Privacy Policy
Effective Date: July 16, 2026 | Version 1.0OrderEzee Technologies Private Limited ("OrderEzee", "Company", "we", "our", "us") respects the privacy of every User and is committed to protecting Personal Data entrusted to it. This Privacy Policy ("Policy") applies to the OrderEzee ("Ozie") Web Platform, Mobile Applications, APIs, and connected services.
1. Definitions and Interpretation
1.1 Definitions
- "Account" means the registered user account created on the Platform for accessing the Services.
- "AI Services" means artificial intelligence, machine learning, predictive analytics, recommendation engines, generative AI features, conversational interfaces, automated workflows, and dashboards deployed by OrderEzee.
- "Applicable Law" means all applicable statutes, rules, regulations, notifications, and regulatory directions in force in India, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and all amendments thereto.
- "Business Customer" means any manufacturer, brand owner, distributor, wholesaler, retailer, institution, or commercial entity using the Platform.
- "Consent" means free, specific, informed, unconditional and unambiguous indication by the User signifying agreement to the processing of Personal Data.
- "Data Principal" means the individual to whom Personal Data relates.
- "Personal Data" shall have the meaning assigned under the DPDP Act and includes any data about an identifiable individual processed in digital form.
1.2 Interpretation
Unless the context otherwise requires, the singular includes the plural and vice versa; headings are for convenience only; and references to "including" shall mean "including without limitation."
2. Introduction and Scope
This Privacy Policy explains what information we collect, why we collect it, how we process and secure it, when we share it, and your rights as a Data Principal. This Policy forms an integral part of the Terms of Use, Subscription Agreement, Master Services Agreement, and Vendor Agreements executed with OrderEzee.
3. Applicability of This Policy
This Policy applies to visitors, registered users, manufacturers, distributors, wholesalers, retailers, and any personnel utilizing the Platform regardless of the digital interface used to access it.
4. Eligibility and Children's Privacy
The Platform is primarily intended for commercial use by persons who have attained eighteen (18) years of age. If a person below 18 years seeks to use the Platform, OrderEzee shall process Personal Data only after obtaining verifiable parental consent in accordance with Applicable Law.
5. Privacy Principles
OrderEzee commits to the following foundational data principles: Lawfulness, Transparency, Purpose Limitation, Data Minimization, Accuracy, Storage Limitation, Security Safeguards, and Accountability.
6. Notice of Collection of Personal Data
Before or at the time of collecting Personal Data, OrderEzee provides a clear notice specifying the categories of data collected, lawful purposes of processing, user rights, and the contact details of our Grievance Officer.
7. Categories of Personal Data We Collect
Depending on the Services accessed, we collect Identity, Contact, Business, Transaction, Technical, Usage, and AI Interaction Data, as well as communications and data received from authorized third parties.
8. Purposes of Processing Personal Data
Data is processed for lawful administrative, operational, transactional, security, compliance, analytical, and marketing functions as detailed across our consent frameworks.
9. Consent Framework
Where processing is based on consent, OrderEzee collects affirmative consent through clear electronic interfaces. Users retain the right to withdraw consent at any time, subject to essential operational constraints.
10. AI Services and Automated Processing
AI Services are implemented to assist decisions through predictive metrics and forecasting. AI-generated outputs are probabilistic; Users are responsible for independently verifying outputs before operational reliance. We do not engage in automated decision-making producing significant legal effects without human oversight.
11. Cookies and Similar Technologies
We utilize essential, functional, analytical, and marketing cookies. Users can manage cookie preferences via browser configurations or platform interface panels.
12. Third-Party Services, Integrations and Disclosures
OrderEzee discloses Personal Data to vetted third-party providers (e.g., AWS, payment gateways, accounting platforms) under strict contractual boundaries ensuring equal privacy compliance standards.
13. Cross-Border Transfer of Personal Data
Cross-border transfers are conducted only in compliance with boundaries defined by the government of India under Applicable Law, utilizing standard protective agreements.
14. Information Security
We implement robust technical and organizational security controls (encryption in transit and at rest, firewalls, and role-based access). While we employ advanced protection systems, absolute security cannot be guaranteed.
15. Data Retention
Personal Data is stored strictly as long as necessary for its defined business or statutory purpose. When no longer required, data is deleted, anonymized, or de-identified securely.
16. Rights of Data Principals
Under the DPDP Act, Data Principals possess rights to access, correct, erase, nominate, and file grievances. Requests are fulfilled after appropriate verification checks.
17. Account Deletion and Data Erasure
Users may initiate deletion requests via account settings or directly with the Grievance Officer. OrderEzee erases production-system data while retaining only statutory logs required by law.
18. Business Customer Data, Platform Data and User Responsibilities
Business Customers retain ownership of Customer Data uploaded to the Platform. OrderEzee retains ownership of its platform source code, analytics models, metadata, and security logs.
19. Data Breach Response and Incident Management
In the event of an authenticated security incident, OrderEzee executes immediate containment protocols and issues legal notifications to the Data Protection Board of India (DPBI) and affected users.
20. Grievance Redressal Mechanism
For concerns regarding data privacy, contact our Grievance Officer:
Email: grievances@orderezee.com
Entity: OrderEzee Technologies Private Limited
21. Limitation of Liability and Indemnity
Except where prohibited by law, OrderEzee's aggregate contractual liability under this Policy shall not exceed the subscription fees paid by the respective customer in the 12 months preceding the claim, or INR 10,000, whichever is higher.
22. Amendments, Governing Law and Dispute Resolution
This Policy is governed by Indian law. Disputes not resolved via mutual good-faith negotiations are referred to binding arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996, with seat and venue in New Delhi, India.
23. Miscellaneous
If any part of this Policy is found to be invalid, the remaining parts continue to be valid. No waiver of any terms is effective unless signed in writing by authorized representatives of OrderEzee.
Consent Matrix
This matrix details mandatory versus optional consent modules collected during Registration and Platform execution.
| Activity | Purpose | Type | Withdrawal Permitted |
|---|---|---|---|
| Account Registration | Create and maintain user account | Mandatory | No (requires account deletion) |
| Acceptance of Terms of Use | Contractual formation | Mandatory | No |
| Acceptance of Privacy Policy | Processing of Personal Data | Mandatory | No (requires account deletion) |
| Payment Processing | Subscription and settlements | Mandatory | No |
| WhatsApp Notifications | Order and delivery updates | Optional | Yes |
| Marketing Emails / SMS | Promotional offers and alerts | Optional | Yes |
| AI Recommendations / Analytics | Personalized business insights | Optional | Yes |
| Essential Cookies | Security and session functionality | Mandatory | No |
| Analytics Cookies | Performance improvement tracking | Optional | Yes |
Data Retention Schedule
Subject to statutory changes, we process and retain datasets under these defined periods:
| Category | Retention Baseline Period | Legal / Business Justification |
|---|---|---|
| User Account | Duration of active relationship + 5 years | Limitation Act, 1963 / Legal claim defense |
| Orders, Invoices & Ledger Entries | 8 years | Companies Act, 2013 / Income Tax compliance |
| GST Records | As required by GST provisions | Taxation compliance |
| Customer Support Tickets | 3 years | Quality assurance and disputes |
| Authentication & Access Logs | 2 years | CERT-In Directions / IT Act Security audits |
| Backup Archives | Up to 180 days | Disaster recovery cycles |
Cookie Notice
Our platform uses cookies and localized storage mechanisms. Essential cookies (identifying sessions and validating account logins) are required for platform operability. Functional and analytical cookies (such as measuring application loads) are optional and can be toggled inside your browser settings or directly via the settings panel of Ozie.
Information Security Framework
Our infrastructure operates on a layered security architecture:
- Encryption Controls: Information is encrypted in transit using industry-standard Transport Layer Security (TLS 1.3) and encrypted at rest using AES-256 standards.
- Access Governance: Role-based access control (RBAC) is implemented alongside multi-factor authentication (MFA) across all administrative segments.
- Assessments: Periodic external vulnerability scanning and penetration testing are scheduled to evaluate system configurations.
Data Principal Rights Request Procedure
To exercise rights under the DPDP Act (such as Access, Rectification, or Deletion), Data Principals can follow these steps:
- Step 1 (Submission): Submit a written application to grievances@orderezee.com.
- Step 2 (Verification): Provide the necessary OTP verification or identity documentation to confirm authorized ownership.
- Step 3 (Processing): OrderEzee will assess the request's statutory compliance and process within the timelines listed below.
| Request Type | Acknowledgment | Resolution Window |
|---|---|---|
| Data Correction / Update | Within 3 business days | Within 15 business days |
| Consent Withdrawal | Within 3 business days | Reasonably practicable after verification |
| Account Deletion Request | Within 3 business days | Within 30 business days (subject to statutory retention) |
Categories of Personal Data Processed
The following mapping outlines our specific processing categories:
| Data Category | Examples | Purpose | Legal Basis | Classification |
|---|---|---|---|---|
| Identity Info | Name, Designation | Onboarding & Account Operations | Contract / Consent | Confidential |
| Contact Info | Phone, Email | Communication & Verification | Contract / Consent | Confidential |
| Financial Info | Invoices, Txn IDs | Invoicing & Settlement | Contract / Legal Obligation | Restricted |
| Device Info | IP Address, Device ID | Security & Auditing | Legitimate Interests | Confidential |
Third-Party Sub-Processors
Our current list of cloud providers and software integrations is strictly limited to services facilitating key features:
- Amazon Web Services (AWS): Cloud infrastructure, storage, backup, and disaster recovery.
- Razorpay: Payment processing and subscription invoicing.
- Tally & BUSY: Enterprise integrations for synchronization of accounting data.
- WhatsApp & SMS Providers: Transactional updates, alerts, and OTP communications.
AI Governance & Responsible AI Principles
Our deployment of AI is governed by the following core directives:
- Transparency: Whenever AI tools are used to generate content or compile reports, clear system-generated tags will indicate that the output is automated.
- Security & Privacy: Prompts and documents processed within AI models are insulated within AWS-secured channels and are not used for public model training.
- Prohibited Use Cases: Users are prohibited from using conversational assistant features to generate discriminatory, illegal, or infringing content.
Privacy by Design & Data Governance
OrderEzee integrates privacy directly into our development lifecycle. In alignment with DPDP Act directives, we implement:
- Default Privacy Controls: All non-essential collection mechanisms (such as marketing communication opt-ins) are disabled by default.
- Employee Training: Mandatory periodic privacy and security awareness campaigns are required for all team members handling customer databases.
- Privacy Impact Assessments (PIA): Any engineering update or new software integration altering data pipelines is audited beforehand by security personnel.