Privacy Policy

1. Introduction

Swenid Private Limited (“Swenid”, “we”, “us”, “our”) is a company incorporated under the Companies Act, 2013, having its registered office at 5, Krishna Park Society, Berna Road, Himatnagar, Gujarat - 383001, India (CIN: U62099GJ2026PTC173653).

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our websites, contact us, or use our services, including the ride-sharing platform operated at www.theridesharing.in (the “Platform”).

This Policy is published in compliance with the Information Technology Act, 2000 and the rules made thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and regulations made thereunder, and other applicable Indian laws.

2. Definitions

• Personal Data: Any data about an individual who is identifiable by or in relation to such data.
• Data Principal: The individual to whom the Personal Data relates (i.e., you).
• Data Fiduciary: Swenid Private Limited, the entity that determines the purpose and means of processing your Personal Data.
• Sensitive Personal Data or Information (SPDI): As defined under Rule 3 of the SPDI Rules, 2011.
• Aadhaar Number: The 12-digit unique identification number issued by UIDAI.

3. Information We Collect

We collect only such data as is necessary for the purposes set out in this Policy.

3.1 Information you provide directly

• Identity & Contact Information: Name, email address, mobile number, postal address, date of birth.
• Account Credentials: Username and password (passwords are stored only in hashed form).
• Government ID for Verification: When you choose to verify your identity through DigiLocker / API Setu (Aadhaar-based or other government-issued IDs), we receive only the verification result and minimal demographic fields needed to onboard you (name, gender, date of birth, photograph). See Section 7 for our Aadhaar-specific commitments.
• Driver-specific Information (theridesharing.in): Driving licence number, RC (registration certificate) number, vehicle details, insurance details, PUC certificate.
• Payment-related Information: Payment is processed through PCI-DSS compliant third-party gateways. We do not store your full card number, CVV, or net-banking credentials.
• Communications: Project specifications, proposals, support queries, and other content you submit through forms or email.

3.2 Information collected automatically

• Device & Usage Data: IP address, browser type, operating system, device identifiers, referring URLs, pages visited, time spent.
• Location Data (Platform only): With your explicit consent, real-time GPS location to match riders with drivers, calculate fares, and ensure trip safety.
• Cookies and Similar Technologies: See Section 11.

4. Purpose of Processing

5. Consent

Where we rely on consent, we ask for it through a clear affirmative action — for example, by ticking an unticked checkbox before account creation, or by tapping an “I Agree” button before the first identity-verification request. Consent is asked for in clear, plain language and is itemised by purpose.

You may withdraw consent at any time by writing to our Grievance Officer (Section 14) or through the in-app settings. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and may limit our ability to provide certain services.

6. Sharing of Information

Swenid does not sell your Personal Data. We share data only as follows:

• Within the Platform: Limited driver/rider details (name, photograph, vehicle, contact) are shared between matched parties to enable the trip.
• Service Providers (Data Processors): Cloud hosting, SMS/email delivery, payment gateways, mapping services, identity-verification providers (e.g., API Setu / DigiLocker / authorised KSAs/AUAs). Each processor is bound by a written contract requiring confidentiality and DPDP-aligned safeguards.
• Legal Disclosure: When required by law, court order, or a valid request from a competent government authority.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale, with notice to affected users.

7. Identity Verification and Aadhaar Data Policy

8. Data Security

We follow Reasonable Security Practices and Procedures as required under Section 43A of the IT Act, 2000 and adhere to the principles of ISO/IEC 27001 in our information-security programme. Specifically:

• TLS 1.2+ encryption for all data in transit; AES-256 (or equivalent) for data at rest.
• Network isolation, least-privilege IAM, and multi-factor authentication for administrative access.
• Hashing and salting of authentication credentials.
• Audit logs, intrusion-detection, and regular vulnerability assessments.
• Personnel are bound by confidentiality obligations and trained on data-protection practices.
• Periodic third-party security audits and a documented incident-response plan.

Notwithstanding these measures, no system can be guaranteed 100% secure. In the event of a personal data breach likely to result in risk to your rights, we will notify the Data Protection Board of India and affected users in the manner and within the timelines prescribed under the DPDP Act.

9. Data Retention

We retain Personal Data only for as long as it is required to fulfil the purposes set out in this Policy, or as required by applicable law (whichever is longer). Indicative retention periods:

• Account data: Duration of the account + 3 years thereafter (for legal and tax records).
• Trip and transaction records: 8 years (Income-Tax Act / GST recordkeeping).
• Server access logs: 180 days, unless required for security investigation.
• Aadhaar authentication artefacts: Not retained beyond the active transaction (see Section 7).
• Marketing preferences: Until you opt out.

On expiry of the retention period or upon your verified erasure request, data is securely deleted or irreversibly anonymised.

10. Your Rights as a Data Principal

Subject to applicable law, you have the right to:

• Access: Obtain a summary of the Personal Data we process about you.
• Correction & Updation: Correct, complete, or update inaccurate or outdated data.
• Erasure: Request deletion of Personal Data that is no longer necessary for the purpose collected (subject to statutory retention obligations).
• Withdrawal of Consent: Withdraw any consent you have previously given.
• Grievance Redressal: Lodge a complaint with our Grievance Officer; if unresolved, escalate to the Data Protection Board of India.
• Nomination: Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, write to the Grievance Officer (Section 14). We will respond within the timelines prescribed under the DPDP Act and, in any event, within 30 days.

11. Cookies and Similar Technologies

We use first-party cookies that are strictly necessary for site operation (session management, security, language preferences) and, with your consent, analytics cookies to understand usage patterns. You can disable cookies from your browser settings; however, this may affect site functionality. We do not use cookies for cross-site advertising profiling.

12. Children’s Data

Our services are not directed to individuals under 18 years of age. We do not knowingly collect Personal Data of children. If we become aware that a child’s data has been collected without verifiable parental consent, we will delete it promptly.

13. Cross-Border Transfers

Personal Data is primarily stored on servers located in India. To the extent any data is transferred outside India for processing by service providers, such transfer is carried out only to jurisdictions permitted under the DPDP Act and subject to contractual safeguards.

14. Grievance Officer & Data Protection Contact

In accordance with the Information Technology Act, 2000, the SPDI Rules, 2011, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, the contact details of our Grievance Officer are:

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are dissatisfied with the resolution, you may approach the Data Protection Board of India.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified by email (where you have an account) and by a prominent notice on this page at least 7 days before they take effect. The “Last Updated” date at the top reflects the most recent revision.

16. Contact Us

For any questions about this Policy or our data-handling practices, write to info@swenid.com.