PRIVACY POLICY

The entity determining the purposes and means of processing personal data on this platform is:

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), The Dani Conglomerate Private Limited acts as the Data Fiduciary in respect of all personal data collected through the Website.

This Privacy Policy is designed to comply with and give effect to all applicable Indian laws and regulatory mandates governing data privacy, digital communications, electronic commerce, and real estate transactions, including but not limited to:

1. The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), when notified and in effect.
2. The Information Technology Act, 2000 ("IT Act"), including Section 43A and Section 72A thereof.
3. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
4. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended.
5. Telecom Commercial Communications Customer Preference Regulations, 2018 ("TCCCPR 2018") issued by the Telecom Regulatory Authority of India (TRAI), concerning Do-Not-Disturb (DND) registrations and commercial communication registries.
6. The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.
7. The Real Estate (Regulation and Development) Act, 2016 ("RERA") and relevant State RERA rules governing advertisements, disclosures, and real estate agent obligations.

In this Privacy Policy, unless the context otherwise requires:

• (a) "Personal Data" means any data about an individual who is identifiable by or in relation to such data, including name, phone number, email address, IP address, device identifier, location coordinates, and financial information.
• (b) "Processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, alignment, combination, indexing, sharing, disclosure, restriction, erasure, or destruction.
• (c) "Data Principal" means the individual to whom the personal data relates (i.e., you, the visitor, user, buyer, seller, or inquirer on the Platform).
• (d) "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing personal data (in this case, The Dani Conglomerate Private Limited).
• (e) "Consent" means any freely given, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes signifying agreement to the processing of personal data for a specified purpose.
• (f) "Partner" includes ONE SHOP SPACE OK and other authorised consultation, verification, and service partners operating in formal written engagement with PropertyBuyKaro.

We process your personal data strictly for specified, explicit, and legitimate purposes:

• (a) Property Discovery & Matching: Enabling you to search, filter, compare, and bookmark real estate listings based on your self-selected criteria.
• (b) Connecting Inquirers with Verified Sellers: Facilitating communication between you and the specific developer, property owner, or RERA-registered broker for the exact listing you inquired about (subject to the anti-spam restrictions in Section 8).
• (c) Professional Advisory Services: Providing strategic real estate consultation, site visit coordination, pricing comparison, and negotiation advisory through ONE SHOP SPACE OK.
• (d) Authentication and Profile Management: Managing user sessions, preventing account takeover, and securing dashboard functions.
• (e) Customer Support and Notice Delivery: Responding to inquiries, resolving complaints, dispatching booking confirmations, and notifying you of significant legal policy updates.
• (f) Platform Security, Integrity and Fraud Prevention: Detecting fraudulent listings, preventing automated scraping/bot attacks, monitoring unauthorized lead harvesting, and ensuring system availability.
• (g) Legal and Regulatory Compliance: Fulfilling statutory obligations under RERA, the IT Act, the DPDP Act, GST laws, and lawful government directives.
• (h) Service Optimization and Analytics: Evaluating platform performance, improving interface navigation, and conducting anonymised real estate trend analysis.

Under the DPDP Act, 2023, personal data shall be processed only upon receiving valid Consent from the Data Principal or for specified Legitimate Uses recognized by law.

• 7.1 Consent as Primary Basis: When you submit a property inquiry, request a site visit, register an account, or request a callback, you provide affirmative consent for PropertyBuyKaro to process your data for that specified inquiry.
• 7.2 Clear and Granular Notice: Every lead form on PropertyBuyKaro.com is accompanied by an itemised notice stating: (i) the personal data to be collected; (ii) the specific purpose of collection; (iii) the identity of the recipient (e.g., specific developer or ONE SHOP SPACE OK); and (iv) the manner in which consent may be withdrawn.
• 7.3 Right to Withdraw Consent: You have the absolute right to withdraw your consent at any time by emailing grievance@propertybuykaro.com or using the in-portal unsubscribe/opt-out mechanisms. Withdrawal does not affect the legality of processing carried out prior to withdrawal.
• 7.4 Legitimate Uses: Where permitted under Section 7 of the DPDP Act, limited processing may occur for voluntary disclosure, compliance with judicial decrees, prevention of cyber incidents, or disaster response.

ONE SHOP SPACE OK operates as our strategic real estate consultation and transaction facilitation partner. Where you request general property assistance, advisory services, commercial space advisory, or portfolio consultation:

• 9.1 Scope of Engagement: Data is shared with ONE SHOP SPACE OK exclusively to provide you with tailored consultation, schedule site visits, present comparative inventory, and assist with negotiation and closing documentation.
• 9.2 Governed by Contract: ONE SHOP SPACE OK is bound by strict confidentiality, data security, and purpose limitation covenants coterminous with this Privacy Policy.
• 9.3 Non-Dissemination: ONE SHOP SPACE OK is contractually prohibited from distributing, sub-licensing, or transferring your contact details to external marketing agencies or unverified third parties.
• 9.4 Independent Legal Relationship: PropertyBuyKaro and ONE SHOP SPACE OK operate on a principal-to-principal basis under formal service standards.

When you click "Contact Seller", "Request Callback", or "Book Site Visit" for a specific listed property:

• Your name, phone number, and stated requirement are communicated solely to the verified lister (developer, builder, sole-selling agent, or property owner) of that exact listing.
• The recipient is granted access to your details strictly to fulfill your requested inquiry regarding that specific project or property.
• Listers are prohibited by platform Terms of Service from adding your contact details to general cold-calling rosters for unrelated real estate properties.
• Should any developer or broker abuse this channel by sending spam or unsolicited offers, you may report them to grievance@propertybuykaro.com. We reserve the right to immediately deactivate offending accounts and pursue legal remedies.

We engage vetted third-party technical infrastructure providers who process personal data solely on our behalf under Data Processing Agreements (DPAs):

• Cloud Hosting & Database Infrastructure: Secure cloud providers (such as Amazon Web Services / AWS, Google Cloud Platform, or DigitalOcean) with data centers physically located in India.
• Communication & OTP Gateways: Enterprise SMS, WhatsApp Business API, and automated IVR providers (e.g., Gupshup, Twilio, Exotel) for OTP verification and booking status alerts.
• Email Delivery Services: Transactional email service providers (e.g., SendGrid, AWS SES) for dispatching account confirmations and formal notices.
• Analytics & Error Monitoring: Aggregated analytical tracking and error diagnostics engines (e.g., Google Analytics, Sentry) operating with IP-anonymisation enabled.
• Payment Aggregators: RBI-licensed payment gateways (e.g., Razorpay, Cashfree, PayU) for processing listing fees and subscription payments.

All Data Processors are bound by statutory confidentiality and security obligations under Section 8 of the DPDP Act.

We may disclose your personal data to law enforcement authorities, judicial courts, statutory bodies, or regulatory commissions only when strictly required by applicable Indian law:

• In response to a formal summons, warrant, or court order issued by a court of competent jurisdiction.
• Pursuant to a written requisition issued by an authorised law enforcement officer under Section 91 of the Code of Criminal Procedure / Bharatiya Nagarik Suraksha Sanhita (BNSS).
• To assist statutory agencies under Section 69 of the Information Technology Act, 2000.
• To protect the legal rights, safety, property, or integrity of PropertyBuyKaro, our users, or the general public against imminent fraud or security attacks.

PropertyBuyKaro operates as an online discovery, information, and marketing facilitation platform. While we enforce strict vetting and anti-spam contracts:

• Third-party developers, property sellers, home loan advisors, and external legal title search consultants operate as independent entities.
• Once you enter into direct off-platform transactions, site visits, or contractual negotiations with a developer, broker, or financial institution, their independent privacy notices will govern information you directly volunteer to them.
• PropertyBuyKaro is not liable for independent disclosures made by you directly to third parties during physical meetings, offline site visits, or direct WhatsApp chats outside the platform.

Property listings, project brochures, architectural renders, pricing matrices, and floor plans published on PropertyBuyKaro.com are provided by third-party builders, developers, and agents or sourced from public records (including MahaRERA).

• PropertyBuyKaro functions as an intermediary under Section 79 of the Information Technology Act, 2000 with respect to third-party submitted content.
• Users are strongly advised to independently verify RERA registration numbers, land title documents, encumbrance certificates, and physical municipal sanctions before issuing token payments or executing agreements for sale.
• Contact details displayed on verified project profiles are provided for legitimate buyer-seller communication and must not be harvested for unsolicited commercial advertising.

In accordance with Section 8(5) of the DPDP Act and the IT SPDI Rules, 2011, PropertyBuyKaro maintains comprehensive technical and organizational safeguards:

In the unforeseen event of a personal data breach affecting personal data processed by PropertyBuyKaro:

1. Containment and Investigation: Our incident response team will immediately isolate affected systems, patch identified vulnerabilities, and determine the nature and scope of the compromise.
2. Regulatory Notification: We shall notify the Data Protection Board of India (DPBI) in the prescribed form and manner in accordance with Section 8(6) of the DPDP Act and the DPDP Rules.
3. Notice to Affected Data Principals: Impacted users will receive prompt direct communication detailing: (i) the nature of the breach; (ii) data elements likely involved; (iii) measures taken to mitigate harm; and (iv) recommended precautions.
4. CERT-In Reporting: Cyber incidents will be reported to the Indian Computer Emergency Response Team (CERT-In) as mandated under prevailing cybersecurity directives.

PropertyBuyKaro uses small text files known as cookies and similar local storage technologies to enhance platform functionality:

• Strictly Necessary Cookies: Essential for authenticating users, maintaining active secure sessions, preventing cross-site request forgery (CSRF), and securing lead submission forms. These cannot be disabled.
• Functional & Preference Cookies: Storing user UI preferences (such as selected city, recent searches, saved filters, and budget ranges) so that your settings persist between sessions.
• Analytics Cookies: Anonymized behavioral statistics helping us understand user search trends, page load latencies, and device compatibility.

Browser Cookie Controls: You may modify your browser settings to decline or clear cookies at any time. Please note that disabling essential cookies may impact certain interactive features, such as saved searches or listing inquiry submissions.

We may generate aggregated, pseudonymised, or anonymized datasets from usage telemetry (such as average price per square foot searched in Nerul, Kharghar, or Thane, or popular property configurations).

Anonymized and aggregated data that cannot be linked, directly or indirectly, to identify any individual Data Principal does not constitute Personal Data under the DPDP Act and may be utilized for real estate industry reports, platform optimization, and academic market research.

PropertyBuyKaro respects your inbox and messaging space. We do not dispatch unsolicited marketing broadcasts.

• Commercial notifications (e.g., project price drops, new launch notifications matching your saved searches, curated newsletters) are transmitted only if you have affirmatively opted in.
• Every marketing email includes an instant one-click "Unsubscribe" link.
• WhatsApp and SMS marketing messages include clear instructions to opt-out (e.g., replying "STOP").
• Service-related notifications (such as OTP verification, site visit confirmations, account security alerts, and legal updates) are transactional and will continue as necessary for service fulfillment.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as mandated by applicable statutory retention laws:

Upon expiry of the designated retention schedule or upon valid erasure request, personal data is irreversibly destroyed, shredded, or rendered permanently non-identifiable.

Under the DPDP Act, 2023, you enjoy statutory rights as a Data Principal, which you may exercise without fee:

• Right to Access Information: Obtain a summary of personal data held about you, the processing operations carried out, and the identities of third parties with whom data has been shared.
• Right to Correction & Updating: Request immediate rectification of inaccurate, incomplete, or obsolete personal data.
• Right to Erasure / Deletion: Request permanent erasure of personal data when the original purpose is no longer served or when you withdraw consent (subject to legal retention mandates).
• Right to Grievance Redressal: Avail of an accessible grievance redressal mechanism provided by our Grievance Officer.
• Right to Nominate: Nominate an individual to exercise your rights under the Act in the event of death or incapacity.

To exercise any of these rights, email grievance@propertybuykaro.com with your registered mobile number and specific request.

In accordance with Section 12 of the DPDP Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer / Privacy Contact for PropertyBuyKaro is:

Grievance Escalation Timelines

• Acknowledgment: Within 24 to 48 hours of ticket receipt.
• Investigation & Resolution: Substantive resolution within 15 to 30 calendar days as specified under prevailing IT and DPDP regulations.
• Escalation to DPBI: If you remain dissatisfied with our resolution, you hold the statutory right to escalate the complaint to the Data Protection Board of India.

PropertyBuyKaro.com is not directed towards individuals under eighteen (18) years of age ("Children"). Real estate inquiries, listing postings, and agreements require full contractual capacity under the Indian Contract Act, 1872.

In compliance with Section 9 of the DPDP Act, we do not knowingly collect personal data of children, undertake behavioral tracking or targeted marketing directed at minors. If we discover inadvertent receipt of personal data belonging to a minor without verified parental consent, we will promptly delete such data from our systems.

PropertyBuyKaro processes and stores all core user databases, listing data, and transaction information within the sovereign territory of the Republic of India.

Where third-party enterprise tools (such as global email routing or cloud analytics) process data cross-border, such transfers comply strictly with Section 16 of the DPDP Act, 2023 and notifications issued by the Central Government restricting data transfers to blacklisted territories.

As a Data Principal submitting personal data on PropertyBuyKaro.com, you undertake to:

• Provide true, accurate, current, and complete contact details.
• Refrain from impersonating any individual, entity, or submitting fake phone numbers or third-party details without authorization.
• Keep your account credentials, login OTPs, and password tokens strictly confidential.

PropertyBuyKaro disclaims liability for misdirected site visit updates or communications resulting from false or mistyped contact credentials entered by users.

The Website may contain links to third-party web portals, developer microsites, government portals (e.g. MahaRERA, IGR Maharashtra), or financial partner websites (e.g., home loan providers).

Clicking on external links directs you outside our domain. We do not exercise control over external platforms and are not responsible for their content, cookies, or privacy practices. We encourage you to review the privacy notices of any external site you visit.

PropertyBuyKaro contracts exclusively with reputable partners, developers, and brokers. However, independent real estate agents, external sales gallerists, or third-party service vendors operate as autonomous business entities:

• PropertyBuyKaro shall not be vicariously liable for unauthorized, rogue, or illegal actions undertaken by independent third parties in breach of written agreements with us.
• Upon receiving verifiable notice that a partner or developer has engaged in unauthorized lead spamming, we will promptly initiate contractual sanctions, delist the offender, and assist affected users.

In the event that The Dani Conglomerate Private Limited undergoes any corporate reorganization, merger, acquisition, demerger, asset transfer, or restructuring, user databases may be transferred as an essential business asset to the successor entity.

In such event, the surviving or acquiring entity will remain bound by the terms and protections established in this Privacy Policy, and prominent notice will be posted on the Website prior to the effective date of the transfer.

We maintain an active internal data protection compliance program:

• Designation of a qualified privacy officer and legal liaison.
• Mandatory data privacy onboarding for all engineering, customer success, and sales staff.
• Periodic Data Protection Impact Assessments (DPIA) prior to launching new features or algorithmic recommendation systems.
• Annual review of vendor security architectures and compliance certifications.

We reserve the right to amend, update, or modify this Privacy Policy from time to time to reflect operational changes, technical advancements, or evolving legal frameworks under the DPDP Rules or TRAI directives.

When material changes are made, we will update the "Last Updated / Effective Date" at the top of this document and post a conspicuous announcement on our homepage. Continued access or use of PropertyBuyKaro.com following such notification signifies your acknowledgment and acceptance of the revised policy.

This Privacy Policy shall be governed by, interpreted, and construed strictly in accordance with the laws of the Republic of India.

Subject to statutory remedies available before the Data Protection Board of India (DPBI) under the DPDP Act, 2023, any dispute, controversy, or claim arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts sitting in Mumbai / Navi Mumbai / Thane, Maharashtra, India.

To ensure day-to-day fidelity between this written policy and website operations, PropertyBuyKaro enforces the following digital controls:

• Active Consent Checkboxes: Clear, un-ticked consent checkboxes on all lead capture dialogs, site visit request forms, and callback modals.
• Notice on Lead Forms: Explicit statement on every submission card identifying that inquiry data will only be routed to the specific developer or ONE SHOP SPACE OK.
• Footer Hyperlink: Persistent, clearly legible hyperlinks to this Privacy Policy from every page footer across the Website.
• OTP-Based Validation: Mobile telephone numbers are authenticated via OTP to prevent third-party spoofing or malicious form submissions.
• Unsubscribe Mechanism: Fully functional, automated unsubscribe and preference management tools on all outbound email and messaging communications.

This Privacy Policy represents the complete, binding privacy framework of PropertyBuyKaro.com as operated by The Dani Conglomerate Private Limited in partnership with ONE SHOP SPACE OK.

We pledge to uphold these standards in letter and spirit to deliver an exemplary, spam-free real estate discovery experience across India.