Privacy Policy

Vahnam is an online marketplace that connects buyers, individual sellers, and dealers of vehicles, and that may facilitate related services such as vehicle listings, enquiries, inspections, valuations, test drives, and referrals to financing and insurance partners.

We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) in respect of the personal data we determine the purpose and means of processing. Where we process personal data on behalf of another party, we act as a Data Processor.

By using the Platform, you acknowledge that you have read and understood this Policy. Where the law requires your consent, we will obtain it separately as described below; your continued use of the Platform is not, by itself, treated as consent for purposes that require explicit consent under the DPDP Act.

• Personal data means any data about an individual who is identifiable by or in relation to such data.
• Data Principal means the individual to whom the personal data relates (i.e., you). Where the individual is a child, it includes the parent or lawful guardian; where the individual is a person with disability, it includes their lawful guardian.
• Processing means any operation performed on personal data, including collection, storage, use, sharing, and erasure.
• Consent Manager means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.

This Policy applies to Data Principals in India and to the processing of personal data within India; and outside India, where the processing is in connection with offering goods or services to Data Principals within India.

This Policy does not apply to (a) personal data that you make or cause to be made publicly available yourself; or (b) third-party websites, applications, or services that are linked from the Platform but not operated by us. We encourage you to read the privacy policies of those third parties.

We collect the following categories of personal data. The specific items collected depend on how you use the Platform and which services you request.

3.1 Information you provide to us

• Identity and contact data: name, mobile number, email address, postal address, city/PIN code, and (where required for a specific service such as KYC, financing, or ownership transfer) date of birth, government-issued identifiers, and photographs.
• Account data: username, password (stored in hashed form), profile preferences, and communication settings.
• Vehicle data: for listings and enquiries — registration number, make, model, variant, year, mileage/odometer reading, ownership history, service and accident history, insurance status, and, where required, VIN/chassis and engine details and ownership documents.
• Transaction and enquiry data: vehicles viewed, shortlisted, or enquired about; test-drive and inspection requests; messages exchanged through the Platform; and details of any paid services you purchase.
• Financing and insurance data: information you submit to obtain a quote or referral, which we share only with the partner(s) you choose (see Section 6).
• Support and communications data: the content of your correspondence with us, including calls, emails, chat, and WhatsApp messages.

3.2 Information we collect automatically

• Device and technical data: IP address, device identifiers, browser type, operating system, app version, and crash logs.
• Usage data: pages and listings viewed, searches run, clicks, features used, and time spent, collected through cookies and similar technologies (see Section 9).
• Location data: approximate location derived from your IP address, and — only with your permission — precise GPS location, for purposes such as showing nearby vehicles, dealers, or inspection centres.

3.3 Information from third parties

• Dealers and partners (e.g., inspection or valuation partners) who submit information in connection with a listing or service you engage with.
• Third-party sources for fraud prevention, identity verification, and vehicle-history checks, to the extent permitted by law.

3.4 Children’s data

The Platform is intended for users aged 18 and above. We do not knowingly process the personal data of children (persons under 18) except through a parent or lawful guardian and with verifiable consent of that parent or guardian as required by the DPDP Act. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe we have collected a child’s data without the required consent, contact our Grievance Officer (Section 12) and we will delete it.

We process your personal data for the following purposes. Where the DPDP Act requires consent, we rely on your consent; where the law permits processing for certain legitimate uses (such as complying with law or responding to your voluntarily provided information for a requested service), we rely on those grounds.

We will not use your personal data for a new purpose that is incompatible with the above without providing you a fresh notice and, where required, obtaining fresh consent.

5.1 Notice. When we seek your consent, we provide a clear, itemised notice describing the personal data to be collected, the specific purpose, how you may exercise your rights, how you may withdraw consent, and how you may complain to the Data Protection Board of India. Our consent notices are made available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India.

5.2 Withdrawal of consent. You may withdraw your consent at any time, and doing so will be as easy as giving it. You can withdraw consent through your account settings, by using the opt-out mechanism in any marketing communication, through a registered Consent Manager (once operational), or by contacting our Grievance Officer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent necessary for a particular service, we may be unable to continue providing that service.

5.3 Consent Managers. Once the Consent Manager framework is operational, you may give, manage, review, and withdraw your consent through a Consent Manager registered with the Data Protection Board.

We do not sell your personal data. We do not disclose your personal data to third parties for their independent marketing without your consent. We share personal data only as described below:

• Sellers and dealers: When you make an enquiry, request a test drive, or express interest in a vehicle, we share the information reasonably necessary (such as your name and contact number) with the relevant seller or dealer so they can respond. Sellers and dealers are independently responsible for their handling of your data.
• Service partners (Data Processors): Inspection, valuation, logistics, cloud hosting, communication (SMS/email/WhatsApp), analytics, payment gateway, and customer-support vendors who process data on our behalf under contractual obligations to protect it and use it only for the purposes we specify.
• Financing and insurance partners: Only where you request a quote or referral, and only with the partner(s) you select. Those partners make independent lending/underwriting decisions and act as separate Data Fiduciaries.
• Corporate affiliates: Entities within the Barodynamics group, for the purposes described in this Policy, under equivalent safeguards.
• Legal and safety: Government authorities, regulators, courts, or law-enforcement where required by law, to enforce our Terms, or to protect the rights, safety, and property of Vahnam, our users, or the public.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to the recipient honouring this Policy.

We primarily store and process personal data in India. Where personal data is transferred to or processed in a country outside India, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government, and we require recipients to maintain appropriate safeguards.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide the services you request, and to comply with legal, accounting, tax, or regulatory obligations. When personal data is no longer necessary and there is no legal requirement to retain it, we will erase it or anonymise it. If your account is inactive and retention is no longer required under law, we will erase the associated personal data in accordance with the DPDP Rules.

We use cookies, SDKs, pixels, and similar technologies to keep you logged in, remember preferences, measure performance, run analytics, prevent fraud, and (with your consent) personalise content and advertising. You can manage non-essential cookies through our cookie preferences tool and your browser or device settings. Disabling certain cookies may affect the functionality of the Platform.

We implement reasonable technical and organisational security safeguards to protect personal data against unauthorised access, disclosure, alteration, and loss, including encryption in transit, access controls, logging and monitoring, and periodic review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

Personal data breach. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required by the DPDP Rules, including a description of the breach, its likely consequences, and the measures taken to mitigate it.

Subject to the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities.
• Correction and updating — correct inaccurate or misleading data and complete or update your data.
• Erasure — request erasure of your personal data where retention is no longer necessary or permitted.
• Grievance redressal — have your grievances addressed by us (Section 12).
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise these rights, use the tools in your account settings or contact our Grievance Officer. We may need to verify your identity before acting on a request. We will respond within the timelines prescribed under the DPDP Rules. You also have the right to complain to the Data Protection Board of India if you are not satisfied with our response.

Your duties. Under the DPDP Act, you must not impersonate another person, suppress material information where required, or file false or frivolous complaints, and you must furnish only verifiably authentic information.

If you have questions, concerns, or complaints about this Policy or our handling of your personal data, contact:

We will acknowledge and respond to grievances within the timelines required by law.

We may update this Policy from time to time. When we make material changes, we will notify you through the Platform or by other reasonable means and update the “Last updated” date above. Your continued use of the Platform after the changes take effect constitutes acknowledgement of the updated Policy, subject to any consent we are required to obtain afresh.