PRIVACY POLICY

The website “www.carandbike.com” (“Website”), is owned and operated by Mahindra First Choice Wheels Limited, having its registered office at Mahindra First Choice Wheels Limited, having its registered office at Gateway Building, Apollo Bunder, Mumbai – 400001, Maharashtra (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal data, your privacy is important to us. This Privacy Policy (“Policy”) applies to all products and/or services offered by us to all individuals (“you”, “your”, “user”).

This Policy explains how we collect, receive, store, disclose, share, and use your personal data for the purpose of your participation and consumption of our products and/or services offered by us through our website and/or software Platform (collectively, “Platform”) or during any interaction with us, and how you can exercise your privacy rights.

Before using our Platform or availing any of our products and/or services, you are advised to carefully read this Policy. If you do not agree with the terms of this Policy, please do not access this Platform. 

BY VOLUNTARILY PROVIDING US WITH INFORMATION, YOU ARE CONSENTING TO OUR USE OF IT IN ACCORDANCE WITH THIS POLICY.

1. DATA PRIVACY DISCLAIMER

The scope of this Policy is limited to the services provided by us within the territory of India and applies to users who request for these services within the Indian territory. In case if you are a citizen of any country other than India, kindly contact us as per para 11 before sharing any information. In case of failure to the same we will assume you to be an Indian citizen and accordingly we will treat your data as mentioned herein. 

1. WHAT PERSONAL DATA THAT WE COLLECT ABOUT YOU?

When you interact with us, we collect different types of information from you based on the type of interaction.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.

“Processing”, “Processed”, “Process” in relation to Personal Data, means a wholly or partly automated operation or set of operations performed on digital Personal Data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure, or destruction.

Any Personal Data provided by you will not be considered as private and confidential if it is freely accessible in the public domain like any comments, messages, blogs, available on social media platforms like Facebook, X, etc. 

We endeavour to collect only such information that is reasonably necessary to perform our services for you. When you interact with our Platform or otherwise with us, we may collect the following personal data from you directly:

1. General Data – full name, email, mobile number, city, total work experience, employment type, Date of birth, residence type;
2. Government Identification Data – PAN number;
3. Financial Data - Net income, Salary bank name, EMI status;
4. Electronic information – data about your device and your usage of our Platform, including your IP address, device ID, hardware model and version, mobile network information, operating system and other online identifiers, type of browser, browsing history, search history, access time, pages viewed, URLs clicked on, forms submitted, and physical location.

Electronic information is generally non-identifying in nature, but to Process such usage information and to make it feasible for our legitimate business interests like promoting system security and stability, allowing for error and performance analysis, and serving internal statistical needs, we may associate the usage information with other information collected from you and such combination may be treated as your Personal Data. This data also enables us to optimize our online services. 

You are under no obligation to provide the Personal Data that we ask you for. However, if you do not provide your Personal Data, you will not be able to make use of the features and functions of the platform.

1. LINKS TO SOCIAL MEDIA AND THIRD-PARTY SITES 

The Platform may contain links to other websites whose privacy practices differ from those of MFCWL. We have no control over such websites and are not responsible for the privacy policies/notices/statements or the content of such websites even if:

• You accessed the third-party Website using links from our Platform; or
• You accessed our Platform using links from a third-party Website.

If you provide your personal data to any third-party website, then the use of your personal data is governed by their privacy policies. This Policy applies to our Platform only. We encourage you to be aware when you leave our Platform and to read the privacy policies of other Website that you may choose to visit.

1. PURPOSE FOR WHICH WE PROCESS YOUR PERSONAL DATA

We collect your Personal Data for the following purposes:

1. To provide you with our services to:

• Login/Register, account maintenance and operations relating to your account(s), including without limitation, processing your applications or requests for services and/or products, operating and closing your account(s);
• Conducting identity and/or credit checks, and carrying out customer due diligence to offer you finance options;
• Manage your relationship with us;
• Assist with your purchase and respond to your requests;
• Sell/evaluate your vehicle;
• To manage your interaction with us but, not limiting to
  • Receive launch alerts;
  • Get offers from dealers; 
  • Download inspection reports; 
  • Download vehicle broachers.
    1. For marketing to:

• Notify you about any new products or enhancements to our services, if you opt in for the same;
• Deliver marketing and event related communications to you across various platforms, such as emails, telephones, text messaging, or WhatsApp, if you opt in for the same.

1. BASIS FOR PROCESSING YOUR PERSONAL DATA 

We will collect personal data by lawful and fair means and, where appropriate, with the knowledge of the individual concerned. We only collect and process personal data about you where we have a lawful basis. Lawful basis on which we would process data from you includes:

• Obtaining explicit consent from you,
• Processing for legitimate uses where processing is necessary to provide you with our products and/or services, such as:

1. To enforce our terms and conditions;
2. To ensure compliance with our legal obligations and to also comply with our obligations towards public authorities;
3. To enforce any legal right or claim;
4. For responding to a medical emergency involving a threat to your health or life or that of any other individual;
5. For taking measures to ensure safety of, or provide assistance or services to any individual any disaster, or any breakdown of public order;
6. For legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss prevention or prevention of fraud;
7. As otherwise described to you at the time of collection of your personal data.

1. SHARING/DISCLOSURE OF PERSONAL DATA

As far as this is necessary for the purposes set out above, we will share your Personal Data with the following recipients who either have a need to know and who will Process it for us based on our instructions and for no other purpose:

6.1 Potential partnerships: Your Personal Data might also have to be shared in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

6.2 External service providers: Occasionally, to provide our services, it is necessary to collaborate with external service providers. These external service providers shall Process your Personal Data on our behalf subject to appropriate safeguards only insofar as it is necessary for them to provide their services to us. Our prior authorization is required before they are permitted to transfer responsibility for Processing Personal Data to a third-party. We may share your Personal Data with our channel partners/service partners/third-party entities for the purpose of completing the transaction or establishing the relationship.

We only share your Personal Data with recipients that have an adequate level of data protection by implementing appropriate technical and organizational security measures, or we take measures to ensure that all recipients provide an adequate level of data protection as prescribed by applicable law. We do not sell your Personal Data to anyone.

6.3 Courts and public authorities: We will share your Personal Data when required for the following purposes:

• To comply with legal obligations and respond to requests from government agencies, including law enforcement agencies and other public authorities.
• To prevent or detect or investigate offences or cyber incidents or for the prosecution or punishment of offences.
• To raise or defend against legal claims.
• To protect our users, systems, and product and/or services.

1. HOW DO WE PROTECT YOUR PERSONAL DATA?

We implement appropriate technical and organizational measures in relation to the information and Personal Data that is Processed by us. We take reasonable measures to protect all Personal Data from unauthorised Processing or accidental disclosure, acquisition, sharing, alteration, misuse, destruction or loss or unauthorised access and modification that compromises the confidentiality, integrity, and availability of such data. 

While we endeavour to always protect our systems, platforms, operations and information against unauthorized access, use, modification, and disclosure, due to the inherent nature of the Internet, we cannot guarantee that any information, during transmission or while stored on our systems, will be safe and secure from intrusion by others.

You too have an important role in protecting your Personal Data. You should not share your user identity, password or other authentication data provided to you with anyone. If you have any reason to believe that your user identity or password has been compromised, please contact us immediately by using the contact details given in paragraph 11 below.

1. YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA

We respect your right to access and control your Personal Data, and we will respond to requests to exercise your rights under applicable laws for information and, where applicable, will correct, update, or erase your Personal Data.

Please note that applicable law might require that we cannot comply with every request. We will be required to retain your Personal Data due to legitimate business/ regulatory/ statutory retention requirements despite your request for erasure.

You have the following rights:

• Right to access information about your Personal Data: At any point, you can contact us for a summary of your Personal Data we hold about you, the Processing activities undertaken with respect to such Personal Data, the identities of all those persons with whom your Personal Data has been shared by us along with a description of the Personal Data so shared, and any other information related to your Personal Data and its Processing.
• Right to request correction: If your Personal Data is incomplete, inaccurate or misleading, or out of date, you can inform us about the same, and your Personal Data will be corrected, completed, or updated, as the case maybe.
• Right to request erasure: If you believe that we should discontinue the use of your Personal Data, you have the option to request the deletion of your Personal Data, unless retention is necessary for compliance with any law for the time being in force.
• Right of grievance redressal: We are committed to protecting your Personal Data collected by us. However, in case of any act or omission regarding the performance of our obligation in relation to your Personal Data or in the exercise of your rights under applicable law, we encourage you to contact us using the contact details provided in paragraph 12.
• Right to nominate: In the event of death or incapacity to exercise these rights, you can nominate any other individual to exercise such rights.
• Right to withdraw your consent to Process Personal Data: You can withdraw/revoke your consent at any time, to the Processing of your Personal Data for which consent was sought earlier. You can withdraw your consent easily by contacting us using the contact details given below in paragraph 11. The withdrawal of consent previously granted for the Processing does not affect the lawfulness of the Processing until the withdrawal. However, opting out will result in cessation of the respective services.

For exercising any of your rights, you can contact us using the contact details provided in paragraph 11. We will need you to furnish proof of your identity before you can exercise these rights. MFCWL may not be able to Process any requests made in the event you fail to establish your identity or if MFCWL is unable to authenticate your identity. 

It is important that the Personal Data we hold about you is accurate and updated, and you agree to provide us accurate Personal Data at all times. Please write to us if the Personal Data given to us changes during the period for which we hold it.

1. HOW LONG DO WE KEEP YOUR PERSONAL DATA? 

We will retain your Personal Data which we have collected for as long as we reasonably consider it necessary for achieving the abovementioned purposes and as is permissible under applicable law. This is determined on a case-to-case basis. 

We will delete your Personal Data whenever you request us to do so. However, we may archive and/or retain your Personal Data for as long as there are statutory retention obligations or potential legal claims are not, yet time barred.

1. SAFEGUARDING PRIVACY OF CHILDREN

We do not knowingly collect or solicit Personal Data from minors. Our services are not designed for any person who is under 18 years of age, and we do not knowingly permit such persons to register for the services. So, if you are under 18, please do not attempt to register for the services or send any Personal Data about yourself to us. Further, we do not undertake tracking and behavioural monitoring of children or targeted advertising directed to minors.

If we learn that we have collected Personal Data from a minor without verified parental consent, we will erase such Personal Data.

If you believe that a child under 18 years may have provided us their Personal Data, please contact us using the contact details provided in paragraph 11.

1. OUR CONTACT DETAILS

If you have questions or comments regarding this Policy or want to exercise any of your rights or express your grievances regarding the Processing of your Personal Data, please contact us using the contact details given below:

Name of the Grievance officer/Data Protection Officer: Shivani Arni

Email ID: privacy@mahindra.com

Mahindra First Choice Wheels Limited

Awfis Managed Workspace

3rd Floor, Crescent 4,

Prestige Shantiniketan,

ITPL Main Road, Whitefield,

Bengaluru 560048

1. GRIEVANCE REDRESSAL

If you have any grievances against our Processing of your Personal Data, you may lodge your grievance with the Data Protection Officer as per the details provided in paragraph 11 above. 

If you are not satisfied with the resolution provided, you may lodge your complaint with the Data Protection Board of India following the procedure prescribed by them.

1. CHANGES TO THIS PRIVACY POLICY 

We reserve the right to change this Policy at our sole discretion at any time. Any material changes to this Policy will be posted on this page. We encourage you to review this Policy regularly for such changes. The updated Privacy Policy will take effect as soon as it has been updated. 

This Policy was last updated as of 25/11/24.