;

• operating system;

• app version;

• login activity;

• session data;

• cookies and similar technologies;

• usage analytics;

• crash logs and diagnostic information.

2.7 Marketing and preference information

• communication preferences;

• campaign interactions;

• referral data;

• survey responses;

• feedback and ratings.

3. How we collect personal data

We collect personal data:

• directly from you when you register, fill forms, upload documents, connect stores, place or process orders, contact support, or otherwise interact with us;

• from your use of the Platform, through logs, cookies, analytics tools, and device signals;

• from other users on the Platform where relevant to a transaction or complaint;

• from service providers, payment partners, logistics partners, identity verification providers, or publicly available sources, where lawfully permitted;

• from connected platforms or integrations, including e-commerce and storefront tools you choose to connect to Dropspot.

4. Why we process personal data

We may process personal data for the following purposes:

• creating and managing accounts;

• onboarding suppliers, sellers, and resellers;

• verifying identity, business details, and eligibility;

• enabling listings, catalogues, storefront integrations, and order routing;

• processing orders, shipments, settlements, returns, refunds, and complaints;

• enabling communication between platform participants where operationally necessary;

• providing customer support and grievance redressal;

• detecting, preventing, investigating, and mitigating fraud, abuse, policy violations, security incidents, and unlawful activity;

• enforcing our Terms, policies, and contractual rights;

• complying with legal, tax, accounting, regulatory, audit, and law-enforcement requirements;

• improving our Platform, product experience, support workflows, analytics, and service quality;

• sending service communications, alerts, updates, and, where permitted, promotional communications;

• protecting the rights, safety, and integrity of Dropspot, our users, customers, partners, and the public.

Where required under applicable law, we will rely on consent or other lawful grounds available to us. The DPDP Act contemplates processing on consent and also for certain legitimate uses.

5. How we share personal data

We may share personal data with:

5.1 Other platform participants

We may share relevant personal data between suppliers, sellers/resellers, customers, and other platform participants where necessary to enable transactions, fulfilment, support, returns, complaints, or policy enforcement.

5.2 Service providers and partners

We may share data with third parties that help us operate the Platform, such as:

• payment processors and banking partners;

• logistics and courier partners;

• cloud hosting and infrastructure providers;

• analytics and communication vendors;

• KYC, fraud detection, or verification providers;

• customer support tools and ticketing vendors.

5.3 Authorities and legal recipients

We may disclose personal data where required or permitted by law, including to regulators, courts, law-enforcement agencies, tax authorities, and other governmental bodies.

5.4 Corporate transactions

If Dropspot is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, personal data may be transferred as part of that process, subject to applicable law.

We do not sell personal data as a standalone data-broker business.

6. Cookies and similar technologies

We may use cookies, SDKs, tags, pixels, and similar technologies to:

• keep you logged in;

• remember preferences;

• secure the Platform;

• measure usage and performance;

• improve product features;

• support analytics and communications.

You may be able to control some cookie settings through your browser or device. However, disabling certain technologies may affect Platform functionality.

7. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including for:

• account administration;

• transaction records;

• fulfilment and settlement records;

• returns, refunds, disputes, and complaints;

• fraud prevention and security;

• tax, accounting, and regulatory compliance;

• legal claims, enforcement, and record retention.

We may retain data for longer where required by law or where necessary to establish, exercise, or defend legal rights.

8. Data security

We implement reasonable technical, organisational, and contractual measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, or destruction.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The 2025 Rules contemplate technical and organisational safeguards, contractual safeguards with processors, logging, and breach intimation requirements.

9. Personal data breach

If we become aware of a personal data breach, we may take such steps as we consider appropriate under applicable law, including containment, investigation, remediation, and, where required, notification to affected individuals or authorities.

The 2025 Rules provide for intimation of personal data breaches to affected individuals and the Board once those provisions are in force.

10. Your rights

Subject to applicable law, you may have the right to:

• request access to personal data we process about you;

• request correction, completion, updating, or erasure of personal data;

• withdraw consent where processing is based on consent;

• seek grievance redressal;

• nominate another person to exercise rights in circumstances permitted by law.

The DPDP Act expressly provides rights of access, correction/erasure, grievance redressal, and nomination.

To exercise your rights, please contact us using the details in Section 15 below. We may need to verify your identity before acting on your request.

11. Children’s data

Dropspot is not intended for children unless expressly stated otherwise.

If we knowingly process personal data of a child in circumstances where the law requires parental or guardian consent, we will seek to obtain verifiable consent in accordance with applicable law.

The DPDP Act requires verifiable consent before processing the personal data of a child.

12. Cross-border processing

Your personal data may be processed in India and in other jurisdictions where we or our service providers operate, subject to applicable law and reasonable safeguards.

If we transfer personal data across borders, we will do so in a manner we consider appropriate under applicable law and our contractual arrangements.

13. Third-party links and services

The Platform may contain links to third-party websites, apps, storefronts, payment pages, or tools. We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies before sharing personal data with them.

14. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on the Platform with a revised “Last Updated” date. Where required by law, we will take additional steps to notify you.

15. Contact and grievance details

For privacy-related questions, requests, or grievances, please contact:

Privacy / Grievance Contact: [Name / Team]
Designation: [●]
Email: [support@dropspot.in ]
Phone: [+91 7892304194]
Address: [36 Venkatappa Road, Cross Queens Road, Bangalore, Karnataka, India - 560051]

The 2025 Rules require a data fiduciary to prominently publish the business contact information of the DPO, if applicable, or another person able to answer questions about processing.