Privacy Policy
Last updated: September 1, 2026
Contents
CarUniv (“CarUniv”, “we”, “our”, “us”) is the Data Fiduciary in respect of personal data collected through www.caruniv.in and related services (the “Platform”). This Privacy Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules made thereunder, and, to the extent applicable, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It explains what personal data we collect, why, how it is used and shared, and the rights available to you as a Data Principal. This is a template drafted for review by a qualified Indian counsel before publication. Bracketed [placeholders] must be completed with CarUniv’s actual operating details.
1. Definitions
- “Data Principal” means the individual to whom the personal data relates (e.g., a website visitor, enquirer, or client contact).
- “Data Fiduciary” means CarUniv, which determines the purpose and means of processing personal data.
- “Data Processor” means any person who processes personal data on behalf of CarUniv (e.g., a hosting or CRM provider).
- “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
- “Processing” means any operation performed on personal data, including collection, storage, use, sharing, and erasure.
- “Consent” means the free, specific, informed, unconditional, and unambiguous indication of the Data Principal’s wishes, given through clear affirmative action.
2. Personal Data We Collect
We collect personal data that you voluntarily provide, and limited technical data collected automatically.
2.1 Information you provide
- Name and business/entity name
- Phone number and email address
- Business location and website details
- Details of your workshop, detailing studio, or used-car business
- Marketing requirements and business goals shared during enquiries or growth-audit requests
- Any information you submit through contact forms, lead-capture forms, or in correspondence with us
2.2 Information collected automatically
- IP address, browser type and version, and device information
- Website usage data (pages visited, time spent, referral source)
- Cookies and similar tracking technologies (see Section 6)
We do not intentionally collect any Sensitive Personal Data or Information (as defined under the SPDI Rules, 2011), such as financial account details, health data, biometric data, or passwords, through the Platform. Please do not submit such information through our forms.
3. Purpose and Legal Basis for Processing
Under the DPDP Act, we process your personal data on the basis of your consent, or where processing is for a “legitimate use” recognised under the Act (for example, where you have voluntarily provided data for a specific purpose and processing is necessary for that purpose, or to comply with a legal obligation). We use personal data to:
- Respond to enquiries and consultation or growth-audit requests
- Provide our digital marketing and automotive growth services
- Develop and execute marketing strategies, including managing Google Business Profiles, social media, advertising campaigns, microsites, and lead-generation activities
- Communicate with you about our services, including service updates and support
- Analyse campaign performance and improve our services and Platform
- Maintain business and statutory records
- Comply with applicable legal, tax, and regulatory requirements We do not sell your personal data to third parties.
4. Consent and Withdrawal
Where we rely on your consent, we will seek it through a clear notice specifying the personal data to be collected and the purpose of processing, in accordance with Section 6 of the DPDP Act. You may withdraw your consent at any time, with effect for future processing, by writing to our Grievance Officer at the contact details in Section 12. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to continue providing certain services to you.
5. Sharing and Disclosure of Personal Data
We may share personal data with trusted service providers and technology platforms strictly where necessary to deliver our services, including advertising, analytics, website hosting, social media, and communication platforms. Such Data Processors are engaged under contractual obligations to process personal data only as instructed by us and to implement appropriate security safeguards. We may also disclose personal data where required to comply with an applicable law, a court order, or a lawful direction of a government or regulatory authority in India. 5.1 Cross-border transfer Personal data may be processed on servers or by service providers located outside India. Except where the Central Government restricts transfer to specific countries or territories by notification under the DPDP Act, we may transfer personal data outside India, subject to appropriate contractual and security safeguards with the recipient.
6. Cookies, Analytics, and Advertising
CarUniv may use cookies, analytics tools, pixels, and similar technologies on the Platform to understand website traffic, measure marketing performance, improve user experience, and support advertising campaigns. Third-party advertising and analytics platforms may independently collect information in accordance with their own privacy policies and settings. You may manage or disable cookies through your browser settings; doing so may affect certain Platform features.
7. Data Security
We implement reasonable security safeguards — technical, organisational, and administrative — that are appropriate to the personal data we hold, in line with our obligations under Section 8(5) of the DPDP Act and the SPDI Rules, 2011, to protect against unauthorised access, misuse, alteration, disclosure, or destruction of personal data. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.
8. Data Retention
We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, maintain business records, resolve disputes, comply with legal and regulatory obligations, and enforce our agreements. Where you withdraw consent or your data is no longer required, and we are not otherwise required or permitted by law to retain it, we will erase the personal data and direct our Data Processors to do the same, in accordance with Section 8(7) of the DPDP Act.
9. Your Rights as a Data Principal
Subject to the DPDP Act and applicable rules, you have the right to:
- Obtain a summary of the personal data we hold about you and the processing activities undertaken (Right to Access)
- Request correction, completion, and updating of your personal data (Right to Correction) Request erasure of your personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations (Right to Erasure)
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity (Right to Nominate)
- Have readily available means to register a grievance with us (Right to Grievance Redressal)
To exercise any of these rights, please contact our Grievance Officer using the details in Section 12. We will endeavour to respond to and resolve your request within the timelines prescribed under the DPDP Act and rules made thereunder.
10. Data Breach Notification
In the event of a personal data breach, we will take prompt remedial steps and notify the Data Protection Board of India and affected Data Principals, where required, in the manner and within the timelines prescribed under the DPDP Act and rules made thereunder.
11. Children’s Privacy
Our services are directed at businesses and business owners, not individuals. We do not knowingly collect personal data from children (individuals under 18 years of age). If we become aware that we have inadvertently collected personal data from a child without verifiable parental or guardian consent, we will take steps to delete such data
12. Grievance Officer
In accordance with the DPDP Act and the Information Technology Act, 2000, we have designated a Grievance Officer to address your queries, complaints, or grievances relating to the processing of your personal data:
- Name: Shivani Dubey
- Designation: Grievance Officer, CarUniv
- Email: Shivani@caruniv.in
- Phone: +91 70427 11006
- Address: 6th floor, Galaxy Blue Sapphire Plaza Greater Noida West, Uttra Pradesh
We will acknowledge and address grievances within the timelines prescribed under applicable law. If you remain dissatisfied with our response, you may file a complaint with the Data Protection Board of India, once constituted and operational.
13. Third-Party Links
The Platform may contain links to third-party websites, platforms, or services. CarUniv is not responsible for the privacy practices, content, or security of such third-party sites. We recommend reviewing the privacy policies of any third-party service before sharing your personal data with them.
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our services, technology, legal requirements, or business practices. The updated version will be published on this page with a revised “Last updated” date. We encourage you to review this Policy periodically.
15. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights as a Data Principal, please contact us at: CarUniv
Website: www.caruniv.in
Phone: +91 70427 11006
Email: hello@caruniv.in
Address: 6th floor, Galaxy Blue Sapphire Plaza Greater Noida West, Uttra Pradesh