This Privacy Policy is issued in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

This Notice applies to GaliKart Private Limited (hereinafter referred to as "GaliKart" or "the Company"), a company incorporated under the Companies Act, 2013 and having its registered office at B-7/10 Arawali Sulabh Awas, Type 3, Shatabdi Nagar, Kanpur, UP-208020 and its subsidiaries, its holding company, its affiliates. The Company is the owner of websites www.galikart.com and www.galikart.in and mobile application 'GaliKart' (collectively, the "Platform").

This privacy policies (Privacy Notice) describes the policies and procedures applicable to the collection, use, storage, disclosure and protection of Your information shared with Us while You use the Platform. We value the trust You place in Us. That is why, We maintain reasonable security standards for securing the transactions and Your information.

GaliKart ("we", "our", "us") respects your privacy and is committed to protecting your personal data. By using GaliKart, you give consent to the collection and processing of your personal data in accordance with this Privacy Policy.

Please read the Privacy Notice carefully prior to using or registering on the Platform or accessing any material, information or availing any services through the Platform.

1. Definitions (as per DPDP Act, 2023)

Personal Data: Any data about an individual who is identifiable by or in relation to such data.
Sensitive Personal Data: Includes health data, prescriptions, biometric or financial information as defined under applicable laws.
Data Principal: The individual to whom the personal data relates.
Data Fiduciary: GaliKart, which determines the purpose and means of processing personal data.
Data Processor: Any third party that processes data on behalf of GaliKart.

2. Information We Collect

i. Collection of Information

We collect various information from You when You access or visit the Platform, register or set up an Account on the Platform or use the Platform. This Privacy Notice applies to information collected about You:

a. Personal Information: You may provide certain information to Us voluntarily while registering on the Platform for availing services including but not limited to Your complete name, mobile number, email address, date of birth, gender, age, address details, KYC related information such as PAN, passport, driving licence, voter's identity card, income details, business or professional details, health and lifestyle related information and any other information voluntarily provided through the Platform.

ii. Sensitive Personal Information

Sensitive Personal Information consists of information relating to:

Passwords
Financial information such as bank account or credit card or debit card details
Physical, physiological and mental health condition
Sexual orientation
Medical records and history
Biometric information
Uploaded prescriptions and related medical information
Medicine details derived from prescriptions

Such data is collected only with explicit user consent in accordance with SPDI Rules and DPDP Act.

iii. Financial Information

If You choose to avail the services through the Platform, We will also collect and store information about Your transactions including transaction status, order history, and Your behaviour or preferences on the Platform.

v. Vendor & Delivery Partner Data

Identity and KYC documents (Aadhaar, PAN, GST, DL, RC)
Business and operational details

vi. Technical Data

IP address, device identifiers
App usage logs and cookies

3. Purpose of Data Processing

We process personal data strictly for lawful purposes including:

Account creation and management
Order placement and fulfillment
Prescription verification and medicine delivery
Payment processing and refunds
Customer support and grievance handling
Fraud prevention and platform security
Legal and regulatory compliance
Marketing and promotional activities (with consent)

Data is processed only for purposes consented to by the Data Principal.

4. Consent Mechanism

Consent is obtained explicitly at signup and during prescription uploads
Consent is free, specific, informed, unconditional, and unambiguous as required under DPDP Act
Users may withdraw consent at any time, subject to legal obligations

5. Sharing of Personal Data

a. Business Partners

We may disclose Your Personal Information to third party Sellers, service providers, merchants, delivery partners, marketing or advertising partners, consultants for carrying out research and other service providers who work for Us or provide services through the Platform.

b. Compliance with Law

We may disclose Your information including Personal Information to comply with laws, regulatory requirements and to respond to lawful requests and legal process, to protect Our rights and property, and in an emergency to protect personal safety.

c. Acquisition, Sale or Merger

We may share all of Your Personal Information with any other business entity in the event of a merger, sale, reorganization, amalgamation, joint ventures, assignment, restructuring of business.

d. Transfer Outside India

Subject to applicable law, We may share Personal Information to Our Group or affiliated entities, any third party located in India or any other country that ensures at least the same level of data protection.

We do not sell or commercially exploit personal data.

6. Data Retention

Personal data is retained only:

For as long as necessary to fulfill stated purposes
As required under applicable laws
For dispute resolution and enforcement

Prescription and health data are retained strictly in accordance with legal and regulatory requirements.

7. Data Security Practices

In compliance with IT Act and SPDI Rules:

We implement reasonable security practices including encryption, access controls, and secure servers
Regular security reviews are conducted
Access to sensitive personal data is restricted on a need-to-know basis

8. Rights of Data Principals (DPDP Act)

You have the right to:

Access information about your personal data
Request correction or erasure of personal data
Withdraw consent
Grievance redressal
Nominate another individual to exercise rights in case of death or incapacity

Requests can be raised using the contact details below.

9. Grievance Redressal Officer

In accordance with IT Rules, the contact details of the Grievance Officer are:

Grievance Officer – GaliKart

Email: grievance@galikart.com

Response Time: Within 7 working days

10. Children's Data

GaliKart does not knowingly process personal data of children under 18 years of age without verifiable parental consent, as required under DPDP Act.

11. Cross-Border Data Transfer

Personal data may be stored or processed on servers located in India or other jurisdictions permitted under Indian law, ensuring adequate data protection safeguards.

12. Policy Updates

This Privacy Policy may be updated periodically to reflect legal or operational changes. Continued use of the Platform constitutes acceptance of the updated policy.

GaliKart – Privacy Policy for Minors (Children)

GaliKart is committed to protecting the privacy and safety of children and minors. This Privacy Policy for Minors explains how we handle personal data relating to individuals below the age of 18 years, in compliance with the Digital Personal Data Protection Act, 2023 (India).

1. Definition of a Minor

For the purpose of this policy, a Minor (Child) means any individual below 18 years of age, as defined under Indian law.

2. No Intentional Data Collection from Minors

GaliKart does not knowingly collect, store, process, or solicit personal data from minors. Minors are:

Not permitted to create accounts
Not permitted to place orders
Not permitted to upload prescriptions
Not permitted to purchase restricted products such as medicines, tobacco, cigarettes, hookah, or nicotine products

3. Age-Gating & Access Control

To prevent misuse:

Age confirmation is required during account registration and checkout of restricted items
Orders involving medicines or tobacco require 18+ confirmation
Delivery partners are instructed to verify age at delivery

If a user is found to be under 18, access to restricted services is blocked immediately.

4. Accidental Collection of Minor Data

If GaliKart becomes aware that personal data of a minor has been collected without verified parental consent:

The data will be deleted immediately
The associated account may be suspended or terminated
No such data will be used for profiling, marketing, or analytics

5. No Behavioral Tracking or Targeted Ads for Minors

GaliKart:

Does not perform behavioral tracking of minors
Does not serve targeted or personalized advertisements to minors
Does not engage in profiling or automated decision-making involving minors

This aligns with Section 9 of the DPDP Act, 2023.

6. Parental / Guardian Rights

Parents or legal guardians may:

Request confirmation if their child's data has been collected
Request access, correction, or deletion of such data
Withdraw consent (if applicable)

Requests can be made by emailing contact@galikart.com. Verification of guardianship may be required.

7. Prescription Data & Minors

GaliKart does not accept prescriptions uploaded for minors
Medical orders must be placed only by adult users
Any prescription found to be associated with a minor will be rejected and deleted

8. Security Measures

GaliKart applies:

Encryption of all sensitive data
Restricted access controls
Regular audits to prevent unauthorized access

Children's data, if detected, is treated as high-risk data and removed on priority.

9. Legal Compliance

This policy complies with:

Digital Personal Data Protection Act, 2023
Information Technology Act, 2000
Consumer Protection Act, 2019
Applicable child protection laws in India

10. Changes to This Policy

GaliKart may update this policy from time to time. Material changes will be communicated via the app or website.

11. Contact Us

For any concerns regarding children's privacy:

Email: contact@galikart.com