Privacy Policy — India

The OneAppPlus marketplace platform (www.oneappplus.com, "OneAppPlus", "Portal", "We", "Us" or "Our") is owned and operated by ONEAPPPLUS PVT LTD, a company incorporated under the Companies Act, 2013, which inter alia facilitates and provides a platform for KYC-verified Sellers — including GI-certified weavers, artisans, NGOs, and producer companies — to sell their handloom and handicraft items ("Products") online to Users of the Platform.

This Privacy Policy ("Privacy Policy"), together with our Terms of Use and all other policies notified by us from time to time, governs your use of the Platform. This Privacy Policy describes our policies and procedures on the collection, use, disclosure, sharing, processing, transfer, storage, and retention of data provided to us by you through the use of the Platform.

We encourage you to read this Privacy Policy carefully. By accessing or using our Platform, registering an account, or placing an order, you expressly agree to be bound by this Privacy Policy and consent to our collection, use, disclosure, and retention of your personal data as described here. If you do not agree, please do not use or access the Platform.

OneAppPlus is committed to protecting your personal data in compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data) Rules, 2011, and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

We may modify this Privacy Policy from time to time. If any material changes are made, users will be notified through the Platform or by email before the changes take effect.

1. Data Collected

1.1 When you use the OneAppPlus Platform, the following data is collected from you at various stages:

Personal Data: We may collect your personal data to enhance your experience and provide our services. This may include, but is not limited to:

• Identifying Data — Name, email address, and phone number.
• Account Data — Username, password (stored in hashed form), and profile picture.
• Demographic Data — Location, shipping address, city, state, and pincode.
• Identification Details — For Sellers: occupation/business details, GSTIN, PAN, and KYC documents (Aadhaar, PAN card) to verify eligibility under Indian law and anti-money-laundering requirements.
• Financial Data — Payment references only (UPI transaction ID, card last-four via Razorpay). Full card/UPI/bank account details are tokenised by Razorpay and are never stored on OneAppPlus servers.
• Preferences — Time zone, language, market/locale selection, wishlist, and recently viewed items.
• Additional Data — Any other data voluntarily provided by you (e.g., reviews, ratings, photos, comments, order notes).

Usage Data: We may also collect data on how the Platform is accessed and used:

• Device information — type of device, operating system, browser type and version, IP address, brand and model.
• App performance data — crash reports, error logs, load times, and other diagnostic data to troubleshoot and improve the Platform.
• Browsing behaviour — pages visited, time spent, search queries entered, links clicked, and results selected.
• Data from cookies and similar tracking technologies (see Section 5 below).

1.2 You may optionally sign in using third-party services (e.g., Google Sign-In). In such cases, we fetch and store only the data made available to us by that service with your consent.

2. App Permissions

2.1 The OneAppPlus mobile application may request the following permissions to provide its services effectively:

• Camera Access — to enable photo upload for product reviews, profile pictures, and return/damage claim evidence.
• Storage / Gallery Access — to allow you to select and upload images from your device.
• Notifications — to send order updates, dispatch alerts, delivery confirmations, and promotional offers (with your consent).
• SMS Access — to facilitate OTP-based login and two-factor authentication via SMS.
• Microphone / Audio — to enable voice search functionality within the App.
• Location — to auto-fill delivery addresses and show estimated delivery timelines. Location access is optional and can be denied without preventing purchase.

2.2 The user may grant or revoke app permissions at any time through their device's settings. However, certain features of the App may be limited or unavailable if permissions are restricted.

3. Cookie Policy

3.1 The OneAppPlus Platform uses cookies to enhance user experience. By using our website, you consent to the use of cookies as described here. See our full Cookie Policy for detailed information.

• Strictly Necessary Cookies — required for login, cart, checkout, and session management. Cannot be disabled.
• Functional Cookies — remember your market/locale preferences, language, and recently viewed items.
• Analytics Cookies — aggregate usage statistics to improve Platform performance (e.g., page load times, error rates). Data is not linked to your personal identity.
• Marketing Cookies — used only with your explicit consent to show relevant promotions within the Platform. We do not share your data with external advertising networks.

4. Use of Data

4.1 We are committed to safeguarding your privacy and using your data responsibly. The data collected from you is utilised for the following purposes:

• Provide Services — processing and fulfilling your orders, generating GST-compliant tax invoices, arranging delivery through our ShipRocket-network courier partners, and managing export documentation for cross-border orders.
• Account Management — user authentication, account recovery, KYC verification, and communication regarding account-related matters.
• Personalisation — analysing your purchase and browse history to personalise product recommendations, display GI-product provenance, and tailor content to your preferences.
• Communication — sending order confirmations, dispatch notifications, delivery updates, and (with consent) promotional communications via email, SMS, and push notifications.
• Improving Services — analysing usage patterns, identifying trends, and improving the functionality, performance, and quality of our Platform.
• Develop New Services — using aggregated, anonymised data to build new features and product categories.
• Analytics & Reporting — generating aggregated statistical reports and visualisations to draw insights about Platform usage. Cumulative data is never linked to individual users.
• Legal Compliance — processing data as necessary to comply with obligations under the IT Act, 2000, DPDPA 2023, GST law, income-tax law, FEMA/RBI requirements, and other applicable Indian law.
• Security — maintaining the security and integrity of the Platform, detecting and preventing fraud, unauthorised access, and other illegal activities.
• Marketing & Advertising — with your consent where required by applicable law, for relevant promotions and offers within the Platform. We do not sell your data to external advertising companies.

5. Disclosure and Sharing of Data

5.1 We may disclose the data collected from you to our trusted third-party service providers who assist us in facilitating the provision of services in relation to your purchase of Products on the Platform. By using the Platform, you consent to our disclosure of your data with such third-party service providers.

• Sellers / Vendors — receive your shipping name, delivery address, and phone number for packing and dispatch coordination. Sellers never see your email, payment details, payment method, or browsing history.
• Razorpay (Payment Gateway) — processes your payment under PCI-DSS standards. OneAppPlus never receives or stores your full card/UPI/bank details. All financial data is transacted through encrypted, secure digital platforms.
• Logistics Partners — ShipRocket-network courier partners (Delhivery, Bluedart, DTDC, etc.) receive your shipping details for order delivery. They may contact you for delivery-related coordination.
• Tax & Regulatory Authorities — GST authorities, income-tax department, RBI (for FEMA/export remittance compliance), and courts or government authorities where required by law or enforceable government order.
• IT Service Providers — cloud infrastructure (AWS/GCP), analytics, and fraud-prevention services operating under data-processing agreements that prohibit independent commercial use of your data.

5.2 We may also disclose your data to external organisations or individuals if we have reason to believe that access, use, preservation, or disclosure of the data is reasonably necessary to: (a) meet applicable law, regulation, legal process, or enforceable governmental request; (b) detect, prevent, or address fraud, security, or technical issues; or (c) protect the rights, property, or safety of OneAppPlus, its Users, or the public.

5.3 We may disclose and share non-personal, aggregated statistical data to any third party to improve software, hardware, or services designed for use with the Platform.

6. Retention of Data

6.1 We retain personal data related to you for as long as your account remains active or as necessary to provide our services and comply with our legal obligations.

6.2 Transaction records, GST-compliant tax invoices, export shipping bills, and FEMA/RBI documentation are retained for 8 years to meet Indian statutory record-keeping requirements (GST Act, Income Tax Act, FEMA).

6.3 If your account remains inactive for a prolonged period (24 months), it shall be considered an implied withdrawal of consent, and we will notify you before archiving or deleting your account data.

6.4 If an account is suspended or blocked due to breach of our Terms of Use, we reserve the right to retain account identifiers (email, phone) to prevent the creation of new accounts using the same identifiers.

6.5 All personal data collected is retained in encrypted form on our application servers.

7. Consent Withdrawal

7.1 Upon accepting this Privacy Policy, you have provided a free, specific, informed, unconditional, and unambiguous consent for processing your data for the use of our Platform as described here.

7.2 You have the right to withdraw your consent at any time. Such withdrawal shall not affect the lawfulness of processing based on your consent before its withdrawal. Upon withdrawal of consent, we will cease to process your data for the purposes for which consent was given, and will ensure that third parties we have shared your data with also cease such processing.

7.3 You can withdraw consent, manage, review, or update your data preferences by:

• Visiting My Account → Profile or My Account → Notifications within the Platform.
• Emailing our Grievance Officer at grievance@oneappplus.com.
• Writing to privacy@oneappplus.com.

7.4 Upon withdrawal of consent, all non-statutory user data collected by the Platform will be deleted or anonymised within 30 days. Statutory records (tax invoices, export documentation) are retained for the period required by law.

8. Third-Party APIs and Services

8.1 The Platform may utilise third-party APIs and services to generate or enhance information about your experience. These may access data related to your profile, preferences, interactions, and relevant order details. We ensure that these APIs adhere to industry security standards.

8.2 By accepting this Privacy Policy, you consent to the use of third-party APIs that enhance your experience by providing personalised content, GI-product provenance verification, payment processing, and logistics tracking. Your consent extends to the terms and conditions of all third-party APIs integrated with the Platform.

8.3 The Platform may contain links to third-party websites and services. We have no control over such third-party services and are not responsible for any collection or disclosure of your data by them. We encourage you to read the privacy policies of any third-party site you visit.

8.4 Any data shared with third-party APIs will be subject to their respective privacy policies. OneAppPlus is not liable for any actions, data breaches, or disputes arising from third-party API usage.

9. Privacy, Safety, and Security

9.1 OneAppPlus implements appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• TLS/HTTPS encryption for all data in transit.
• AES-256 encryption at rest for sensitive personal data fields.
• Role-based access controls restricting staff access to data on a strict need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing.
• Intrusion detection and monitoring systems.

9.2 Your personal data is stored on our application servers in a regulated, secure environment protected from illicit access, use, or disclosure. When personal data is transmitted, it is encrypted using the Secure Sockets Layer (SSL) / TLS protocol.

9.3 Users are responsible for maintaining the security of their accounts, including using strong passwords and protecting login credentials. Users must report any suspected security breach or unauthorised account access to grievance@oneappplus.com immediately.

9.4 In the event of a security incident affecting your personal data, we will take immediate steps to contain the breach, investigate the cause, and notify affected users as required under the DPDPA 2023 and applicable law.

10. Your Rights Under the DPDPA 2023

10.1 Under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data held by OneAppPlus:

• Right to Access — obtain a summary of your personal data held by us and information about how it has been processed.
• Right to Correction — request correction of inaccurate, outdated, or incomplete personal data via your profile settings or by emailing privacy@oneappplus.com.
• Right to Erasure — request deletion of your personal data, subject to legal retention requirements. Statutory records cannot be deleted during the mandatory retention period.
• Right to Grievance Redressal — raise any data-protection complaint with our Grievance Officer (see Section 11 below).
• Right to Nominate — nominate any individual to exercise your rights in the event of your death or incapacity.

10.2 To exercise any of these rights, please contact us at privacy@oneappplus.com. We will respond within 30 days.

11. Grievance Redressal

11.1 We are committed to safeguarding the privacy and dignity of all individuals and will address privacy concerns in accordance with this Privacy Policy and applicable law. If you believe your privacy rights have been infringed, you are encouraged to report the matter to our Grievance Officer:

Grievance Officer, ONEAPPPLUS PVT LTD
Email: grievance@oneappplus.com
Acknowledgement within 24 hours · Resolution within 30 days (as required under IT Rules 2021 and DPDPA 2023)

11.2 If your complaint is not resolved to your satisfaction within the period prescribed, you may approach the Data Protection Board of India (once constituted under the DPDPA 2023) or the relevant court for redressal.

12. Indemnity

12.1 You agree to indemnify and hold OneAppPlus harmless from and against all liabilities, damages, losses, and expenses of any kind (including reasonable legal fees and costs) arising out of or in any way connected with: (a) your access to or use of our Services; (b) your breach of our Terms of Use or this Privacy Policy; (c) any misrepresentation made by you in connection with your use of the Platform.

13. Governing Law and Jurisdiction

13.1 This Privacy Policy is subject to and governed by the laws of India. In the event of any dispute arising out of or relating to this Privacy Policy, the dispute shall be resolved by arbitration in accordance with the Arbitration and Conciliation Act, 1996, with the seat of arbitration in Chennai, Tamil Nadu. The language of arbitration shall be English.

13.2 Subject to the above, the competent courts in Chennai, Tamil Nadu shall have exclusive jurisdiction over any dispute not referred to arbitration.

14. Severability

14.1 If any provision of this Privacy Policy is determined to be invalid or unenforceable in whole or in part, such invalidity or unenforceability shall attach only to such provision or part of such provision. The remaining provisions of this Privacy Policy shall continue in full force and effect.

15. Contact Us

For any queries relating to this Privacy Policy or the processing of your personal data:
Email: privacy@oneappplus.com
Grievance Officer: grievance@oneappplus.com
Platform: www.oneappplus.com