DUZUTO PRIVACY POLICY

Duzuto respects your privacy and is committed to protecting the personal data and information that you share with us.

This Privacy Policy explains how DUZUTO LLM, a company incorporated under the laws of India, having its registered office at Darbhanga, Bihar ("Duzuto", "Company", "we", "us", or "our"), collects, uses, stores, discloses, and otherwise processes personal data when you access or use the Duzuto website, mobile applications, services, and related platforms.

For the purposes of this Privacy Policy, the Duzuto customer application, professional application, website, and related technology platforms are collectively referred to as the "Platform", and the services made available through the Platform are referred to as the "Services".

This Privacy Policy applies to individuals who access or use the Platform, including customers who book or use home services ("Customers" or "you") and professionals who register, apply, or provide services through Duzuto ("Professionals").

This Privacy Policy should be read together with Duzuto's Terms and Conditions and any other policies, notices, or terms made available by Duzuto from time to time.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and processing of your personal data as described herein, subject to applicable law.

1. OUR ROLE

Duzuto operates a technology-enabled marketplace that facilitates connections between Customers and independent Professionals providing home-based and other services.

Depending on the context, Duzuto may process personal data for purposes including:

• creating and managing user accounts;
• facilitating bookings;
• matching Customers with Professionals;
• enabling service delivery;
• processing payments;
• providing customer and professional support;
• improving safety and trust;
• preventing fraud and misuse;
• improving the Platform and Services;
• complying with legal obligations; and
• communicating with Customers and Professionals.

Duzuto may act as a Data Fiduciary, as applicable under Indian data-protection law, in relation to personal data processed by us for our own purposes.

Where a third-party service provider processes personal data on our behalf, such processing may be carried out under appropriate contractual arrangements and instructions.

2. PERSONAL DATA WE COLLECT

We collect personal data that is reasonably necessary to provide, secure, improve, and operate the Platform and Services.

The information we collect may vary depending on whether you are a Customer, Professional, visitor, or other user of the Platform.

2.1 Information You Provide Directly

Depending on your use of the Platform, we may collect:

Account Information

• full name;
• mobile number;
• email address;
• profile photograph, where provided;
• account credentials or authentication information;
• date of birth or age information where required;
• preferred language;
• communication preferences; and
• other information necessary to create or manage your account.

Booking Information

When you create or manage a booking, we may collect:

• service selected;
• booking date and time;
• service duration;
• service location;
• booking status;
• booking instructions;
• special service requirements;
• subscription or package information;
• cancellation information;
• refund information; and
• other information necessary to fulfil the booking.

Address and Location Information

Depending on the Services you use, we may collect:

• service address;
• apartment, flat, house, building, or unit details;
• locality;
• postal code;
• location coordinates;
• approximate location;
• GPS/location information from your device where you have enabled the relevant permission; and
• access or location-related instructions provided for service delivery.

Location information may be used to determine service availability, identify Professionals near a booking location, calculate applicable charges, facilitate navigation, improve service allocation, and support safety and fraud prevention.

Payment Information

We may collect information relating to payments and transactions, including:

• transaction amount;
• transaction date and time;
• payment status;
• payment method;
• transaction or payment reference;
• refund status;
• subscription or prepaid balance information; and
• information required to reconcile payments.

Where payment is processed through a third-party payment processor, payment-card or banking credentials may be collected and processed directly by that provider in accordance with its applicable terms and privacy policy.

Duzuto generally does not need to store complete card numbers, CVV numbers, UPI PINs, passwords, or other authentication credentials used by payment providers.

You should never share your UPI PIN, card PIN, OTP, password, or other payment authentication credentials with Duzuto, a Professional, or any other person.

3. INFORMATION COLLECTED AUTOMATICALLY

When you use the Platform, we may automatically collect certain technical and usage information.

This may include:

• IP address;
• device type;
• device model;
• operating system;
• operating-system version;
• browser type;
• application version;
• unique device or installation identifiers;
• mobile network information;
• language and regional settings;
• time zone;
• crash information;
• diagnostic information;
• login and session information;
• approximate location;
• interaction with Platform features;
• pages or screens viewed;
• buttons or features used;
• search activity;
• booking activity;
• timestamps;
• error logs; and
• other technical information necessary to operate and secure the Platform.

We may use this information to maintain, troubleshoot, secure, analyse, and improve the Platform.

4. LOCATION INFORMATION

Certain Duzuto features may require access to your location.

For example, location information may be used to:

• determine whether Duzuto Services are available in your area;
• identify Professionals available near you;
• facilitate booking allocation;
• estimate travel distance or time;
• support navigation;
• improve service matching;
• detect suspicious or fraudulent activity;
• provide relevant service information;
• support customer and professional safety; and
• improve operational efficiency.

Depending on the functionality, location information may be collected while the Duzuto application is open or, where specifically required and permitted by the operating system and applicable law, in the background.

You may control location permissions through your device settings. However, disabling location permissions may affect certain Duzuto features.

Where precise location is not necessary for a particular feature, we may use approximate location information.

5. INFORMATION ABOUT BOOKINGS AND SERVICE INTERACTIONS

When you use Duzuto to book a Service, we may collect and retain information relating to your interaction with the Service.

This may include:

• booking details;
• assigned Professional;
• booking acceptance and cancellation;
• service start and completion information;
• service duration;
• arrival information;
• booking history;
• customer instructions;
• service-related communications;
• ratings and reviews;
• complaints and support requests;
• refund and dispute information; and
• other information necessary to administer the booking.

This information helps us provide the Services, maintain accurate records, resolve disputes, investigate complaints, and improve the Platform.

6. INFORMATION ABOUT PROFESSIONALS

If you register or apply to provide Services through Duzuto, we may collect additional information necessary for onboarding, verification, safety, and service operations.

This may include:

• name;
• mobile number;
• email address;
• photograph;
• address;
• identity information;
• government-issued identification details;
• age/date of birth;
• bank or payment information;
• service skills;
• service categories;
• experience;
• availability;
• service history;
• ratings and reviews;
• training information;
• onboarding information;
• background verification information, where applicable;
• location information;
• device information;
• attendance and service activity; and
• other information required for legitimate business, safety, legal, or regulatory purposes.

Professional information may be shared with Customers to the extent reasonably necessary to facilitate bookings and informed use of the Services.

7. INFORMATION FROM THIRD PARTIES

We may receive information about you from third parties where permitted by law.

Such sources may include:

• payment processors;
• identity verification providers;
• fraud-prevention providers;
• map and location service providers;
• authentication providers;
• analytics providers;
• customer-support providers;
• cloud infrastructure providers;
• communication providers;
• Professionals;
• other users;
• publicly available sources; and
• governmental or regulatory authorities where legally permitted or required.

8. HOW WE USE PERSONAL DATA

We may process personal data for the following purposes:

8.1 Providing Services

To:

• create and manage accounts;
• process bookings;
• match Customers with Professionals;
• determine availability;
• facilitate service delivery;
• process cancellations;
• process refunds;
• administer subscriptions and packages;
• maintain prepaid balances;
• provide customer support; and
• communicate about bookings.

8.2 Payments

To:

• process payments;
• verify transactions;
• reconcile transactions;
• process refunds;
• detect suspicious transactions;
• handle chargebacks;
• prevent payment fraud; and
• maintain transaction records.

8.3 Safety and Trust

We may process information to:

• verify users and Professionals;
• conduct onboarding checks;
• detect fraudulent activity;
• investigate suspicious behaviour;
• protect Customers and Professionals;
• investigate complaints;
• prevent misuse;
• enforce our Terms and Conditions; and
• maintain platform integrity.

8.4 Communication

We may contact you through:

• phone calls;
• SMS;
• email;
• WhatsApp, where applicable;
• push notifications;
• in-app messages; and
• other communication channels made available by Duzuto.

These communications may relate to:

• account activity;
• booking confirmations;
• Professional assignment;
• arrival or service updates;
• cancellations;
• payments;
• refunds;
• customer support;
• security alerts;
• policy updates; and
• other service-related matters.

Certain service communications are necessary for the operation of the Platform and may continue even if you opt out of promotional communications.

8.5 Platform Improvement

We may analyse usage and operational information to:

• improve our technology;
• improve booking allocation;
• improve matching between Customers and Professionals;
• improve service availability;
• understand user behaviour;
• identify technical problems;
• develop new features;
• improve performance; and
• conduct analytics and statistical analysis.

Where reasonably possible, information used for analytics may be aggregated or anonymised.

8.6 Marketing and Promotions

Subject to applicable law and your communication preferences, we may use your contact information to:

• send promotional offers;
• inform you about new Services;
• provide discounts;
• send membership or subscription offers;
• communicate relevant Duzuto updates; and
• provide information about products or services offered by Duzuto or its partners.

You may opt out of promotional communications using the mechanism provided in the communication or through available account settings.

9. LEGAL BASES AND PERMITTED PURPOSES

We process personal data only for lawful purposes and in accordance with applicable law.

Depending on the circumstances, processing may be based on:

• your consent;
• your request to receive Services;
• processing necessary to provide a Service or fulfil a transaction;
• compliance with a legal obligation;
• prevention and detection of fraud, misuse, or security incidents;
• protection of rights and safety;
• legitimate business and operational purposes to the extent permitted by applicable law; and
• other grounds permitted under applicable law.

Where consent is required, we will seek consent in an appropriate manner.

Where processing is based on consent, you may withdraw consent in accordance with applicable law. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

The Digital Personal Data Protection framework requires notices and consent mechanisms to provide clear information about personal data and purposes and to provide appropriate means for withdrawal and exercise of rights. ([MeitY][2])

10. SHARING OF PERSONAL DATA

We do not sell your personal data as a standalone commercial product.

We may share personal data with third parties where reasonably necessary for the purposes described in this Privacy Policy or where permitted or required by law.

10.1 Professionals

To fulfil a booking, we may share relevant Customer information with the assigned Professional.

This may include:

• Customer name;
• service address;
• location information;
• booking date and time;
• service requirements;
• relevant booking instructions; and
• information reasonably necessary to provide the Service.

Professionals may receive only the information reasonably necessary for service fulfilment and platform operations.

Similarly, Customers may receive certain Professional information, such as name, profile photograph where applicable, ratings, service information, or other relevant information necessary to identify the assigned Professional.

11. SERVICE PROVIDERS AND BUSINESS PARTNERS

We may use third-party service providers to operate Duzuto.

These may include providers for:

• cloud hosting;
• databases;
• payment processing;
• maps and geolocation;
• SMS;
• email;
• WhatsApp communications;
• push notifications;
• authentication;
• analytics;
• crash reporting;
• customer support;
• identity verification;
• fraud detection;
• security;
• data storage;
• infrastructure monitoring; and
• other technology services.

Such providers may process personal data on our behalf or independently where applicable.

We seek to use appropriate contractual, technical, and organisational safeguards for such processing.

12. GOOGLE MAPS AND LOCATION SERVICES

Duzuto may use mapping and location technologies, including Google Maps or related Google location services, to provide location-based functionality.

These services may process location information and other relevant technical information in accordance with their applicable terms and privacy policies.

Location functionality may be used for:

• selecting service locations;
• displaying addresses;
• estimating distance;
• identifying nearby Professionals;
• navigation;
• service allocation; and
• operational purposes.

13. PAYMENT PROCESSORS

Payments may be processed through third-party payment providers.

When you make a payment, the relevant payment provider may collect and process information necessary to complete the transaction.

Duzuto may receive transaction-related information such as:

• transaction ID;
• amount;
• payment status;
• payment method;
• timestamp;
• refund status; and
• other transaction information.

Your use of a third-party payment service may also be subject to that provider's own terms and privacy policy.

14. PUSH NOTIFICATIONS

Duzuto may use push-notification services to send information to your device.

Notifications may include:

• booking confirmation;
• Professional assignment;
• booking status;
• service reminders;
• cancellation updates;
• payment notifications;
• account-security alerts;
• customer-support messages; and
• promotional communications, where applicable.

You can generally manage notification permissions through your device settings.

Disabling notifications may prevent you from receiving certain timely Service updates.

15. CALLS AND COMMUNICATIONS

To facilitate bookings and support, Duzuto may enable communications between Customers, Professionals, and Duzuto.

Where technically available, we may use masked or controlled communication mechanisms to reduce unnecessary disclosure of personal contact information.

Calls or communications may be logged or recorded where permitted by applicable law and where reasonably necessary for:

• customer support;
• quality monitoring;
• dispute resolution;
• fraud prevention;
• safety investigations;
• training; or
• compliance.

Where recording is required to be disclosed or consented to under applicable law, appropriate notice or consent mechanisms may be used.

16. REVIEWS, RATINGS, AND USER CONTENT

Duzuto may allow Customers and Professionals to submit:

• ratings;
• reviews;
• comments;
• feedback;
• photographs;
• complaints; and
• other content.

Reviews and ratings may be associated with your account and may be visible to other users to the extent necessary for operating the Platform.

We may use reviews and feedback to:

• improve Services;
• assess service quality;
• investigate complaints;
• monitor platform safety;
• train or improve operational processes; and
• promote Duzuto where permitted by law.

You should not include sensitive personal information, payment credentials, passwords, government identification numbers, or another person's private information in a review or public content.

17. COOKIES AND SIMILAR TECHNOLOGIES

The Duzuto website may use cookies, SDKs, pixels, local storage, and similar technologies.

These technologies may be used to:

• keep you signed in;
• remember preferences;
• understand website usage;
• measure performance;
• improve functionality;
• detect security threats;
• analyse traffic; and
• support marketing and advertising where applicable.

You may be able to control cookies through your browser settings.

Disabling certain cookies may affect website functionality.

18. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• providing Services;
• maintaining transaction and booking records;
• resolving disputes;
• preventing fraud;
• enforcing agreements;
• complying with legal obligations;
• maintaining accounting and tax records;
• protecting our legal rights; and
• meeting regulatory requirements.

Different categories of information may have different retention periods.

For example, transaction, payment, accounting, tax, security, and dispute-related information may need to be retained for longer periods than ordinary account information.

When personal data is no longer required for a lawful purpose, we may delete, anonymise, or otherwise securely dispose of it, subject to applicable law and legitimate retention requirements.

19. ACCOUNT DELETION

You may request deletion of your Duzuto account through the functionality provided in the application or by contacting us using the details provided below.

Upon receiving a valid deletion request, we will process the request in accordance with applicable law.

Deletion of an account may not result in immediate deletion of every record associated with that account where we are required or permitted to retain information for:

• legal compliance;
• tax or accounting purposes;
• fraud prevention;
• dispute resolution;
• security;
• enforcement of agreements; or
• other lawful purposes.

Where information cannot be deleted immediately for such reasons, it may be securely retained and isolated from further processing except as required for the applicable purpose.

20. YOUR RIGHTS

Subject to applicable law, you may have rights in relation to your personal data, including the right to:

• obtain information about processing of your personal data;
• request access to information regarding your personal data;
• request correction or updating of inaccurate or incomplete information;
• request deletion of personal data where legally applicable;
• withdraw consent where processing is based on consent;
• raise a grievance regarding processing of your personal data;
• nominate another individual to exercise rights in accordance with applicable law; and
• exercise other rights available under applicable data-protection laws.

Requests may be subject to reasonable verification requirements to protect your account and personal data.

We may request information necessary to verify your identity before processing certain requests.

21. WITHDRAWAL OF CONSENT

Where we process personal data based on your consent, you may withdraw your consent through the mechanism made available by Duzuto or by contacting us.

We will process your request within the applicable legal framework.

However, withdrawal of consent may affect our ability to provide certain Services where the relevant information is necessary to provide those Services.

Withdrawal of consent does not affect the lawfulness of processing performed before consent was withdrawn.

22. GRIEVANCE REDRESSAL

If you have any question, concern, complaint, or grievance relating to the processing of your personal data, you may contact us.

Customer Support

You may contact Duzuto through:

Email: support@duzuto.com In-App Support: Available through the Duzuto application

23. CHILDREN'S PRIVACY

Duzuto Services are intended for individuals who are legally capable of entering into agreements and using the Services.

Duzuto does not knowingly seek to collect personal data from children in circumstances where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to Duzuto in circumstances where such collection was not permitted, please contact us.

Where applicable law requires parental or lawful guardian consent for processing a child's personal data, Duzuto will implement appropriate mechanisms required by law.

24. DATA SECURITY

We take reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• destruction;
• accidental loss;
• misuse; and
• other unlawful processing.

Depending on the nature of the information and risks involved, security measures may include:

• encryption in transit;
• access controls;
• authentication mechanisms;
• role-based access;
• logging and monitoring;
• secure cloud infrastructure;
• backups;
• vulnerability management;
• security reviews; and
• incident-response procedures.

However, no electronic system, network, or method of transmission can be guaranteed to be completely secure.

Accordingly, while we take reasonable measures to protect your personal data, we cannot guarantee absolute security.

25. DATA BREACHES AND SECURITY INCIDENTS

If Duzuto becomes aware of a personal-data breach or security incident requiring notification under applicable law, we will take appropriate steps to:

• investigate the incident;
• contain and mitigate its effects;
• protect affected systems;
• assess the nature and extent of the incident;
• notify relevant authorities where required; and
• notify affected individuals where required by applicable law.

26. INTERNATIONAL DATA PROCESSING

Some of our technology or service providers may process personal data from locations outside India.

Where personal data is transferred, stored, or processed outside India, Duzuto will take steps required under applicable law and contractual arrangements to ensure that such processing is carried out in accordance with applicable data-protection requirements.

This may include cloud infrastructure, payment services, analytics, communications, customer-support, security, or other technology providers.

27. BUSINESS TRANSFERS

If Duzuto undergoes a merger, acquisition, restructuring, financing, sale of assets, or transfer of all or part of its business, personal data may be transferred to the relevant successor, acquiring entity, or service provider to the extent permitted by applicable law.

Any such transfer will be subject to appropriate legal and contractual requirements.

28. LEGAL DISCLOSURES

Duzuto may disclose personal data where reasonably necessary or legally required to:

• comply with applicable law;
• respond to lawful requests from governmental authorities;
• comply with court orders;
• respond to regulatory requirements;
• investigate fraud;
• investigate security incidents;
• protect the rights or safety of Duzuto, Customers, Professionals, or others;
• enforce our Terms and Conditions; or
• establish, exercise, or defend legal claims.

29. FRAUD PREVENTION AND PLATFORM SECURITY

We may analyse information relating to:

• account activity;
• device information;
• IP addresses;
• booking patterns;
• payment activity;
• location information;
• cancellation patterns;
• refund activity;
• Professional activity;
• customer complaints; and
• other platform activity

to identify and prevent:

• fraud;
• account abuse;
• payment misuse;
• fake accounts;
• fraudulent bookings;
• promotional abuse;
• identity misuse;
• suspicious activity; and
• other violations of Duzuto's Terms or applicable law.

We may suspend, restrict, investigate, or terminate accounts where permitted by our Terms and applicable law.

30. AUTOMATED SYSTEMS AND ALGORITHMIC PROCESSING

Duzuto may use automated systems, algorithms, or software to support:

• Professional matching;
• booking allocation;
• service availability;
• pricing;
• ranking;
• fraud detection;
• operational planning;
• notifications;
• recommendations; and
• other Platform functions.

Automated systems may consider factors such as:

• location;
• availability;
• booking requirements;
• service category;
• Professional skills;
• ratings;
• service history;
• operational capacity;
• demand; and
• other relevant marketplace information.

Automated processing does not necessarily result in a decision solely by automated means, and Duzuto may review certain decisions where appropriate or required by law.

31. PERSONAL DATA OF OTHER INDIVIDUALS

If you provide Duzuto with personal data relating to another individual, such as:

• a family member;
• household member;
• tenant;
• guest;
• building representative; or
• another person receiving or facilitating a Service,

you should ensure that you have the necessary authority or lawful basis to provide that information.

You should not provide another person's personal data to Duzuto unless you are legally permitted to do so.

32. CUSTOMER SERVICE AND SUPPORT RECORDS

When you contact Duzuto support, we may retain information relating to your interaction with our support team.

This may include:

• messages;
• emails;
• support tickets;
• booking information;
• complaints;
• photographs or documents you voluntarily provide;
• call records;
• resolution details; and
• other information necessary to investigate and resolve the issue.

We use such information for customer support, quality improvement, dispute resolution, fraud prevention, and legal compliance.

33. PROFESSIONAL SAFETY AND CUSTOMER SAFETY

Because Duzuto facilitates services performed at homes and other locations, safety is an important part of the Platform.

We may process relevant information to:

• verify Professionals;
• identify suspicious behaviour;
• investigate complaints;
• manage incidents;
• protect Customers and Professionals;
• enforce safety policies;
• investigate misconduct; and
• cooperate with law enforcement where legally required.

We may share relevant information with appropriate parties where necessary to address a safety incident or comply with law.

34. PUBLICLY AVAILABLE INFORMATION

Certain information you choose to make public through the Platform, including reviews, ratings, comments, profile information, or other content, may be visible to other users or third parties depending on the relevant functionality.

You should therefore avoid posting information that you do not want others to see.

35. LINKS TO THIRD-PARTY WEBSITES

The Platform may contain links to websites, applications, services, or resources operated by third parties.

Duzuto does not control the privacy practices of such third parties.

Your use of third-party services is subject to their respective terms and privacy policies.

We encourage you to review the privacy policy of any third-party service before providing personal data.

36. THIRD-PARTY APPLICATIONS AND SERVICES

The Platform may integrate with third-party technologies, including:

• payment services;
• mapping services;
• authentication services;
• communication services;
• analytics services;
• cloud infrastructure;
• notification services; and
• other technology providers.

Such providers may process information according to their own terms and applicable privacy policies.

Duzuto will seek to ensure that third-party service providers processing personal data on our behalf are subject to appropriate contractual and security requirements.

37. YOUR RESPONSIBILITIES

You are responsible for:

• keeping your account credentials secure;
• providing accurate information;
• updating inaccurate information;
• not sharing your OTP or authentication credentials;
• not providing unnecessary personal data through reviews or support;
• notifying Duzuto of suspected unauthorised account access; and
• using the Platform in accordance with the Terms and applicable law.

If you believe that your account has been compromised, you should contact Duzuto promptly.

38. CHANGES TO THIS PRIVACY POLICY

Duzuto may update this Privacy Policy from time to time.

Changes may be made to reflect:

• changes in our Services;
• changes in technology;
• changes in our data-processing practices;
• changes in legal or regulatory requirements; or
• other operational requirements.

When we make material changes, we may provide notice through:

• the Duzuto application;
• website;
• email;
• push notification; or
• other appropriate communication channels.

The updated Privacy Policy will indicate the revised "Last Updated" date.

Your continued use of the Platform after the effective date of an updated Privacy Policy will be subject to the updated policy, to the extent permitted by applicable law.

39. GOVERNING LAW

This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, subject to applicable data-protection and privacy laws.

Nothing in this Privacy Policy limits any rights that you may have under applicable law.

40. CONTACT US

If you have questions about this Privacy Policy, our data-processing practices, or your personal data, you may contact us at: support@duzuto.com

41. IMPORTANT INFORMATION REGARDING THIS POLICY

This Privacy Policy describes Duzuto's general personal-data processing practices.

The specific personal data collected from you may depend on:

• whether you use Duzuto as a Customer or Professional;
• the Services you use;
• your device and operating-system permissions;
• your interaction with the Platform;
• the payment methods you select;
• your communication preferences;
• applicable legal requirements; and
• the features available to you at the relevant time.

Where Duzuto provides a separate notice or obtains consent for a specific processing activity, that notice or consent may supplement this Privacy Policy.