Privacy Policy

• Entity: FurrFurr Mobility Pvt. Ltd., a company incorporated in India.
• Corporate Identity Number (CIN): to be inserted
• Registered office: full registered address, Gurugram, Haryana, India
• Email for all privacy matters: hello@furrfurr.in

Our Grievance Officer and their contact details are set out in the 'Grievance redressal' section at the end of this Policy.

We collect only what we need to verify who you are, hand you a vehicle, keep that vehicle running, take payment, and meet our legal obligations. What we collect depends on how you interact with us.

Our vehicles carry telematics units. We want to be direct about this because it is the part of our processing that affects you most.

• We collect vehicle location while a vehicle is allotted to you. We do not track you when no vehicle is allotted to you.
• The FurrFurr app may request location permission on your device to show nearby hubs and swap stations, and to send help to you during a breakdown. You can refuse or later withdraw this permission in your device settings without losing access to your rental, though those features will stop working.
• We use vehicle location to manage the fleet, respond to breakdowns, investigate theft or non-return, verify service claims, and produce aggregate operational statistics.
• We do not use vehicle location to assess your performance for any delivery platform, and we do not sell or provide location data to advertisers or data brokers.
• We share location data with a delivery platform only where you have specifically consented, or where a court order, police request, or other legal obligation requires it.

We process personal data for the following purposes:

• Verifying your identity and eligibility, and completing onboarding.
• Creating and administering your rental agreement, allotting a vehicle, and handling extensions, swaps, and returns.
• Taking payment, holding and refunding the security deposit, issuing invoices, and recovering amounts you owe.
• Servicing, maintaining, repairing, and recalling vehicles, including preventive maintenance driven by telematics.
• Providing rider support, breakdown assistance, and battery swap services.
• Preventing, detecting, and investigating fraud, theft, misuse of a vehicle, and safety incidents.
• Meeting legal and regulatory obligations, including responding to challans, notices, and lawful requests from authorities.
• Sending you service messages about your rental. These are not marketing and you cannot opt out of them while you hold a vehicle.
• Sending you promotional messages about FurrFurr offers, where you have consented. You can withdraw that consent at any time.
• Improving our vehicles, plans, and app, using aggregated or de-identified data wherever that is sufficient.

Under the Digital Personal Data Protection Act, 2023 we rely on your consent for most processing, and on the 'certain legitimate uses' grounds in that Act where processing is necessary for a purpose you have voluntarily provided data for, or for compliance with law, or to respond to a medical emergency or a threat to safety.

We do not sell your personal data. We share it only in these circumstances:

• Service providers who work for us under contract, including payment gateways, cloud hosting and storage providers, telematics and IoT vendors, communication and messaging providers, KYC verification agencies, and analytics tools. They may process your data only on our instructions and for no purpose of their own.
• Insurers, surveyors, and claims administrators, where a claim is made in relation to a vehicle allotted to you.
• Service and repair partners, so they can attend to your vehicle at your location.
• Delivery platforms and fleet partners, only where you have consented or where you were onboarded through that partner and the sharing is necessary to provide the service.
• Law enforcement, courts, regulators, and other authorities, where we are legally required to disclose, or where disclosure is necessary to establish, exercise, or defend a legal claim, including recovery of a vehicle.
• Professional advisers such as lawyers, auditors, and accountants, bound by duties of confidentiality.
• An acquirer or successor entity, if FurrFurr is involved in a merger, acquisition, financing, or sale of assets. We will notify you of any such transfer that materially affects how your data is handled.

We keep personal data only for as long as the purpose it was collected for continues to be served, and for as long as retention is required by law.

When a retention period expires we delete the data or irreversibly de-identify it. Where deletion is not immediately possible, for example in secure backups, we isolate the data and delete it on the next backup cycle.

We maintain reasonable security safeguards appropriate to the sensitivity of the data, as required by the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include:

• Encryption of data in transit, and encryption at rest for identity documents and payment-related records.
• Role-based access control, so that staff can see only the data their role requires.
• Access logging and periodic review of who has access to what.
• Contractual security and confidentiality obligations on every vendor that touches personal data.
• Background checks and confidentiality undertakings for staff who handle KYC documents.
• Backup, recovery, and incident response procedures that are tested periodically.

If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal in the manner and within the timelines required by law. No system is perfectly secure, and we cannot guarantee absolute security, but we will tell you promptly and honestly if something goes wrong.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights. We will not charge you for exercising them, and we will not treat you differently because you did.

• Right to access: obtain a summary of the personal data we process about you, the processing activities involved, and the identities of the Data Fiduciaries and Data Processors we have shared it with.
• Right to correction and erasure: have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased where it is no longer needed for the purpose it was collected for and no law requires us to keep it.
• Right to withdraw consent: withdraw any consent you have given, at any time, as easily as you gave it. Withdrawal does not affect processing that already took place, and where the withdrawn consent was essential to providing a vehicle, we may have to end the rental.
• Right to nominate: nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to grievance redressal: raise a complaint with us and receive a response, before approaching the Data Protection Board of India.

To exercise any of these rights, write to hello@furrfurr.in from the email address or phone number registered with us, or contact our Grievance Officer. We will respond within the timelines prescribed under applicable law, and in any case will acknowledge you within seven working days. We may ask you to verify your identity before we act, because we will not hand your data to someone impersonating you.

The Digital Personal Data Protection Act, 2023 also places duties on you as a Data Principal. You must:

• Provide accurate and complete information, and not impersonate another person when giving KYC documents or opening an account.
• Not suppress material information when providing identity documents or when reporting damage, theft, or an incident.
• Not raise false or frivolous grievances or complaints.

Our services are for adults. We do not knowingly provide services to, or collect personal data from, anyone under 18 years of age. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we learn that we hold data of a person under 18, we will delete it promptly. If you believe a minor has given us data, write to us and we will act.

Our website uses a small number of cookies and similar technologies. Strictly necessary cookies keep the site secure and functional and cannot be switched off. Analytics cookies, where enabled, help us understand which pages riders and partners find useful, and we use them only with your consent. You can clear or block cookies in your browser settings, though parts of the site may then not work as intended.

We host and process personal data in India wherever we can. Some of our service providers, particularly cloud hosting, communication, and analytics vendors, may process data on servers outside India. Where that happens we transfer data only to countries not restricted by the Central Government under the Digital Personal Data Protection Act, 2023, and only under contracts that require standards of protection equivalent to those in this Policy.

Our website and app link to third-party services, including the Google Play Store where our rider app is listed. Those services have their own privacy policies and we are not responsible for their practices. Downloading our app from the Play Store means Google processes data about you under Google's own terms, not ours. We are not affiliated with, endorsed by, or acting as an agent of any delivery platform named on our website; their names and marks belong to them and are used only to describe the work our riders do.

We may update this Policy as our services, technology, or the law changes. The 'last updated' date at the top of this page always reflects the current version. If a change materially affects how we use your personal data, we will give you notice by email, in the app, or by SMS before the change takes effect, and where the law requires it we will ask for fresh consent. Continuing to use our services after a change takes effect means you accept the updated Policy.

If you have a question, a request, or a complaint about how we handle your personal data, contact our Grievance Officer. This is also the officer designated under the Information Technology Act, 2000 and the rules made under it.

• Grievance Officer: name to be inserted
• Email: hello@furrfurr.in
• Address: full registered address, Gurugram, Haryana, India
• Response time: acknowledgement within 7 working days, and resolution within the period prescribed by applicable law

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in the manner prescribed under the Digital Personal Data Protection Act, 2023.