Privacy Policy

Preamble

This Privacy Policy is compliant with the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable international standards including the General Data Protection Regulation (GDPR) where relevant. By using the Drivyn website, you consent to the collection and use of your personal information in the manner described in this policy.

Section 01

Information We Collect

1.1 Information You Provide

Drivyn collects personal information that you voluntarily provide when you:

• Create an account — full name, email address, and password (stored in hashed form).
• Place an order — full name, shipping address, email address, phone number, and payment verification details (we do not store full payment card details).
• Contact us — your name, email address, and the content of your communication.
• Join the affiliate programme — name, email address, and banking or payment details required for commission disbursement.

1.2 Information Collected Automatically

When you visit www.drivyn.in, we may collect certain technical information automatically, including IP address and approximate geographic location, browser type, device type, and operating system, pages visited, time spent, and referral source, and session identifiers and interaction logs. This information is collected using standard web technologies including cookies, local storage, and server-side logs. It is used to maintain website functionality, improve user experience, and ensure platform security.

1.3 Payment Information

Payment transactions are processed by Razorpay (India) and PayPal (international). Drivyn does not receive, transmit, or store full card numbers, CVV codes, or banking credentials. Razorpay and PayPal are independently PCI-DSS compliant.

Section 02

How We Use Your Information

Drivyn uses collected information for the following purposes:

• Order Processing — to confirm, produce, fulfil, and dispatch your order, and to communicate order status updates.
• Customer Communication — to respond to enquiries, resolve disputes, and provide post-purchase support.
• Account Management — to create and maintain your Drivyn account and provide access to order history.
• Affiliate Programme Administration — to track referrals, calculate and process commission payments, and maintain the affiliate dashboard.
• Platform Security — to detect and prevent fraud, unauthorised access, and abuse of the website.
• Legal Compliance — to comply with applicable laws, regulations, and lawful requests from government authorities.
• Service Improvement — to analyse usage patterns and improve the functionality and content of the website.

Drivyn does not use your personal information for unsolicited commercial communications without your consent, and does not engage in the sale, rental, or trade of personal data to third parties for their marketing purposes.

Section 03

Legal Basis for Processing (GDPR)

For customers in the European Economic Area (EEA) and the United Kingdom, Drivyn processes your personal data under the following legal bases:

• Contractual Necessity — processing required to fulfil your purchase and provide services you have requested.
• Legitimate Interests — fraud prevention, website security, and service improvement, where these interests are not overridden by your rights.
• Legal Obligation — compliance with applicable laws.
• Consent — where you have explicitly consented to a specific form of processing, such as receiving marketing communications.

Section 04

Data Sharing and Disclosure

4.1 Fulfillment Partners

Drivyn shares necessary order information (name, shipping address, product details) with our print fulfillment partner Qikink to enable production and dispatch. This sharing is limited to the minimum information required for fulfillment.

4.2 Email Service Providers

Transactional emails (order confirmations, shipping notifications, account communications) are sent via Brevo (formerly Sendinblue). Your email address is shared with Brevo solely for the purpose of delivering these communications.

4.3 Payment Processors

Payment-related data is shared with Razorpay and PayPal as required to process and verify transactions. These processors operate independently and are subject to their own data protection obligations.

4.4 Infrastructure Providers

The Drivyn website is hosted on Cloudflare Pages and uses Cloudflare Workers for server-side processing. Cloudflare may process traffic and request data in accordance with its own privacy and security practices.

4.5 Legal Disclosures

Drivyn may disclose your personal information to law enforcement, regulatory authorities, or courts of competent jurisdiction if required by applicable law, a valid legal order, or to protect the rights, property, or safety of Drivyn, its customers, or the public.

4.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, customer data may be transferred to the successor entity. You will be notified via email or a prominent notice on the website prior to any such transfer.

Section 05

Data Retention

Drivyn retains personal information for as long as reasonably necessary to fulfil the purposes for which it was collected:

• Order records: retained for a minimum of five (5) years in compliance with applicable tax and accounting regulations.
• Account information: retained for the duration of the account's existence and for a reasonable period thereafter to handle post-closure queries.
• Affiliate data: retained for the duration of the affiliate relationship and for a reasonable period thereafter for commission resolution.
• Communication records: retained for up to two (2) years for dispute resolution purposes.

Upon expiry of the applicable retention period, data is securely deleted or anonymised.

Section 06

Data Security

Drivyn implements commercially reasonable technical and organisational security measures to protect your personal information against unauthorised access, loss, misuse, alteration, or destruction. These measures include:

• Encrypted transmission of data via HTTPS/TLS.
• Hashed storage of account passwords (no plaintext passwords are stored).
• Server-side HMAC verification for payment processing.
• Restricted access to personal data on a need-to-know basis.
• Secrets and API keys stored as encrypted environment variables, not in source code.

While Drivyn takes reasonable precautions, no system can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights, Drivyn will notify affected individuals in accordance with applicable legal requirements.

Section 07

Cookies and Tracking Technologies

Drivyn uses essential cookies and browser storage mechanisms to maintain session state, preserve cart contents, and facilitate authenticated access. We do not currently deploy third-party advertising or tracking cookies.

You may configure your browser to refuse or delete cookies; however, doing so may impair the functionality of the Drivyn website, including checkout and account access.

Section 08

Your Rights

Depending on your jurisdiction, you may have the following rights in relation to your personal data:

• Right of Access — to request a copy of the personal information Drivyn holds about you.
• Right to Rectification — to request correction of inaccurate or incomplete personal data.
• Right to Erasure — to request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction — to request that processing of your data be restricted in certain circumstances.
• Right to Data Portability — to receive your data in a structured, machine-readable format (applicable under GDPR).
• Right to Object — to object to processing based on legitimate interests.
• Right to Withdraw Consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please write to drivynofficial@gmail.com with the subject line "Data Rights Request" and include your registered email address. Drivyn will respond within thirty (30) days.

Section 09

Children's Privacy

The Drivyn website is not directed at individuals under the age of eighteen (18). Drivyn does not knowingly collect personal information from minors. If we become aware that personal information has been collected from a minor without parental consent, we will take steps to delete such information promptly.

Section 10

International Data Transfers

Drivyn is based in India. If you are accessing the website from outside India, your personal information may be transferred to and processed in India. For EEA customers, transfers are conducted on the basis of applicable safeguards including standard contractual clauses or adequacy decisions where available.

By using the Drivyn website from outside India, you acknowledge and consent to the transfer of your information to India in accordance with this Privacy Policy.

Section 11

Third-Party Links

The Drivyn website may contain links to third-party websites. Drivyn is not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any external websites you visit.

Section 12

Changes to This Policy

Drivyn reserves the right to amend this Privacy Policy at any time. Material changes will be communicated via a notice on the website and, where appropriate, by email. The effective date at the top of this document will be updated upon each revision. Your continued use of the website following publication of a revised policy constitutes acceptance of the changes.