New, Used Cars, Bikes, Trucks, Buses and Equipment

Thank You for visiting GaadiBazaar Website. Cholamandalam Investment and Finance Company Limited (collectively, referred to as “we” “us” “our” or “CIFCL”) are committed to protecting your privacy. This Privacy Notice (“Notice”) applies to persons who are accessing, selling, browsing or purchasing products or services on the website for any purpose and are referred as "You", "Your" or “User”. This notice shall be referred to and read as an integral part of the Terms of Use of the Website. This notice explains how CIFCL will collect, store, disclose, transfer, and use any data that personally identifies you ("Personal Data" as defined hereafter) when you visit our website to use our services, as required by applicable data protection rules. The Privacy Policy of the website is available at https://www.gaadibazaar.in/privacy-notice, is applicable to the guest users or registered users of the Platform (each, hereinafter referred to as the "User").

Protecting your privacy and protecting your Personal Data is of paramount importance to CIFCL. We want you to be confident that we are looking after your interests and that is why we have set out details with respect to processing of your Personal Data herein below.

Definitions

(i) “Personal Data”: Is defined as any data about an individual who is identifiable by or in relation to such individual.
When anonymous information is directly or indirectly associated with Personal Data, the resulting information also is treated as Personal Data. Any content posted/uploaded/conveyed/communicated by users on the public sections of the Website becomes publicly available information, as per The Digital Personal Data Protection Act, 2023 and is not considered Personal Data subject to this notice.
(ii) “Data Fiduciary”: Means any person who alone or in conjunction with other persons determines the purpose and means of processing of Personal Data.
(iii) “Data Principal”: Means the individual to whom the Personal Data relates and where such individual is:

a child, includes the parents or lawful guardian of such a child

a person with disability, includes her lawful guardian, acting on her behalf
(iv) “Data Processor”: Means any person who processes Personal Data on behalf of a Data Fiduciary.
(v) “Digital Personal Data”: Means Personal Data in digital form.
(vi) “Processing”: Refers to a wholly or partly automated operation or set of operations performed on digital Personal Data, and includes operations such as collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

Scope

This notice applies to Digital Personal Data and any Personal Data collected in non-digital form and subsequently digitized and processed by CIFCL.

1 Collection and use of Personal Data on the Platform

a. Information we collect from you

Information we collect from customers/ prospective customers/ visitors on the website/ applications – information which we collect may include one or all of the following:

Name
Gender
Address details
Mobile Number
Email ID
Photograph
Date of birth
PAN card
Education qualifications
Employment information
Aadhaar card
Income details
Marital status

We may use various technologies to collect information about your activities on our websites, including:

Cookies (web page flow, location, browsing patterns, etc.) (If not selected may affect certain or all functionalities); Most of the cookies are ‘session cookies’ which will be deleted automatically from the hard drive at the end of a session. Please refer to our Cookie Policy.
Cookies help CIFCL in providing information that is targeted to the interests of the Customer. If the Customer chooses to purchase products/services offered in the website, then CIFCL shall collect information about the Customer’s buying behaviour.

User is always free to decline the cookies, if his/her browser permits, although in that case the User may not be able to use certain features of the Platform and the User may be required to re-enter his/her password more frequently during a session.

b. Information users provide to us voluntarily

If you seek any help via the website through request call back option, we may process such information, including but not limited to name, phone number, pincode (if mentioned by you). If you reach out to us for raising a grievance, we will collect your data including name, email, phone, location. The Grievance officer may be contacted with respect to any complaints or concerns.

c. Information from other sources

We may obtain information about you from other sources, including customer reporting agencies such as credit bureaus, your employer or third parties, data aggregators and public databases. We may also collect information about you from our subsidiaries or non-affiliated third parties. This includes your Personal Data, such as credit scores.

2 Purpose and Use of collected Personal Data

CIFCL may use the Personal Data that is collected from you with your consent to provide requested products and services, for our internal business purposes and regulatory purposes, including, but not limited to:

Responding to your requests, enquiries or complaints for our unique products and services
To process your transactions/orders and to provide you with transaction and post transaction-related services, providing, improving, and marketing our products and services, including site content and performance
Analyze usage of the platform
Evaluating your use of the services
Bill the User and provide required support if the User chooses to list a vehicle/equipment for sale on the Platform
Providing advertising for products and services that might interest you
Responding to your requests for information or enforcing any of your rights
Communicating with you by e-mail, postal mail or courier, and/or telephone about products or services that may be of interest to you
Maintaining and managing your account with us
Keeping you updated on the issues that are relevant to your business relationship with us
Monitoring your compliance with any terms and conditions associated with our products and services, including to confirm your identity
Customize User experience; help promote safe trading; detect and protect CIFCL against error, fraud, and other criminal activity; resolve disputes; troubleshoot problems and collect fees owed
For internal operations such as troubleshooting, data analysis, research, testing and quality improvement of our service
Performing other functions as described to you at the time of collection or pursuant to your consent
Inform the user about online and offline offers, products, services and updates
Delivering marketing and event communications to you across various platforms, such as email, telephone, WhatsApp, text messaging and direct mail. Based on your consent, we may send you a marketing email which will include instructions on how to opt out of receiving these emails in the future. We also maintain email preference centers for you to manage your information and marketing preferences. Please remember that even if you opt out of receiving marketing emails, we may still send you important service information related to Your accounts and subscriptions that are required.
For Regulatory / Statutory reporting activities, Anti-Money Laundering (AML) and Fraud investigation purposes
To meet our internal and external audit requirements and for information security purposes
For legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss prevention or prevention of fraud
Verify the identity and processing of customer applications / forms / agreements
Analytics and business purposes
Ensure adherence to legal and regulatory requirements
Use and share the information with its Affiliates and third parties for providing services and any service-related activities

Where you have given your consent for the processing of Personal Data before the date of commencement of the Digital Personal Data Protection Act, 2023 (“DPDPA, 2023”), to CIFCL/ its Subsidiaries. CIFCL or its Subsidiaries shall take reasonable efforts to take consent from you in accordance with the DPDPA, 2023 and applicable data protection laws and regulations.

If CIFCL wishes to collect and process your Personal Data for purposes other than those mentioned above, we shall seek a specific consent from you prior to processing of your Personal Data for such additional purposes unless the process falls under ‘legitimate use’ within the meaning of the DPDPA, 2023. CIFCL shall not seek consent for processing activities that are permitted under applicable law, including regulatory compliance, fraud prevention and contractual necessity.

The information along with Personal Data which CIFCL collects, processes and stores during normal use of the Website is used to monitor the use of the Website, applications and to help further development of our products and services. We use this information to improve our Web-based offerings.

The Customer allows CIFCL to exchange, share, part with all information related to the details and transaction history of the Customers to its Associates/banks/financial institutions/credit bureaus/agencies/participation in any telecommunication or electronic clearing network as may be required by law, customary practice, credit reporting, statistical analysis and credit scoring, verification or risk management and shall not hold CIFCL liable for use or disclosure of this information.

3 Basis for processing your Personal Data

We use your Personal Data only for a lawful purpose. We may use your Personal Data for any of the following uses without your explicit consent:

To comply with a legal obligation to which we are subject
To comply with the requirement of performance of any function of the State and any of its instrumentalities to provide or issue You such subsidy, benefit, service, certificate, licence or permit
To comply with requirement of performance of any function of the State authorized by law
To comply with any law for the time being in force made by the Parliament or any State Legislature
To comply with any judgement, decree, or order issued under any law
To respond to any medical emergency involving a threat to your life
To undertake any measure to provide medical treatment or health services to any individual during an epidemic, outbreak of disease or any other threat to public health
To undertake any measure to ensure safety, or provide assistance or services to, any individual during any disaster or any breakdown of public order
To enforce the terms and conditions of the products or services
To protect and defend CIFCL or it’s Affiliates’ rights, interests or property
To confirm the transaction details
To process Personal Data for reasonable purpose such as -
1. prevention and detection of any unlawful activity including fraud
2. mergers, acquisitions, any other similar combinations or corporate restructuring transactions in accordance with the provisions of applicable laws
3. ascertaining financial information and assets and liabilities in case of default of any payment due on account of a loan or advance taken from CIFCL
To gather details about prospect employees: Your information helps us to more effectively respond to your requests and queries to make the application interface user friendly.

4 Sharing/disclosure of information

We will transfer your Personal Data to the following recipients:

(i) CIFCL companies and potential acquirers

Our businesses are supported by a variety of CIFCL functions, its subsidiaries, and group company. Personal Data will be made available to them basis your consent, if necessary, for the provision of services, account administration, sales and marketing, customer and technical support, analytics, and business and product development.

Your Personal Data might also have to be shared in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). All our employees and contractors are required to follow our data protection and security policies when handling Personal Data.

Service providers: We may share Personal Data with organizations or individuals that perform functions on our behalf. For example, service providers may conduct verification/ evaluation of information you share with us, property details, process payments for our products and services or may store and process data on our behalf. These service providers are granted access to Personal Data for the purpose of performing their functions for CIFCL. We shall take all reasonable steps to ensure that the confidentiality of your information is maintained by imposing strict confidentiality standards on all the third parties with whom we part these information.

(ii) External providers of IT infrastructure

We collaborate with several external providers of IT infrastructure for any support needed. Your Personal Data will be processed by these parties only in so far as it is necessary for them to provide their services to us, such as support for software, systems, and platforms; delivery of marketing messages; cloud hosting services; and order fulfilment and delivery.

(iii) Legal matters

CIFCL may share Personal Data in response to a court order, a request for cooperation from a law enforcement or other government agency, or as otherwise required by law; to persons acting in a representative capacity on your behalf; to defend against legal claims; to investigate, prevent, or take other action regarding illegal activity, suspected fraud, suspected violations of terms and conditions associated with any of our products or services, or other wrongdoing; or to protect and defend the rights, property or safety of our company, our users, our employees, or others.

(iv) Regulatory Compliance

CIFCL may share Personal Data to regulators, such as RBI (Reserve Bank of India), Data Protection Board of India to comply with regulations, circular, notice or order issued by such Regulators. If there are any cyber security incidents, CIFCL may share the User's Information, including Personal Information and Sensitive Personal Information, with the Indian Computer Emergency Response Team in accordance with the policies and procedures mentioned in the Information Technology Rules, 2013.

(v) Transactions

CIFCL may share Personal Data in connection with a substantial corporate transaction, such as mergers, acquisitions, the sale of our business, a divestiture, consolidation, or asset sale, or in the unlikely event of bankruptcy when applicable.

(vi) Listing of Classifieds and advertisements

On the listing of a classified advertisement by a User, and another User expressing his interest on the advertisement, the User who expresses interest over the advertisement will be provided with the contact information of the User listing the classified advertisement. CIFCL may aggregate the Personal Information of Users available on the Platform and share such information in a non-personally identifiable manner to the advertisers and third parties for marketing and promotional purposes of Website. The User can opt out of sharing such information by reaching out to support@gaadibazaar.in

(vii) Other Purposes

CIFCL may share Personal Data as otherwise described to You at the point of collection or pursuant to your consent. We may transfer your personal information or sensitive personal information collected, stored, processed by us to any other entity or organization located in India only in case it is necessary for providing services to you or for assisting in protecting the operation of CIFCL and its subsidiaries.

5 Security measures

5.1

We are strongly committed to the protection of your privacy and accordingly, we take security measures in relation to the information and Personal Data that is contained at our facilities and restrict access to the CIFCL Website, applications, buildings, computer rooms, office desks, technology areas, equipment, and other facilities where unauthorized access by people could compromise our security.

5.2

We also take appropriate technical and organizational measures under applicable law to protect the confidentiality, integrity and availability of Personal Data provided to us by you against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure, or access.

5.3

If we share your information with third parties/ service providers for processing your data, appropriate technical and organization measures as per applicable law shall be implemented to ensure confidentiality, integrity, and availability of Personal Data.

5.4

We endeavor to detect and investigate every breach of security by having relevant mechanisms in place which should alert us to a breach of security. We also use appropriate security safeguards to assist in protecting any information or data which you provide.

6 Your rights

We respect your right to access and control your information, and we will respond to requests for information and, where applicable, will correct, amend, or erase your Personal Data.

Please note that applicable law might require that we cannot comply with every request. For example, we will be required to keep your Personal Data due to statutory retention requirements despite your request for erasure.

6.1 Under the DPDPA, 2023, You have the following rights:

The right to access

At any point, you can contact us to request a summary of what kind of Personal Data we hold about you, the processing activities undertaken with respect to such data, the identities of other data fiduciaries and data processors with whom Your Personal Data has been shared (if any) and description of such Personal Data shared.

The right to request correction, completion and updating

If your Personal Data is out of date, incomplete or incorrect, you can inform us, and your Personal Data will be updated accordingly.

The right to request erasure

If you feel that we should no longer be using your Personal Data or that we are using your Personal Data for a purpose it was not originally intended for, you can request that we erase your Personal Data. We will delete your information whenever you request us to do so. However, we may archive and/or retain and/or process some data/information as per statutory requirements.

The right of Grievance Redressal

You have the right to have your grievances redressed by us. You can file a complaint with us and we will address it within 90 days. In case, the grievance is not redressed by us, you have the right to go to the Data Protection Board of India (DPBI).

The right to nominate

You have the right to nominate any other individual who can exercise these rights on your behalf, in the event of your death or inability to exercise the rights.

The right to withdraw your consent to process Personal Data

You can withdraw/revoke your consent at any time, to the processing of your Personal Data for which consent was sought earlier. You can withdraw your consent easily by telephone, email, or by post (see contact details below). The withdrawal of consent previously granted for the processing does not affect the lawfulness of the processing until the withdrawal. Upon withdrawal of consent, CIFCL will cease processing activities based on consent, which may impact the availability of certain Platform services or functionalities.

6.2

For exercising your rights, you can write to our Data Protection Officer (DPO) at dpo@chola.murugappa.com. We will need you to respond with proof of your identity before you can exercise these rights. CIFCL may not be able to process any requests made in the event the user fails to identify themselves or if CIFCL is unable to authenticate such a user. CIFCL may also decline to process requests that are unreasonably repetitive or systematic, requiring disproportionate effort, jeopardizing the privacy of others, or extremely impractical or for which access is not otherwise required.

6.3

We may use a consent manager as per DPDPA, 2023 and DPDP Rules, 2025.

6.4

CIFCL shall not charge you for fulfilling any of the above requests. However, if the fulfilment of any such request leads to certain costs being incurred by CIFCL, then CIFCL will notify You prior to processing such request.

6.5

Once you have raised a request with us for any request related to your data, we shall provide resolution to you within 90 days of receipt of your request.

7 How long do we keep your information?

We shall not retain any Personal Data beyond the period necessary to satisfy the legitimate and essential business purposes, such as maintaining the performance of the service, making data-driven business decisions about new features and offerings, complying with legal obligations, resolving disputes for which it is processed and shall delete the Personal Data at the end of the processing. However, where it is required by local regulations and applicable law, we shall retain your data for longer than required for the purpose. In some circumstances, CIFCL may take appropriate security measures to safeguard the data so that it can no longer be associated with the user, and CIFCL may use such data without further reference to the user.

We shall conduct periodic review of the data retained and stored and shall delete all data that is not necessary for processing or required to be stored.

CIFCL shall retain any processing of Personal Data undertaken by it, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing or as per CIFCL’s Data Retention and Erasure Policy and applicable regulatory requirements and after which CIFCL shall erase the Personal Data, logs unless further retention is required for compliance with any other law.

8 Usage of other User’s Information

CIFCL allows the User to access other Users' contact details. As a Seller, a User shall receive the contact details of the intending Buyer(s) via email/ short messaging service (SMS) and as an intending Buyer; a User shall receive the contact details of the Seller(s) via email/SMS. The Website hereby permits the User a license to use such information only for:

availing services offered through the Platform,
any other purpose that the User voluntarily opts by providing adequate disclosures. The User shall give adequate opportunity to other Users to remove themselves from his/her database and an option to review the information collected by such User about other Users.

No User shall disclose Personal Information or Sensitive Personal Information of another User to a third party without the specific consent of that another User and CIFCL.

10 Your duties as a Data Principal

You as a ‘Data Principal’, while exercising your rights as provided by this notice and interacting with any of the CIFCL’s services shall perform the following duties,

comply with the provisions of all applicable laws for the time being in force while exercising Your rights as provided by this privacy notice;
to ensure not to impersonate another person while providing her Personal Data for a specified purpose;
to ensure not to suppress any material information while providing Your Personal Data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
to ensure not to register a false or frivolous grievance or complaint with us;
to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the applicable data protection laws and regulations.

Changes to this privacy notice

We may also occasionally update this notice to reflect changes in our practices concerning the collection and use of your information. Users are requested to periodically check the terms and conditions under this notice from time to time. CIFCL shall not in any circumstance be held liable for such lapses on the part of the users.

In order to assist you in determining whether our notice has changed, we will list at the top of the notice the most recent date on which we updated it. If we make any material changes to this notice, we will notify you by posting notice of the changes on the website or by other appropriate means. This notice will be updated subject to any changes in information collection, activities performed or any applicable regulations.

Questions/ contact information

If you have questions or comments regarding this notice or want to express your grievances regarding the processing of your Personal Data, please contact us at:

Customer Care

Cholamandalam Investment and Finance Company Limited (CIFCL),
Chola Crest, C54-55 & Super B-4,
Thiru-Vi-Ka Industrial Estate, Guindy,
Chennai - 600032.

Phone: 1800 102 4565 / 1800 123 4565

Email: customercare@chola.murugappa.com

Data Protection Officer

Name: Dhanarajan P

Cholamandalam Investment and Finance Company Limited (CIFCL)
Chola Crest, C54-55 & Super B-4,
Thiru-Vi-Ka Industrial Estate, Guindy,
Chennai - 600032.

Email: dpo@chola.murugappa.com