Privacy Policy

Condivio Technology LLP (“Condivio”)

1. Introduction to Condivio’s Commitment to Your Privacy

Welcome to Condivio.

We are a pioneering platform dedicated to revolutionizing the way individuals find compatible flatmates and connect rental seekers with property owners. Condivio ("we," "our," or "us") is deeply committed to upholding the highest standards of privacy and data protection for all our users. This comprehensive Privacy Policy meticulously details how we collect, utilize, disclose, and safeguard your personal data as you interact with the Condivio platform ("Platform"). Our Platform uniquely (i) facilitates sophisticated flatmate and roommate matching services and (ii) seamlessly connects rental seekers ("Rentees") with property owners, managers, or their authorized representatives ("Listers") across India, the European Union ("EU"), and the United States ("US") under various rental agreements, including Leave and License arrangements in India. This Policy is universally applicable to all users and visitors, irrespective of their geographical location, recognizing that additional specific rights and obligations may apply based on your country or region of residence.

2. Scope and Applicability: Navigating Global Data Protection Landscapes

This Policy serves as the definitive framework governing all personal data processing activities conducted through our website, mobile applications, and ancillary services. We are steadfast in our commitment to compliance with leading global data protection regulations:

• India: We adhere strictly to the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act), ensuring robust protection for Indian users.
• European Union: Our practices are fully aligned with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and all pertinent member state specific data protection laws, safeguarding the rights of our EU users.
• United States: We comply with relevant state laws, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and other emerging state-specific privacy legislations.

Should you be located outside these primary regions, your information may be transferred, stored, and processed globally. Rest assured, all such international transfers are undertaken with appropriate legal and technical safeguards in place to ensure your data remains protected to a standard equivalent to that mandated by the aforementioned regulations.

3. Types of Data We Collect: A Comprehensive Overview of Information Gathering

To provide our multifaceted services, we collect various categories of personal data, each serving a specific purpose:

• Account Information: This includes your full name, preferred email address, contact phone number, date of birth, and a profile picture to personalize your user experience and facilitate identification within the community.
• Identity Verification (KYC - Know Your Customer):For the safety and security of all users and to comply with legal obligations, we may collect government-issued identification numbers (e.g., Aadhaar, PAN, passport details in India; national ID cards, driver’s licenses in the EU/US), selfies for liveness detection, and copies of other Know Your Customer (KYC) documents as required by local regulations.
• Property & Listing Details: For Listers, this encompasses precise property addresses, detailed rental terms, availability schedules, specific rent amounts, and comprehensive descriptions of the property and its features.
• Rental Preferences: Rentees provide information regarding their desired location, budget constraints, preferred occupancy type (e.g., single, couple), and a list of desired amenities.
• Payment Information: While we do not directly store sensitive financial details, we facilitate secure transactions by collecting necessary payment identifiers such as UPI IDs, bank account details, and credit/debit card information. These are securely processed through PCI-DSS compliant third-party payment gateways.
• Device & Usage Data: We automatically collect technical information, including your IP address, unique device identifiers, browser type and operating system, access times, and a record of pages viewed and features utilized on our Platform.
• Location Data: With your explicit consent, we may collect approximate or precise geographical location data from your device to help you find nearby properties or flatmates.
• Communication Data: Records of all interactions, including messages exchanged on the Platform, support requests, feedback submissions, and emails sent to us.
• Bookings & Transactions History: Details pertaining to your booking history, payment records, cancellations, and other transactional interactions on the Platform.
• Reviews & Ratings: User-generated content in the form of reviews and ratings for properties, Listers, and Rentees, contributing to community trust and transparency.
• Emergency/Alternate Contacts: In specific circumstances, and with your explicit consent, we may request emergency or alternate contact details for safety and security purposes.
• Inferred Preferences: Based on your search history, saved listings, and interactions, we infer preferences to offer a more personalized and relevant experience.
• Third-Party Data: With your explicit consent, we may collect data from third-party services for purposes such as background checks, referrals, or enhanced KYC procedures.

4. Purposes & Legal Bases for Processing Your Data: A Framework of Justification

Our data processing activities are underpinned by clearly defined purposes and robust legal bases, varying according to your jurisdiction:

• Consent: Where required, we obtain your explicit consent before processing your data. You have the right to withdraw consent at any time.
• Contract: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract (e.g., providing our services).
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (e.g., KYC checks, tax reporting).
• Legitimate Interest: Processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your fundamental rights and freedoms (e.g., improving services, security).
• Business Purpose (US):For US users, processing may be for various "business purposes" as defined under relevant state privacy laws, such as auditing, security, debugging, providing services, performing internal research, or undertaking activities to verify or maintain the quality or safety of a service or device.

5. Your Rights: Empowering You with Control Over Your Data

Condivio recognizes and respects your fundamental data protection rights. Depending on your country or region of residence, you may be entitled to exercise the following rights:

• Right to Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and specific information regarding its processing.
• Right to Correction/Rectification: You can request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
• Right to Erasure ("Right to Be Forgotten"): You have the right to request the deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent and there is no other legal ground for processing), subject to overriding legal exceptions.
• Right to Restriction of Processing: You may request the restriction of processing of your personal data under specific conditions (e.g., if you contest the accuracy of the data, for a period enabling us to verify its accuracy).
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Opt-Out (US Specific):Under CCPA/CPRA and similar US state laws, you have the right to opt-out of the "sale" or "sharing" of your personal data, if applicable. Condivio does not sell your personal data in the traditional sense.
• Right to Non-Discrimination (US Specific): You have the right not to receive discriminatory treatment for exercising your privacy rights under US state laws.
• Right to Lodge Complaints: You have the right to lodge a complaint with your relevant data protection authority or supervisory authority if you believe your rights have been violated.

To exercise any of these rights, please contact us promptly at [Insert Email]. We are committed to responding to your requests in accordance with applicable laws.

6. Data Sharing: Facilitating Services While Upholding Privacy

Condivio maintains a strict policy: we do not sell your personal data. We share your data only when necessary to provide our services, comply with legal obligations, or with your explicit consent, and always under robust contractual safeguards:

• Other Users: To facilitate rental arrangements, essential information (e.g., profile name, preferences, property details) is shared between Rentees and Listers.
• Service Providers: We engage trusted third-party service providers who assist us with critical functions such as payment processing, data analytics, cloud hosting, customer support, identity verification (KYC), insurance services, and marketing communications. These providers are contractually bound to process your data only for specified purposes and to implement appropriate security measures.
• Affiliates and Partners: Your data may be shared with our corporate affiliates or strategic partners to support our operations, enhance our services, or for joint ventures, always under strict confidentiality agreements.
• Legal & Regulatory Authorities: We may disclose your data to governmental, regulatory, or law enforcement authorities if required by law (e.g., in response to a subpoena, court order, or governmental request) or if we believe such action is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.
• Business Transfers: In the event of a merger, acquisition, asset sale, or other corporate restructuring, your personal data may be transferred to the acquiring entity or successor in interest, subject to the terms of this Privacy Policy.

All third parties with whom we share your data are rigorously vetted and are contractually obligated to protect your personal data in accordance with our standards and applicable laws.

7. International Transfers: Ensuring Data Protection Across Borders

As a global platform, your personal data may be transferred, stored, and processed in locations outside your country of residence, including India, the EU, the US, or other regions where our service providers operate. We ensure that such transfers are conducted in compliance with relevant data protection laws:

• India:Transfers are permitted to countries not deemed "restricted" under the DPDP Act.
• European Union: Transfers outside the European Economic Area (EEA) are only conducted to countries deemed by the European Commission to provide an adequate level of data protection, or where appropriate legal safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or Binding Corporate Rules (BCRs).
• United States: We ensure that any cross-border data flows are transparent, securely managed, and comply with applicable US state laws regarding international transfers and security measures.

We implement robust technical and organizational measures to protect your data during international transfers.

8. Cookies & Tracking Technologies: Enhancing User Experience

We utilize cookies, pixel tags, web beacons, and similar tracking technologies to enhance your experience, analyze platform usage, and deliver personalized content:

• Authentication and Preferences:Cookies help us recognize you when you return to our Platform, remembering your preferences and settings (e.g., language, region) so you don’t have to re-enter them on subsequent visits.
• Usage Analysis: We use tracking technologies to understand how users interact with our Platform, identifying popular pages, user flows, and areas for improvement. This helps us optimize our services.
• Personalized Content and Advertisements: These technologies enable us to deliver content and advertisements that are more relevant to your interests, both on and off our Platform.

You have control over these technologies. Most web browsers allow you to manage your cookie preferences through their settings. You can typically set your browser to refuse all cookies, or to indicate when a cookie is being sent. You can also manage cookie preferences through your Condivio account settings. Please note that disabling certain cookies may limit the functionality of some features on our Platform.

9. Data Security: Our Unwavering Commitment to Protecting Your Information

The security of your personal data is paramount to Condivio. We employ a multi-layered approach to protect your information from unauthorized access, disclosure, alteration, and destruction:

• Encryption: We use industry-standard encryption protocols (e.g., TLS/SSL) for data in transit and robust encryption for data at rest, safeguarding your information during transmission and storage.
• Access Controls & Permissions: Strict access controls and role-based permissions are implemented to ensure that only authorized personnel have access to personal data, and only to the extent necessary for their job functions.
• Regular Audits & Penetration Testing: We conduct regular security audits and engage third-party experts to perform penetration testing to identify and remediate potential vulnerabilities in our systems.
• Employee Privacy & Security Training: All Condivio employees undergo mandatory and regular training on data privacy principles and security best practices to foster a culture of vigilance.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.

10. Data Retention: Strategic Management of Your Information Lifecycle

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our retention periods are carefully determined based on the type of data, the purpose of processing, and applicable legal obligations:

• Account and KYC Information: Retained for the duration of your active account, plus a period of up to 7 years post-account closure, to comply with legal, regulatory, and audit obligations.
• Transaction Records: Financial transaction data is retained for a minimum of 7 years to meet accounting, tax, and anti-money laundering compliance requirements.
• Support Communications: Records of customer support interactions are typically retained for up to 3 years post-resolution of the query, to maintain service quality and address potential disputes.
• Marketing Preferences: Retained until you withdraw your consent or delete your account, whichever comes first.
• Analytics Data (Anonymized): Anonymized or aggregated data, which cannot identify you personally, may be retained indefinitely for long-term service improvement and statistical analysis.

Once data is no longer necessary, it is securely deleted or irreversibly anonymized to prevent identification.

11. Children’s Privacy: Protecting Our Younger Users

Condivio’s Platform is explicitly designed for and directed towards individuals who are 18 years of age or older. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under the age of 18, we will take immediate steps to delete that information from our servers. If you believe a minor has provided us with personal data, please contact us immediately at [Insert Email].

12. Dispute Resolution: Addressing Your Concerns

Should you have any questions, concerns, or complaints regarding our privacy practices or this Policy, we encourage you to contact our designated Grievance Redressal Officer/Customer Care at [Insert Email]. We are committed to addressing your concerns promptly and amicably.

If your issue remains unresolved after contacting us, you may have the right to lodge a complaint with your local data protection authority or supervisory authority. In certain jurisdictions, and as outlined in our Terms of Service, disputes may also be subject to binding arbitration.

13. Contact Information: Your Direct Line to Condivio Privacy Team

For all privacy-related inquiries, requests to exercise your rights, or to report a concern, please use the following contact details:

Grievance Redressal Officer/Customer Care:
Name: [Insert Name]
Email: [Insert Email]
Phone: [Insert Phone]

14. Policy Updates: Staying Informed

Condivio reserves the right to update or modify this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements. Any updates will be prominently posted on this page with a revised "Effective Date." For material changes that significantly impact your rights or how we process your personal data, we will endeavor to provide you with more prominent notice, such as via email, in-app notification, or other appropriate means. Where legally required, we will seek your fresh consent for such material changes. We encourage you to review this Policy regularly to stay informed about how we are protecting your information.