1. Overview

PropDROP ("we", "us", or "our") is India's zero-brokerage housing marketplace connecting tenants, property owners, and flatmates. We are committed to protecting your personal data and operating in full compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and all applicable Indian laws. By registering or using PropDROP, you ("Data Principal") consent to the collection and processing of your personal data as described in this Privacy Policy.

2. What Data We Collect

3. How We Use Your Data

• •To create and manage your account and verify your identity
• •To display property listings and connect tenants with owners
• •To process rent payments and generate verified digital rent receipts for HRA claims
• •To facilitate digital KYC, move-in paperwork, and tenancy management
• •To send transactional notifications (rent reminders, maintenance updates, food menus)
• •To resolve complaints, improve platform safety, and detect fraud
• •To comply with legal obligations under Indian law
• •To send platform updates and promotional communications (you may opt out at any time)

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following bases: Consent — You provide explicit consent at sign-up via the mandatory consent checkbox. You may withdraw consent at any time, though this may affect your ability to use the platform. Contract — Processing necessary to fulfil our service agreement with you (e.g., rent collection, receipts). Legal Obligation — Processing required by applicable Indian law (e.g., KYC for regulated transactions). Legitimate Interest — Fraud detection, platform security, and service improvement, balanced against your rights.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only in the following limited circumstances:

• •Between Users: Tenant contact details (name, phone) are shared with property owners only after a confirmed booking; owner contact details are shared with prospective tenants to enable direct contact
• •AWS (Amazon Web Services): Authentication via Amazon Cognito and cloud infrastructure for data storage; AWS is bound by data processing agreements
• •Payment Gateways: Financial data is shared with RBI-regulated payment processors only to the extent necessary to complete transactions
• •Legal Requirements: We may disclose data when required by court order, government authority, or to protect the rights and safety of users
• •Business Transfer: In the event of a merger or acquisition, your data may be transferred to the successor entity with prior notice to you

6. KYC & Sensitive Personal Data

When you initiate a digital move-in or tenancy agreement, we collect government-issued identity documents (Aadhaar, PAN, etc.) for KYC verification. This is treated as Sensitive Personal Data under applicable law. Encryption: All KYC documents are encrypted at rest and in transit using AES-256 and TLS 1.2+. Access Control: KYC data is accessible only to authorised personnel and the parties directly involved in your tenancy. Retention: KYC documents are retained for the duration of your tenancy plus 2 years thereafter, then securely deleted. Aadhaar: We comply with all UIDAI guidelines and do not store Aadhaar numbers in raw form.

7. Data Retention

• •Account data is retained for as long as your account is active
• •Rent receipts and financial records are retained for 7 years as required by the Income Tax Act, 1961
• •KYC documents are retained for the tenancy period plus 2 years, then permanently deleted
• •Usage/analytics data is retained for up to 24 months in anonymised form
• •You may request deletion of your account and associated data at any time (see Section 8)

8. Your Rights (DPDP Act 2023)

As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights:

• •Right to Access — Request a summary of personal data we hold about you
• •Right to Correction — Request correction of inaccurate or incomplete data
• •Right to Erasure — Request deletion of your personal data, subject to legal retention requirements
• •Right to Grievance Redressal — Lodge a complaint with our Grievance Officer (see Section 11)
• •Right to Nominate — Nominate a person to exercise your rights in the event of your death or incapacity
• •Right to Withdraw Consent — Withdraw consent at any time; withdrawal does not affect prior lawful processing

To exercise any of these rights, email us at privacy@propdrop.in. We will respond within 30 days of receiving your verified request.

9. Cookies & Tracking

We use strictly necessary cookies (e.g., session authentication, role-based routing) and optional analytics cookies to understand platform usage. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair platform functionality.

10. Children's Privacy

PropDROP is intended for users aged 18 and above. We do not knowingly collect personal data from minors. If we become aware that data has been collected from a person under 18, we will delete it immediately. If you believe a minor has registered, please contact us at privacy@propdrop.in.

11. Grievance Officer

In accordance with the Information Technology Act 2000 and the DPDP Act 2023, we have appointed a Grievance Officer: Grievance Officer, PropDROP Email: grievance@propdrop.in Response time: Within 30 days of receipt of complaint If you are unsatisfied with our response, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app banner at least 7 days before they take effect. Continued use of PropDROP after the effective date constitutes acceptance of the updated policy.