PRIVACY POLICY

DHARMLOK — www.dharmlok.com

Last Updated: August 18, 2026

Dharmlok Ventures Private Limited (CIN: U46901RJ2023PTC088247), having its registered office at 12/9, GF, Malviya Nagar, Jaipur, Rajasthan – 302017, India ("Dharmlok", "Company", "we", "us", "our"), is committed to protecting the privacy of Users of the Platform (website https://dharmlok.com and the Dharmlok mobile application). This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules made thereunder.

1. SCOPE

1.1 This Policy applies to all "Personal Data" (as defined under the DPDP Act) collected, processed, or stored by the Company in connection with your use of the Platform.

1.2 By using the Platform, you consent to the collection and processing of your Personal Data as described herein.

2. PERSONAL INFORMATION WE COLLECT

We may collect the following categories of information:

2.1 Identity and contact data: name, mobile number, email address, date of birth, gender, postal address.

2.2 Account data: login credentials, Account preferences, profile photograph.

2.3 Transaction data: order history, payment method (tokenised), billing details, GSTIN (where provided), donation records, booking history.

2.4 Astrology/consultation data: date, time, and place of birth, and other details voluntarily provided for horoscope, astrology, palm reading, or Vastu consultation purposes.

2.5 Technical data: IP address, device identifiers, browser type, operating system, app version, log data.

2.6 Usage data: pages viewed, features used, click-stream data, and interaction with Content.

2.7 Location data: approximate or precise location, where enabled by the User, for temple/service discovery.

2.8 Communication data: correspondence with customer support, reviews, feedback, and community posts.

2.9 We do not intentionally collect sensitive personal data such as health records or biometric data unless expressly and separately consented to for a specific feature.

3. PURPOSE OF COLLECTION AND LEGAL BASIS

3.1 We process Personal Data for the following purposes, on the legal bases indicated:

3.2 We process Personal Data only for the specified purpose for which consent was given, in accordance with the purpose-limitation principle under the DPDP Act.

4. CONSENT

4.1 Where processing is based on consent, such consent shall be free, specific, informed, unconditional, and unambiguous, communicated through a clear affirmative action, as required under Section 6 of the DPDP Act.

4.2 Consent requests will be presented in clear and plain language, in English or the User's chosen language, together with the contact details of the Grievance Officer.

4.3 You may withdraw your consent at any time, with the ease of withdrawal comparable to the ease with which it was given (see Clause 12).

5. COOKIES AND ANALYTICS

5.1 We use cookies and similar technologies to operate the Platform, remember preferences, and analyse usage. Full details are set out in our separate Cookie Policy.

5.2 We may use third-party analytics tools (e.g., Google Analytics) to understand aggregate usage patterns. Such tools may set their own cookies, subject to their respective privacy policies.

6. THIRD PARTY SERVICES

6.1 We may share Personal Data with:

• (a) Payment gateway partners, strictly for processing transactions;
• (b) Logistics and courier partners, for delivery of Products;
• (c) Service Providers/Vendors, to the extent necessary to fulfil a booking or order (e.g., sharing your name, contact number, and address with the Pandit/astrologer/Vendor you have booked);
• (d) Cloud hosting and IT infrastructure providers, for storage and processing of data;
• (e) Analytics and marketing service providers, subject to your consent preferences;
• (f) Regulatory, governmental, or law enforcement authorities, where required by Applicable Law or a valid legal process.

6.2 We require such third parties to maintain confidentiality and implement reasonable security safeguards. We do not sell Personal Data to third parties for their independent marketing purposes.

7. PAYMENT GATEWAY

7.1 All online payments are processed through RBI-authorised, PCI-DSS compliant payment gateway partners. The Company does not store complete card numbers, CVV, or banking credentials on its own servers.

8. DATA RETENTION

8.1 We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with legal, accounting, tax, or regulatory obligations (e.g., GST records under applicable law).

8.2 Where you withdraw consent or request erasure, we will delete or anonymise your Personal Data unless retention is required by Applicable Law, in which case we will restrict further processing.

8.3 Further detail is available in our separate Data Retention Policy.

9. CHILDREN'S PRIVACY

9.1 The Platform is not intended for use by individuals below 18 years of age without verifiable parental/guardian consent, in accordance with Section 9 of the DPDP Act.

9.2 We do not knowingly collect Personal Data of children without such consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

9.3 If we become aware that we have inadvertently collected a child's Personal Data without appropriate consent, we will take steps to delete such data promptly.

10. YOUR RIGHTS AS A DATA PRINCIPAL

Under the DPDP Act, you have the right to:

10.1 Access — obtain a summary of the Personal Data we hold about you and the processing activities undertaken;

10.2 Correction and Updating — request correction of inaccurate or incomplete Personal Data;

10.3 Erasure — request deletion of Personal Data that is no longer necessary for the purpose it was collected, subject to legal retention requirements;

10.4 Grievance Redressal — file a complaint regarding processing of your Personal Data (see Clause 13);

10.5 Nominate — nominate another individual to exercise your rights in the event of death or incapacity;

10.6 Withdraw Consent — withdraw previously given consent at any time (see Clause 12).

10.7 To exercise these rights, Users may submit a request through [insert privacy request mechanism/email], and the Company shall respond within a reasonable time and in accordance with the DPDP Act.

11. WITHDRAWAL OF CONSENT

11.1 You may withdraw consent at any time through your Account settings or by writing to us at the contact details in Clause 16.

11.2 Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal, and may result in the Company being unable to continue providing certain Services dependent on that data.

12. SECURITY MEASURES

12.1 We implement reasonable security practices and procedures as prescribed under Section 43A of the IT Act, 2000 and applicable rules, including encryption in transit, access controls, and periodic security review, to protect Personal Data against unauthorised access, alteration, disclosure, or destruction.

12.2 No method of transmission or storage is completely secure; while we strive to protect your Personal Data, we cannot guarantee absolute security.

13. GRIEVANCE OFFICER

In accordance with the IT Act, 2000, the IT Rules, 2021, and the DPDP Act, the Grievance Officer/Data Protection contact for the Company is:

Name: [Insert Name]

Designation: Grievance Officer

Company: Dharmlok Ventures Private Limited

Address: 12/9, GF, Malviya Nagar, Jaipur, Rajasthan – 302017, India

Email: [Insert Grievance Email]

Phone: [Insert Phone Number]

Response Timeline: Complaints will be acknowledged within 24 hours and resolved within 15 days, in accordance with Applicable Law.

You may also lodge a complaint with the Data Protection Board of India as established under the DPDP Act, if you are not satisfied with the resolution provided.

14. INTERNATIONAL DATA TRANSFER

14.1 Personal Data is primarily stored and processed on servers located in India. Where data is transferred to a jurisdiction outside India (e.g., for cloud hosting or analytics services), such transfer shall be made in accordance with Section 16 of the DPDP Act and any list of restricted countries notified by the Central Government from time to time.

14.2 We shall ensure that any such transfer is subject to contractual or other safeguards providing an adequate level of protection.

15. POLICY UPDATES

15.1 We may update this Privacy Policy periodically to reflect changes in our practices or Applicable Law. Material changes will be notified through the Platform, and the "Last Updated" date will be revised accordingly. Continued use of the Platform after such update constitutes acceptance of the revised Policy.

16. CONTACT US

Dharmlok Ventures Private Limited

Registered Office: 12/9, GF, Malviya Nagar, Jaipur, Rajasthan – 302017, India

CIN: U46901RJ2023PTC088247

Email: [insert privacy email]

Phone: [insert support number]