Legal Center

Policies & Legal Guidelines

Comprehensive, professionally drafted policies compliant with Indian law — DPDPA 2023, Consumer Protection Act 2019, RBI guidelines, and more.

Privacy Policy

Effective Date: May 16, 2026 Last Updated: July 13, 2026 Version: 4.0

PREAMBLE

This Privacy Policy ("Policy") is an electronic document published in accordance with Rule 3(1) of the Information Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 43A of the Information Technology Act, 2000 ("IT Act"), and constitutes a legally binding agreement between AdiFay Infotech Private Limited (CIN: U62011RJ2026PTC114388) ("Company", "we", "us", "our") and any person who accesses, registers upon, or uses the VaahanTax mobile application ("App", "Platform").

AdiFay Infotech Private Limited is a company incorporated under the Companies Act, 2013, with its Registered Office at Shop No R-35, Ganpati Plaza, Bhiwadi, Rajasthan - 301019, India.

This Policy must be read in conjunction with our Terms and Conditions. By accessing or using the App, you expressly consent to the collection, use, storage, and disclosure of your personal data as described herein.

PART I: LEGAL FRAMEWORK

1. Governing Legislation

This Policy is published in strict compliance with the following statutes and regulations:

Primary Legislation:

  • Digital Personal Data Protection Act, 2023 (DPDPA) — The principal data protection legislation in India, which recognizes the right to privacy of individuals and prescribes obligations on Data Fiduciaries.
  • Information Technology Act, 2000 (IT Act) — Sections 43A, 66, 66C, 72, and 72A govern data protection, computer offences, breach of confidentiality, and unauthorized disclosure.
  • Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) — Prescribes specific obligations on body corporates handling sensitive personal data.

Supporting Regulations:

  • Information Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021 — Rule 3(1)(b) mandates intermediaries to publish their privacy policy.
  • Reserve Bank of India (RBI) Master Direction on Digital Payment Security Controls, 2021 — Governs security standards for payment data.
  • RBI Circular on Storage of Payment System Data (2018) — Mandates storage of all payment data within India.
  • Payment and Settlement Systems Act, 2007 — Governs payment systems and security obligations.
  • Google Play Developer Program Policies (2024) — Applicable to Apps distributed through Google Play Store.
  • Apple App Store Review Guidelines (Section 5.1 - Privacy) — Applicable to Apps distributed through Apple App Store.

Constitutional Basis: The right to privacy in India is constitutionally guaranteed as a fundamental right under Article 21 of the Constitution of India, as affirmed by the Supreme Court in the landmark nine-judge bench judgment: Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 SCC 1. This Policy acknowledges and respects this constitutional right.

PART II: DATA FIDUCIARY INFORMATION

2. Identity of Data Fiduciary

Under the DPDPA 2023, AdiFay Infotech Private Limited is the "Data Fiduciary" — the entity that determines the purpose and means of processing your personal data.

| Detail | Information | |--------|-------------| | Entity Name | AdiFay Infotech Private Limited | | CIN | U62011RJ2026PTC114388 | | Incorporation Date | May 16, 2026 | | Registered Office | Shop No R-35, Ganpati Plaza, Bhiwadi, Rajasthan - 301019, India | | Principal Business | Computer Programming, Software Development, Logistics Consultancy (NIC: 62011) | | Email | support@vaahantax.com | | Grievance Officer Email | support@vaahantax.com | | Support Hours | 24/7 Operator Assistance |

PART III: PERSONAL DATA COLLECTION

3. Categories of Personal Data Collected

We collect personal data under the framework established by Schedule I of the SPDI Rules, 2011 and the DPDPA 2023. The categories are:

3.1 Personal Data You Provide Voluntarily

Identity and Contact Information (Mandatory):

  • Full legal name and date of birth
  • Mobile phone number (used for OTP-based authentication per RBI 2FA mandate)
  • Email address

Vehicle and Compliance Information (Mandatory for Service Delivery):

  • Vehicle Registration Number (VRN)
  • Vehicle category (LMV, HMV, commercial, tourist, etc.)
  • Vehicle specifications (seating capacity, fuel type, engine capacity)
  • Chassis number and engine number (for permit applications)

Document Uploads (User-Controlled):

  • Registration Certificate (RC) — issued under Section 41 of the Motor Vehicles Act, 1988
  • Insurance Policy Certificate — mandatory under Section 146 of the Motor Vehicles Act, 1988
  • Pollution Under Control (PUC) Certificate — required under Rule 115 of the Central Motor Vehicles Rules, 1989
  • Fitness Certificate — issued under Section 56 of the Motor Vehicles Act, 1988
  • National Permit — granted under Section 88 of the Motor Vehicles Act, 1988
  • Any other compliance document uploaded at your discretion

Payment Reference Information (Transaction Records Only):

  • Razorpay Order ID and Payment ID
  • Transaction amount and status
  • Order reference numbers

IMPORTANT: We do NOT collect, store, or process credit card numbers, debit card numbers, CVV, PINs, net banking credentials, or UPI PINs. All such sensitive financial data is handled exclusively by Razorpay Software Private Limited, our PCI-DSS Level 1 certified Payment Aggregator, under their separate privacy framework.

Communication Records:

  • Support queries, messages, and feedback submitted through the App or email

3.2 Data Collected Automatically

  • Device Identifiers: Device model, OS version, app version number
  • Usage Analytics: Feature usage frequency, session duration, navigation patterns (anonymized)
  • Log Data: Server-side access logs including IP address, timestamps, API response codes

We do NOT collect real-time GPS location data. Any geographic reference is limited to the state/region selected by you for service processing.

3.3 Sensitive Personal Data or Information (SPDI)

Under Rule 3 of the SPDI Rules, 2011, certain categories constitute "sensitive personal data." The following categories, if collected, are treated with heightened protection:

  • Biometric data (if collected for future identity verification features)
  • Financial information to the extent of transaction records

PART IV: LAWFUL BASIS AND PURPOSE OF PROCESSING

4. Legal Basis for Processing

We process your personal data on the following lawful bases under Section 4 of the DPDPA 2023:

| Lawful Basis | Examples | |--------------|----------| | Consent (Section 6, DPDPA 2023) | Registration, document upload, marketing communications | | Legitimate Uses (Section 7, DPDPA 2023) | Service delivery, payment processing, legal compliance | | Legal Obligation | Tax records, court orders, government directives | | Vital Interests | Emergency situations requiring processing to protect life |

5. Specific Purposes of Processing

| Purpose | Legal Basis | Data Categories Used | |---------|-------------|---------------------| | User account creation and authentication | Consent | Identity, Contact | | Processing border tax payments on Parivahan portal | Legitimate Use | Vehicle, Identity | | Processing challan payments on e-Challan portal | Legitimate Use | Vehicle, Identity | | Uploading official VAHAN receipts to your account | Legitimate Use | Vehicle, Transaction | | Document expiry monitoring and alerts | Consent | Document Data | | Payment processing via Razorpay | Legitimate Use | Transaction Reference | | GST invoice generation (per GST Act, 2017) | Legal Obligation | Identity, Transaction | | Customer support and grievance resolution | Legitimate Use | Communication | | Fraud detection and prevention | Legitimate Use | All categories | | Compliance with court orders or government directions | Legal Obligation | As directed | | Tax record maintenance (8 years, per Income Tax Act, 1961) | Legal Obligation | Transaction Records |

PART V: DATA SHARING AND DISCLOSURE

6. Third-Party Disclosure

We share your personal data only with the following categories of recipients and only to the extent necessary:

6.1 Government Portals (Essential for Service)

  • Parivahan Sewa (parivahan.gov.in) — Vehicle registration data and tax payment submissions are processed on this Ministry of Road Transport portal. This sharing is inherent to and inseparable from our core service.
  • State Transport Department Portals — State-specific tax and permit applications.
  • e-Challan Portal (echallan.parivahan.gov.in) — Challan verification and payment.

6.2 Payment Processor

  • Razorpay Software Private Limited — Our sole Payment Aggregator, authorized by RBI. Razorpay operates under the RBI Master Directions on Payment Aggregators and Payment Gateways (2020). Their data handling is governed by their own Privacy Policy and PCI-DSS Level 1 certification.

6.3 Cloud Infrastructure

  • Our servers are hosted on secure VPS infrastructure within India, in compliance with the RBI Circular on Storage of Payment System Data (April 6, 2018), which mandates storage of payment data within Indian territory.

6.4 Legal Authorities

We may disclose personal data to law enforcement or judicial authorities when:

  • Required by a valid court order under Section 91 of the Code of Criminal Procedure, 1973 (CrPC)
  • Required under Section 69 of the IT Act, 2000 (government direction for interception/monitoring)
  • Required under Section 67C of the IT Act, 2000 (preservation and retention of data)
  • Required to comply with any other applicable law

We do NOT sell, rent, licence, or transfer your personal data to any third party for commercial, marketing, or advertising purposes. Any unauthorized disclosure of personal data constitutes a criminal offence under Section 72A of the IT Act, 2000, punishable with imprisonment up to three years and/or a fine up to Rs. 5,00,000 (Five Lakh Rupees).

PART VI: DATA SECURITY

7. Security Practices

As mandated by Section 43A of the IT Act, 2000 read with Rule 8 of the SPDI Rules, 2011, we implement and maintain "reasonable security practices and procedures" comprising an internationally accepted information security programme, including:

  • Encryption in Transit: All data exchanged between your device and our servers is encrypted using TLS 1.2/1.3 protocols, meeting the standards prescribed in the RBI Master Direction on Digital Payment Security Controls, 2021
  • Encryption at Rest: Database encryption for all stored personal data
  • Access Controls: Role-based access control (RBAC) with principle of least privilege; administrative access protected by multi-factor authentication (MFA)
  • Authentication: JWT-based token authentication with OTP verification for all user login events
  • Secure Storage: Document files stored in sandboxed Nginx server environments with strict access controls
  • Data Minimization: We collect only what is strictly necessary for service delivery
  • Retention Controls: Automated deletion of receipts after service expiry + 2-day buffer period
  • Audit Logs: Server-side access logs maintained for security audit purposes

Legal Note: In the event of a data breach, we are obligated under the DPDPA 2023 to notify the Data Protection Board of India and affected Data Principals in the prescribed manner. The Supreme Court in K.S. Puttaswamy (Retd.) v. Union of India (2017) emphasized that the State and private entities alike must protect personal data from unauthorized access or misuse.

PART VII: DATA RETENTION

8. Retention Periods

| Data Category | Retention Period | Legal Basis | |---------------|------------------|--------------| | Account and identity data | Duration of account + 90 days post deletion request | DPDPA 2023 | | Payment transaction records | Minimum 8 years | Income Tax Act, 1961; GST Act, 2017 | | Vehicle compliance documents | Until document expiry + 2 days | Service requirement | | Communication/support records | 3 years | Limitation Act, 1963 | | Server access logs | 90 days | IT (Intermediary) Rules, 2021 | | GST invoices and credit notes | 6 years | GST Act, 2017 (Section 36) |

Upon expiry of the applicable retention period, personal data will be permanently deleted or anonymized so that it can no longer identify you.

PART VIII: YOUR RIGHTS AS DATA PRINCIPAL

9. Rights Under DPDPA 2023

As a "Data Principal" under the DPDPA 2023, you are entitled to the following rights:

9.1 Right to Access Information (Section 11, DPDPA 2023) You have the right to obtain from us:

  • Confirmation of whether your personal data is being processed
  • A summary of the personal data being processed and the processing activities undertaken
  • The identities of all Data Fiduciaries and Data Processors with whom your data has been shared

9.2 Right to Correction and Erasure (Section 12, DPDPA 2023)

  • You may request correction of inaccurate or misleading personal data
  • You may request completion of incomplete personal data
  • You may request erasure of personal data that is no longer necessary for the purpose for which it was collected (subject to legal retention requirements)

9.3 Right to Grievance Redressal (Section 13, DPDPA 2023) You have the right to have your grievances addressed expeditiously and effectively by our Grievance Officer.

9.4 Right to Nominate (Section 14, DPDPA 2023) You may nominate any individual to exercise your rights in the event of your death or incapacity.

9.5 Right to Withdraw Consent You may withdraw consent for processing at any time. However, withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal, and may result in inability to access certain Services.

To exercise any of the above rights, email us at support@vaahantax.com with your registered mobile number and a description of your request.

PART IX: COOKIES, CHILDREN, AND CHANGES

10. No Cookies

The VaahanTax mobile application does not use browser-based cookies. We may use anonymized, aggregate-level app analytics (non-personally identifiable) to improve service performance.

11. Children's Privacy (Section 9, DPDPA 2023)

VaahanTax is not directed at children under 18 years of age. Section 9 of the DPDPA 2023 imposes additional obligations on Data Fiduciaries processing children's personal data, including obtaining parental consent. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a child without verifiable parental consent, we will delete it promptly.

12. Changes to This Policy

We reserve the right to modify this Policy. Material changes will be communicated through an in-App notification at least 15 days before taking effect. Continued use of the App after the effective date of revised Policy constitutes your acceptance thereof, as recognized under the Indian Contract Act, 1872 (Section 7 — acceptance of proposals).

PART X: GRIEVANCE REDRESSAL

13. Grievance Officer

In accordance with Rule 5(9) of the SPDI Rules, 2011, Section 13 of the DPDPA 2023, and Rule 3(2) of the IT (Intermediary) Rules, 2021, we have designated a Grievance Officer:

Grievance Officer: AdiFay Infotech Private Limited Email: support@vaahantax.com Acknowledgement: Within 24 hours of receipt Resolution: Within 30 (thirty) days of receipt

If dissatisfied with our resolution, you may approach:

  1. The Data Protection Board of India — established under Section 18 of the DPDPA 2023
  2. The Adjudicating Officer under Section 46 of the IT Act, 2000
  3. The appropriate Consumer Forum under the Consumer Protection Act, 2019

14. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of India. Subject to the arbitration clause in our Terms and Conditions, any dispute arising under this Policy shall be subject to the exclusive jurisdiction of courts at Bhiwadi, Rajasthan, India.

This Privacy Policy has been drafted in compliance with all applicable Indian laws as of the date of last update. AdiFay Infotech Private Limited reserves the right to update this Policy to reflect changes in law or business practices.