Who we are
The GD Kites app and website (the “Service”) are operated by GD Kite Center, CVVF+JJR, Shiv Shambo Nagar, Gokul Nagar, Kondhwa Budruk, Pune, Maharashtra 411046, India (“we”, “us”). We sell kites and kite supplies wholesale and deliver them to shops. For personal data processed through the Service we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023, and we follow the Information Technology Act, 2000 and the rules made under it.
What we collect and why
| Data | When | Why |
|---|---|---|
| Name, email address, Google account ID and profile photo | You sign in with Google | To create and secure your account |
| Mobile number and one-time sign-in code | You sign in with your mobile number | To verify your number. Codes expire after 5 minutes and are stored only as a one-way hash. |
| Business name, phone number | You edit your profile | To identify your shop and contact you about orders |
| Delivery addresses, map location of each address, contact name and number | You save an address or check out | To check that we deliver there, calculate the delivery charge and deliver your order |
| Your device’s location | Only when you choose “use my location” while adding an address | To place the address pin. We do not track customers. |
| Cart, orders, order history and delivery code | You place orders | To process, deliver and support your orders, and for our tax and accounting records |
| Payment records (order and payment IDs, amount, status) | You pay a delivery charge online | To confirm payment and process refunds. Card, UPI and bank details are handled by Razorpay; we never see or store them. |
| Push-notification token and device type | You allow notifications | To send order updates to your phone |
| Messages we send you on WhatsApp, and their delivery status | Order updates and sign-in codes | To keep you informed and to check messages were delivered. Sign-in codes are masked in our records. |
| Sign-in sessions (device/browser type) | You use the app | To keep you signed in securely and to detect misuse |
Delivery partners (drivers)
If you deliver for us, we also process your vehicle details, availability, assigned deliveries, fares and proof-of-delivery photos. While you are on duty (available or on a delivery), the app shares your location with us — also when it runs in the background, shown by a persistent “You are on duty” notification. We keep only your latest position, use it to assign deliveries, plan routes and show customers where their order is, and stop collecting it as soon as you go offline or sign out.
Who we share it with
We do not sell your data and we do not show ads. We share data only with service providers who process it for us:
- Google — Google Sign-In, and Firebase Cloud Messaging for push notifications.
- Razorpay — online payments and refunds (Razorpay privacy policy).
- WhatsApp (Meta) — order updates and sign-in codes sent to your WhatsApp number.
- Map and routing services — OpenStreetMap-based services turn a map position into an address and plan driver routes; the map itself loads from OpenFreeMap. They receive the coordinates involved, not your name.
- Our hosting provider — runs the servers and database the Service uses.
- Your delivery partner sees your name, delivery address and contact number for the orders they deliver. Customers see their driver’s name, phone number and live position while their order is out for delivery.
We may also disclose data when required by law or to protect our rights, customers or delivery partners.
How long we keep it
- Account data — until you delete your account.
- Orders, invoices and payment records — as long as Indian tax and accounting law requires (generally up to 8 years), even after you delete your account. They are kept without your profile details.
- Driver location — only the latest position is kept; it is overwritten as you move.
- Sign-in sessions — up to 30 days, or until you sign out.
Your rights
You can:
- see and correct your profile and addresses in the app (Profile);
- turn WhatsApp updates and push notifications off (Profile → Notifications, or your phone’s settings);
- delete your account in the app (Profile → Delete account) or by following these steps;
- ask us for a summary of the data we hold about you, withdraw consent, or nominate someone to exercise your rights, by contacting us at the address below.
Security
Data travels over encrypted connections (HTTPS). Sign-in tokens are stored in your phone’s secure storage (Keychain / Keystore) and on our servers only as one-way hashes. Access to customer data is limited to staff and delivery partners who need it for an order.
Children
The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data.
Changes
We will post any changes on this page and update the date above, and tell you about significant changes before they apply.
Contact and grievances
Grievance Officer, GD Kite Center
CVVF+JJR, Shiv Shambo Nagar, Gokul Nagar, Kondhwa Budruk, Pune, Maharashtra 411046, India
Phone: · WhatsApp
We respond to requests and complaints within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.