Privacy Policy

This Privacy Policy is designed to comply with the Digital Personal Data Protection Act, 2023 (India) and the rules made under it, the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”). Where a specific law gives you additional rights, the relevant region-specific section below applies to you.

1. Who We Are and the Scope of This Policy

Doordap Realty Pvt. Ltd. (“Doordap”, “we”, “us”, or “our”) is a real-estate marketing and sales company incorporated in India with its registered office at Oxford Towers, 139, HAL Old Airport Rd, Kodihalli, Bengaluru, Karnataka 560008. We operate the website www.doordap.com(the “Site”) and provide marketing, demand-generation, and sales services for real-estate developers (“Developer Clients”).

This Policy explains how we handle personal data in two distinct roles:

• As a controller / data fiduciary: for personal data we determine the purposes and means of processing, such as data from Site visitors, business enquiries, prospective Developer Clients, marketing recipients, vendors, and job applicants.
• As a processor / data processor (acting on instructions): for personal data of home-buyers and prospects that we collect and handle on behalf of and under the instructions of a Developer Client in connection with a specific project. For that data, the Developer Client is the controller / data fiduciary and its own privacy notice governs; Section 11 explains how this works.

This Policy applies to the Site, to our enquiry and lead-capture forms, to advertising we run on platforms such as Meta and Google, and to communications we have with you by email, telephone, and messaging (including WhatsApp).

2. Definitions

• Personal data / personal information: any information relating to an identified or identifiable individual.
• Processing: any operation performed on personal data (collection, recording, storage, use, disclosure, erasure, etc.).
• Data Principal / Data Subject / Consumer: the individual to whom the personal data relates (the terms used under the DPDP Act, GDPR, and CCPA/CPRA respectively).
• Data Fiduciary / Controller / Business: the entity that decides why and how personal data is processed.
• Data Processor / Service Provider: an entity that processes personal data on behalf of, and under the instructions of, a controller.
• Sensitive / Special-category data: data such as financial information, government identifiers, or other categories given heightened protection under applicable law.

3. The Personal Data We Collect

3.1 Information you provide directly

When you submit an enquiry, request a call-back, or otherwise contact us, we collect:

• Full name
• Email address
• Phone number (including WhatsApp number, where you contact us there)
• Company / organisation name and role (for Developer Client enquiries)
• Project type (residential, commercial, plotted, etc.)
• City / location of interest or of the project
• Project stage (land, planning, under-construction, ready)
• Budget range or investment intent, where you choose to share it
• Your message, preferences, and any other details you volunteer

3.2 Information from advertising and lead-generation campaigns

We run paid advertising campaigns on platforms including Meta (Facebook and Instagram) and Google. When you respond to an ad or submit an instant lead form on those platforms, or land on a campaign page, we receive the contact and enquiry details you provide, together with campaign attribution data (such as the ad, audience segment, and referring platform).

3.3 Communications and conversation records

When you speak with our sales team, we may record or take notes of telephone calls and retain WhatsApp and messaging conversations for quality, training, follow-up, and record-keeping purposes. Where a call is recorded, we will tell you at the start of the call, and you may ask us not to record.

3.4 Information collected automatically

When you browse the Site, we may collect technical and usage information automatically:

• IP address and approximate (city-level) geographic location
• Device type, browser type and version, and operating system
• Referring URL, entry and exit pages, and UTM / campaign parameters
• Pages visited, time on page, scroll depth, and click paths
• Cookies and similar technologies (see our Cookie Policy for the full list and our consent controls)

Analytics (Google Analytics 4) and advertising measurement (Meta Pixel) are activated only after you give consent through our cookie-consent banner, and you can change or withdraw that consent at any time via the Cookie settings link in our footer.

3.5 Home-buyer data processed for Developer Clients

In our processor role (Section 1 and Section 11), we collect and handle home-buyer and prospect data (typically name, contact details, enquiry details, and site-visit and booking information) on behalf of a Developer Client for a specific project. We process that data only on the Developer Client’s documented instructions.

4. How We Use Your Data and Our Legal Bases

Where we act as a controller / data fiduciary, we rely on the following purposes and legal bases. “Consent” refers to consent under the DPDP Act 2023 and Article 6(1)(a) GDPR; “legitimate interests” refers to Article 6(1)(f) GDPR (and an equivalent reasonable-purpose basis where recognised).

Where we rely on consent, you may withdraw it at any time (see Section 8). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may object as described in Section 9.

5. Cookies and Similar Technologies

We use strictly-necessary cookies to operate the Site, and, only with your consent, analytics and marketing cookies. Strictly-necessary cookies do not require consent. All other categories are off by default until you opt in. You can accept, reject, or fine-tune each category in our cookie banner, and reopen those controls at any time via the Cookie settings link in the footer. Full detail, including the specific cookies and their lifespans, is in our Cookie Policy.

6. Sharing Your Data and Our Sub-Processors

We do not sell your personal data for money. We share it only with the categories of recipients below, and only to the extent necessary for the purposes described above. Each third party is bound by a contract (and, where required, a data-processing agreement) that restricts their use of the data.

For the purposes of the CCPA/CPRA, our use of advertising and analytics technologies (such as the Meta Pixel) may be treated as a “sale” or “sharing” of personal information for cross-context behavioural advertising. You can opt out as described in Section 10.

7. International Transfers

Some of our service providers (for example, Google and Meta) process data outside India, including in the United States. Where personal data of individuals in the EEA or UK is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement), together with supplementary measures where needed. We transfer personal data internationally only to countries not restricted by the Central Government under the DPDP Act 2023. You may request a copy of the relevant safeguard by contacting us.

8. Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and then securely delete or anonymise it. Our default retention periods are:

9. Your Rights Under the DPDP Act 2023 (India)

If you are in India, under the DPDP Act 2023 you have the right to:

• Access: obtain a summary of the personal data we process about you and the processing activities.
• Correction & completion: have inaccurate or incomplete data corrected or completed, and have data updated.
• Erasure: request deletion of your personal data, subject to our legal retention obligations.
• Withdraw consent: withdraw any consent at any time, as easily as you gave it.
• Grievance redressal: have your grievance addressed by our Grievance Officer (Section 13).
• Nomination: nominate another individual to exercise your rights in the event of your death or incapacity.

10. Your Rights Under the GDPR (EEA / UK) and CCPA/CPRA (California)

10.1 EEA and UK residents (GDPR)

If you are in the EEA or the UK, you additionally have the right to:

• Rectification, erasure, and restriction of processing in the circumstances set out in the GDPR.
• Data portability: receive data you provided in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests, and to object to direct marketing at any time.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such decision-making; see Section 12).
• Lodge a complaintwith your supervisory authority (for example, your national Data Protection Authority, or the UK Information Commissioner’s Office).

Our EU/UK representative for data-protection matters is [Article 27 GDPR representative: name and contact, if appointed].

10.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Delete personal information we have collected, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising. You can exercise this by rejecting marketing cookies in our banner, using the Cookie settings link, or emailing us. We honour Global Privacy Control (GPC) browser signals.
• Limit the use of sensitive personal information to permitted purposes.
• Non-discrimination: we will not discriminate against you for exercising your rights.

You may use an authorised agent to submit a request on your behalf, subject to verification. We do not knowingly sell or share the personal information of consumers under 16.

10.3 How to exercise your rights

To exercise any right, email privacy@doordap.com with your request and enough information for us to verify your identity. We will respond within the period required by applicable law (generally within 30 days under the DPDP Act and GDPR, and within 45 days under the CCPA/CPRA, with extensions where permitted). Exercising your rights is free, unless a request is manifestly unfounded or excessive.

11. Our Role as a Processor for Developer Clients

When we collect or handle home-buyer and prospect data for a specific project on behalf of a Developer Client, the Developer Client is the controller / data fiduciary and we act as its processor. In that role we:

• process the data only on the Developer Client’s documented instructions;
• apply appropriate security measures and confidentiality obligations;
• engage sub-processors only under equivalent contractual terms and where permitted by the Developer Client;
• assist the Developer Client in responding to data-principal requests and in meeting its security and breach-notification obligations; and
• delete or return the data at the end of the engagement, subject to legal retention requirements.

If you submitted your details in response to a specific project and wish to exercise your rights over that data, please contact the relevant Developer Client; we will support that request and can help direct you to the right contact.

12. Automated Decision-Making and Profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We do use analytics and advertising platforms that perform audience segmentation and measurement (with your consent) to make our marketing more relevant; this does not determine any outcome about you without human involvement.

13. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include HTTPS encryption in transit, access controls and role-based permissions, vendor due diligence, and periodic reviews. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach occurs, we will notify the relevant authorities and affected individuals where and as required by applicable law.

14. Children’s Data

The Site is intended for business professionals and adult buyers, and is not directed at children. Under the DPDP Act 2023 we do not process the personal data of a child (under 18) without verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Under the GDPR and CCPA/CPRA we do not knowingly collect data from minors below the applicable age. If we learn we have inadvertently collected such data, we will delete it promptly.

15. Grievance Officer (India)

In accordance with the DPDP Act 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:

• Name: Shashank Singh
• Email: privacy@doordap.com
• Address: Oxford Towers, 139, HAL Old Airport Rd, Kodihalli, Bengaluru, Karnataka 560008

Grievances will be acknowledged within 48 hours and resolved within the period required by law (generally 30 days). If your grievance is not resolved, you may approach the Data Protection Board of India once constituted, or your local supervisory authority.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by posting the revised Policy on this page with an updated “Last updated” date and, where appropriate, by a more prominent notice or by re-requesting consent. We encourage you to review this Policy periodically.

17. Contact Us

If you have questions about this Policy or how we handle your personal data, contact:

• Data protection: privacy@doordap.com
• General: knock@doordap.com
• Post: Doordap Realty Pvt. Ltd., Oxford Towers, 139, HAL Old Airport Rd, Kodihalli, Bengaluru, Karnataka 560008