Privacy Policy

The Data Fiduciary

GoZevv is a brand operated by SourceKode Technologies LLP. When you book a ride, contact us or use this website, SourceKode Technologies LLP decides why and how your personal data is used. In the words of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary and you are the Data Principal.

• SourceKode Technologies LLP, operating the GoZevv brand
• Registered address: ZAGA Complex, Senapati Bapat Rd, Shivajinagar, Pune, Maharashtra 411016, India
• GSTIN: 27ACGFS8559J2ZC
• Email: contact@gozevv.in
• Phone: +91 84467 81432

What this notice covers

This notice applies to the GoZevv website at gozevv.in, our booking and support forms, our WhatsApp and phone booking channels, and the rides we operate. It explains, item by item, what personal data we collect, why we collect it, what allows us to collect it in law, how long we keep it, and exactly what you can do about it.

The language of this notice

The DPDP Act requires this notice to be in clear and plain language, and gives you the right to receive it in English or in any language listed in the Eighth Schedule to the Constitution of India. This version is in English. If you would prefer it in Hindi, Marathi or another Eighth Schedule language, email contact@gozevv.in naming the language and we will send you a copy.

2.1 What you give us when you book

We ask only for what is needed to plan and run your trip. For each item, this is the specific purpose:

• Full name — so the chauffeur can identify the passenger and so we can raise a correct invoice.
• Mobile number — to send the booking confirmation, the chauffeur and vehicle details, and so the chauffeur can reach you at pickup.
• Email address — to send the booking confirmation, the invoice and receipts, and to answer support requests.
• Pickup address and drop address — to plan the route, quote the fare and perform the trip.
• Date, time, passenger count and trip notes — to allocate a vehicle and a chauffeur.
• Name and mobile number of the passenger — only when you book on behalf of someone else, and only so the chauffeur can meet the right person.
• Company name and work email — only on the corporate enquiry form, to prepare a corporate mobility proposal and billing.

We do not ask for your date of birth, your government ID number, your religion, your caste or any similar detail, and you should not send them to us.

2.2 What is created by using the service

• Trip history — the trips you have taken, their routes, dates and status. Used to show you your trips, to handle disputes and refunds, and to raise invoices.
• Payment reference — the transaction or order identifier, the amount, the payment status and the method reported back to us by the payment gateway. We use it to reconcile payments and issue refunds.
• Support tickets and correspondence — what you wrote to us and what we replied, so we can resolve and audit the issue.
• Invoices and tax records — kept because Indian tax law requires it.

We never receive or store your full card number, card CVV, UPI PIN or net-banking credentials. Those go directly to the payment gateway and never touch our servers.

2.3 Precise location — only when you ask for it

We never read your device location on our own. It is read only when you press “Use my location” in the city selector, beside the note that explains what happens. Your browser then asks you for permission separately, and saying no there ends it. Pressing that button is what records your consent for precise location, and you will see it switched on afterwards in our privacy choices panel. Until you press it, it is off.

When you do, we use the coordinates at that moment for two things only: to fill in your pickup point, and to show you the nearest GoZevv service city. We do not follow you between trips, we do not build a location history from it, and we never sell it or share it for advertising.

You can withdraw it at any time. Switching “Precise location” off in the privacy choices panel takes effect on the same page view: it erases the service city saved in your browser and the location consent record with it, so nothing further is read unless you ask again. “Forget my saved city” in the city selector erases those same two values, and revoking this site’s location permission in your browser stops it at the browser level.

2.4 Website and device data

When you visit gozevv.in we record your IP address, browser and device type, the pages you viewed, the page that referred you, and a random first-party visitor and session identifier stored in your browser. We use this to keep the site working, to detect abusive or automated form submissions, and to understand which pages are useful.

Measurement that is not necessary to run the site — third-party analytics and any marketing measurement — stays switched off until you switch it on. See section 4.

2.5 Booking for someone else

If you give us another person’s name or mobile number, please share it only if they know and agree. We rely on you having their permission. That person has the same rights under this notice as you do, and we will act on a request they make to us directly.

2.6 What we do not do

• We do not sell, rent or trade your personal data.
• We do not make decisions about you by automated means alone that significantly affect you.
• We do not use your trip data to build advertising profiles.

Under the DPDP Act, personal data may be processed either with your consent (section 6) or for a small set of “certain legitimate uses” (section 7). We rely on the following, and nothing else:

• Your consent (section 6) — for precise location, for analytics and marketing measurement, for promotional messages, and for anything else where we show you a request and you agree.
• Certain legitimate uses, section 7(a) — for the data you voluntarily give us in order to get a ride, for the specified purpose of arranging and performing that ride, where you have not indicated that you object.
• Compliance with law, section 7(b) and 7(i) — where we must keep or disclose data to comply with a law in force in India, such as GST invoicing and record-keeping, or a lawful order of a court or authority.

4.1 How we ask

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. So:

• We ask separately for each purpose. We never bundle unrelated purposes into one tick-box.
• No box is ever pre-ticked. A blank, unticked box is the starting state. Silence or continuing to browse is not consent.
• Every request tells you what data it covers, what it will be used for, how to withdraw, and how to complain to the Data Protection Board of India.
• We ask only for what the stated purpose needs. Refusing an optional consent never blocks you from booking a ride.

4.2 How to withdraw — as easily as you gave it

The DPDP Act requires that withdrawing consent be as easy as giving it. Any one of these works, and none of them requires you to give a reason:

• Open the privacy choices panel — the “Privacy choices” button at the foot of this page and in the site footer — and untick the category. It takes effect the moment you save.
• Use the data request form at gozevv.in/legal/data-request/ and choose “Withdraw consent”.
• Email contact@gozevv.in with the word “Withdraw” and what you want stopped.
• Reply STOP to a promotional WhatsApp or SMS message, or use the unsubscribe link at the foot of a marketing email.
• Revoke the site’s location permission in your browser settings, which stops location collection on its own.

4.3 What happens after you withdraw

We stop that processing. We then erase the personal data collected for that purpose, and we instruct our processors to erase it too, unless a law in force in India requires us to keep it — see section 7 on retention.

Withdrawing consent does not make anything we lawfully did before the withdrawal unlawful. If a withdrawal would stop us completing a booking you have already made, we will tell you before we act on it so you can decide.

We use a small amount of browser storage. It is grouped into four categories, and you control three of them:

• Strictly necessary — always on. Keeping you signed in, remembering the city you selected, protecting forms against automated abuse, and security. The site cannot work without these, so they cannot be switched off.
• Analytics — off until you allow it. Understanding which pages are used so we can improve them. No third-party analytics script loads until you consent, and withdrawing consent stops it.
• Marketing — off until you allow it. Measuring whether an advertisement led to a booking. Nothing loads until you consent.
• Precise location — off until you allow it. See section 2.3.

We record the date, time and version of the choice you made, so that we can show what you agreed to and when. That record is kept in your browser and in our records of consent.

You can change these at any time from the privacy choices panel, or from the “Privacy choices” link at the bottom of this page.

6.1 The rights the DPDP Act gives you

• Right to access (section 11). You can ask for a summary of the personal data we hold about you, the processing we have carried out on it, and the identities of the other Data Fiduciaries and Data Processors with whom we have shared it, along with a description of what was shared.
• Right to correction, completion and updating (section 12). If something we hold is wrong, incomplete or out of date — a misspelled name, an old mobile number, a wrong billing address — you can ask us to correct, complete or update it.
• Right to erasure (section 12). You can ask us to erase your personal data. We will erase it unless keeping it is required for the purpose you gave it for, or by a law in force in India. Where we must keep something, we will tell you which record and why.
• Right of grievance redressal (section 13). You can complain to us about anything in this notice or about how we handled a request, and we must respond. See section 8.
• Right to nominate (section 14). You may nominate one or more individuals to exercise all of these rights on your behalf if you die or become unable to exercise them yourself.
• Right to withdraw consent (section 6). Covered in section 4.2 above.

6.2 How to exercise them

Use the data request form at gozevv.in/legal/data-request/. It lets you choose access, correction, erasure, nomination or withdrawal of consent, and it goes straight to our grievance desk. If you would rather write to us, email contact@gozevv.in with “DPDP request” in the subject line, or post a letter to the address in section 8.

There is no fee for making a request.

6.3 How we verify who you are

We have to be sure that we are not disclosing or deleting one person’s data at another person’s request. So we ask for the minimum that lets us match you to your records:

• The mobile number or email address you used when booking, and a booking reference if you have one.
• A one-time code that we send to that mobile number or email address.
• For a nomination, or for a request made by a nominee after a death or incapacity, we may additionally ask for proof of identity of the nominee and the relevant certificate or medical record.

We use verification details only to check the request. We do not add them to your marketing profile, and we delete any document you send us for verification once the request is closed.

6.4 Your duties under the Act (section 15)

The DPDP Act also places duties on you. In short: comply with the law when exercising your rights, do not impersonate another person when giving personal data, do not suppress material information or give false particulars when providing data or when asking for erasure, and do not register a false or frivolous grievance or complaint. The Act provides for a penalty of up to Rs 10,000 for breaching these duties.

We keep personal data only for as long as the purpose it was collected for is still being served, or for as long as a law in force in India requires us to keep it. After that it is erased or irreversibly anonymised.

• Booking and trip records, invoices and payment references — kept for the life of your relationship with us and thereafter as tax law requires. Section 36 of the Central Goods and Services Tax Act, 2017 requires accounts and records to be retained for 72 months (six years) from the due date of furnishing the annual return for that financial year. We cannot erase an invoice before that period ends.
• Support tickets and correspondence — kept for 24 months after the ticket is closed, then erased.
• Records of consent and withdrawal — kept for the life of the consent and for three years after it is withdrawn. The DPDP Act places the burden of proving valid consent on us, so we must be able to evidence what you agreed to and when.
• Precise location — used at the moment you share it to fill in your pickup point. We do not retain it as a separate location history.
• Website and analytics data — retained for no longer than 14 months.
• Marketing contact details — erased as soon as you withdraw, apart from the minimum needed to keep you off our lists.

When you ask us to erase, we erase from our live systems first and from routine backups as those backups age out on their normal cycle. We instruct our processors to do the same.

8.1 Our Grievance Officer

If you are unhappy with anything — how we collected your data, how we answered a request, or this notice itself — contact our Grievance Officer. You do not need to have used the form first.

• Name: Karan, Grievance Officer, GoZevv — SourceKode Technologies LLP
• Email: contact@gozevv.in, with “DPDP Grievance” in the subject line
• Phone: +91 84467 81432
• Post: Grievance Officer, SourceKode Technologies LLP, ZAGA Complex, Senapati Bapat Rd, Shivajinagar, Pune, Maharashtra 411016, India

8.2 The timeline we commit to

We will acknowledge your grievance within 3 working days of receiving it, and resolve it within 30 days. In no case will we take longer than 90 days from the date we receive it. If we need longer than 30 days we will tell you why, and what we still need.

8.3 Escalating to the Data Protection Board of India

If we do not respond within the period above, or you are not satisfied with our response, you have the right to complain to the Data Protection Board of India, the adjudicating body established under section 18 of the DPDP Act. You do not need our permission, and we will not treat a complaint to the Board as a reason to stop serving you.

The Board publishes its own address and complaint procedure. Under the Act you are expected to have first tried the Data Fiduciary’s grievance route, which is why we ask you to write to us first — but the right to approach the Board is yours.

GoZevv is a service for adults. Under the DPDP Act a “child” is anyone who has not completed 18 years of age.

• We do not knowingly process the personal data of a child without the verifiable consent of a parent or lawful guardian.
• We do not carry out tracking or behavioural monitoring of children, and we do not direct advertising at children. These are prohibited by section 9 of the Act and we do not do them.
• We do not undertake processing that is likely to cause any detrimental effect on the well-being of a child.
• The same protections apply to a person with a disability who has a lawful guardian.

A child may of course travel as a passenger. Where an adult books a trip that includes a child, we process only the minimum needed to run the trip — typically a first name and, where seating requires it, an age band — on that adult’s instruction and responsibility.

If you believe a child has given us personal data without a parent’s or guardian’s consent, write to contact@gozevv.in and we will verify and delete it.

We use a small number of service providers who act as Data Processors — they process personal data only on our instructions, under contract, and for no purpose of their own in relation to our data:

• Razorpay Software Private Limited — payment collection, refunds and payment status. Receives the payment amount and the details you enter on their secure page.
• Twilio Inc. — one-time passcodes and transactional SMS or voice verification. Receives your mobile number and the message content.
• Google LLC — maps, place lookup and routing for pickup and drop addresses; and website analytics, but only if you have allowed analytics.
• Hostinger International Ltd — hosting of this website, our forms and our email. Stores the data our forms send.
• Meta Platforms — WhatsApp Business messaging, used to send booking updates and to answer support messages. Receives your mobile number and the message content.
• Our chauffeurs and vehicle partners — receive only the passenger name, mobile number, pickup and drop needed to perform your trip, and nothing else.

We remain accountable to you for what these processors do with your data. Where you deal with one of them directly — for example entering card details on a payment page — their own privacy policy also applies to the data they collect from you there.

Apart from the processors above, we share personal data only where we have to:

• With a court, tribunal, police or regulatory authority, in response to a lawful order or where a law in force in India requires disclosure.
• With our tax authorities, auditors and professional advisers, for invoicing, statutory filings and legal claims.
• To establish, exercise or defend a legal claim, or to prevent or investigate fraud or a safety incident involving a trip.
• If our business is transferred or restructured, to the acquiring entity, which will be bound by this notice.

Where the law allows us to tell you about such a disclosure, we will.

The DPDP Act requires us to take reasonable security safeguards to prevent a personal data breach. The measures currently in place include:

• All traffic to and from gozevv.in is encrypted in transit using HTTPS/TLS.
• Payment credentials are entered on the payment gateway’s own secure page. Full card numbers, CVV, UPI PIN and net-banking credentials never reach our servers and are never stored by us.
• Credentials and keys used by our forms are held in a configuration file outside the public web directory, not in the pages served to your browser.
• Public forms are rate limited, screened for automated submissions and validated on the server before anything is accepted.
• Access to booking and support records is limited to the staff who need it to do their job.
• We review access, remove accounts of people who leave, and require our processors to maintain comparable safeguards under contract.

No system can be guaranteed perfectly secure, and we do not claim otherwise. What we commit to is taking reasonable safeguards, reviewing them, and telling you honestly if something goes wrong.

If a personal data breach occurs, section 8(6) of the DPDP Act requires us to give intimation to the Data Protection Board of India and to each affected Data Principal, in the form and manner prescribed. We will do this without delay on becoming aware of the breach.

Our notice to you will describe, in plain language, the nature and extent of the breach, when it happened, its likely consequences for you, the measures we have taken or propose to take to remedy it and to prevent a recurrence, and what you can do to protect yourself. We will also give you a contact point for questions.

Personal data collected through gozevv.in is stored on servers located in India.

Some of the processors in section 10 — notably Google, Twilio and Meta — are global providers and may process limited personal data on infrastructure outside India in the course of delivering their service to us.

Section 16 of the DPDP Act permits transfer of personal data outside India except to a country or territory that the Central Government restricts by notification. We do not transfer personal data to any country or territory so restricted. If the Central Government notifies a restriction that affects one of our processors, we will change the arrangement to comply.

Where another Indian law imposes a stricter requirement — for example the Reserve Bank of India’s payment data storage directions, which our payment gateway is bound by — that stricter requirement continues to apply on top of this.

If we change this notice we will publish the new version on this page and update the “last updated” date at the top. Where a change materially affects how we use personal data that you gave us with consent, we will ask you again rather than assume the old consent covers it.

The version and date of the choices you made in the privacy panel are recorded, so a change to this notice does not silently carry your old consent forward.

• Data Fiduciary: SourceKode Technologies LLP, operating the GoZevv brand
• Registered address: ZAGA Complex, Senapati Bapat Rd, Shivajinagar, Pune, Maharashtra 411016, India
• GSTIN: 27ACGFS8559J2ZC
• Grievance Officer email: contact@gozevv.in (subject: “DPDP Grievance”)
• General email: contact@gozevv.in
• Phone: +91 84467 81432
• Data Principal rights request form: gozevv.in/legal/data-request/