Privacy Policy

Keep this current. This privacy policy is a working draft written for an Indian packers-and-movers business. Before you go live, have it reviewed by your own legal adviser and replace the bracketed details with your registered particulars. Edit it in Admin → Pages, not in the source.

1. Who we are

Shifto Packers & Movers ("we", "us") provides relocation services in India. For the purposes of applicable data protection law, including the Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data described below. Our registered address and grievance contact are at the end of this policy.

2. What we collect

• Enquiry and booking details — your name, phone number, email address, pickup and delivery addresses, moving date, and a description of the goods to be moved.
• Account details — if you create a customer account, your email address, a password stored only as a one-way hash, and the one-time codes used to verify you.
• Move records — surveys, inventories, quotations, invoices, payment records, delivery signatures, photographs of goods or damage, and messages exchanged with your coordinator.
• Vehicle and crew location — only as described in section 6.
• Technical data — IP address, browser type and pages visited, used to keep the service secure and to detect abuse. Cookies are described in section 9.

3. Why we collect it

To quote for your move, perform it, invoice it, support you afterwards, handle claims, meet our tax and transport-law obligations, and protect the service against fraud and abuse. We do not sell personal data, and we do not use your move details to target advertising.

4. Who we share it with

Only where it is needed to do the job: the crew and driver assigned to your move; a transport or storage partner where your route requires one; the insurer, if you take transit cover; the payment gateway that processes your payment; and our email and SMS providers, to send you the notifications you expect. Each receives the minimum necessary, and is bound to use it only for that purpose. We disclose data to authorities only where the law requires it.

5. Payment data

Card and UPI payments are processed by a PCI-DSS compliant payment gateway. Your card number, CVV and UPI credentials are entered on the gateway, not on our site, and we never receive or store them. We keep only the gateway's transaction reference, the amount, the status and the last four digits where the gateway supplies them.

6. Location data

We do not track vehicles or crew continuously. Location is recorded only when all of the following are true: the booking is active, the operations team has enabled tracking for that job, and the crew member has given explicit consent on their device. The sampling interval is configured per job rather than left running, collection stops when the booking closes, and history is deleted on the retention schedule in our tracking policy. Customers see progress stages by default; live position is shown only while the above conditions hold.

7. How long we keep it

Enquiries that do not become bookings are kept for 24 months and then deleted. Completed move records, invoices and tax documents are kept for 8 years, as Indian tax law requires. Location history is kept for the period stated in the tracking policy. Account data is kept while your account is open and for 12 months after you close it, unless a legal obligation requires longer.

8. Your rights

You may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it where no legal obligation requires us to keep it, withdraw a consent you previously gave (including consent to location tracking), and nominate someone to exercise these rights on your behalf. Write to the grievance contact below and we will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

9. Cookies

We use a session cookie to keep you signed in and a security token to protect forms against cross-site request forgery. Both are strictly necessary and cannot be turned off without breaking the site. Any analytics or marketing cookie is loaded only after you consent, and you can change that choice at any time.

10. Security

Passwords are stored as one-way hashes and never in plain text. Administrative access is role-based and logged. Sensitive credentials are held outside the application source in environment configuration. Transport is encrypted over HTTPS. No system is perfect, so if a breach affects your data we will notify you and the Board as the law requires.

11. Children

Our services are sold to adults. We do not knowingly collect personal data from anyone under 18, and we do not profile children or target advertising at them.

12. Changes and contact

We will update this page when our practices change and move the "last updated" date. For any privacy question or request, contact our Grievance Officer at [grievance@yourdomain] or write to [registered office address].