CARBOUNTY

BUYER PRIVACY POLICY

urbanFleet Technology Private Limited

Effective date: 15 August 2026 | Version 1.0

This Privacy Policy explains how urbanFleet Technology Private Limited (“CarBounty”, “we”, “us” or “our”), which operates the CarBounty platform, collects, uses, shares and protects your personal information when you use our website, mobile applications and related services (the “Platform”). It is written to align with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP framework”).

Under the DPDP framework, you are the Data Principal (the individual the data is about) and CarBounty is the Data Fiduciary (the entity that decides how and why your data is processed). Please read this Policy carefully. By using the Platform and providing your information, you confirm that you have read and understood it.

1. WHO WE ARE AND HOW TO REACH US

● Company: urbanFleet Technology Private Limited, operating the brand CarBounty.

● CIN: U82990HR2026PTC143108.

● Business address: Omaxe Celebration Mall, Sector 48, Sohna Road, Gurugram, Haryana.

● Registered office: 703 Palm Court, Sector 16, Gurugram, Haryana 122007.

● Privacy contact: admin@carbounty.com.

For any question about this Policy or your personal data, contact our Grievance Officer using the details in Section 13.

2. INFORMATION WE COLLECT

We collect only the information we need to help you buy your car and to run the Platform. The categories are set out below.

Category	What it includes
Identity & contact	Your name, mobile number, email address and city or delivery location.
Vehicle requirement	The exact car you are looking for — make, model, variant, colour, budget range, timeline, and any exchange or finance preference you tell us.
Verification data	Information used to confirm you are a genuine buyer, such as a one-time password sent to your mobile number.
Commitment deposit data	The fact and amount of your refundable commitment deposit, and the payment reference returned by our payment gateway. We do not receive or store your full card, UPI or bank credentials.
Communication records	Messages you exchange with us over WhatsApp or email, and calls connected through our masked-calling system, which may be recorded for quality and dispute resolution.
Technical & usage data	Device type, browser, IP address, and how you move through our website and apps, collected through cookies and similar technologies.
Marketing identifiers	Identifiers used to measure the performance of our advertising, including hashed (irreversibly encoded) versions of your email or phone number where you have consented.

We do not knowingly collect sensitive information such as caste, religion, health or biometric data, and we ask you not to share it with us. We do not require, and do not want, information about the internal pricing or discount decisions of any dealership.

3. HOW WE COLLECT YOUR INFORMATION

● Directly from you, when you create an account, post a car requirement, verify your number, place a commitment deposit, or communicate with us.

● Automatically, through cookies and similar technologies when you browse the Platform (see Section 8).

● From service providers who help us operate, such as our payment gateway confirming that a deposit has been received.

4. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

● To run your car search. To create and manage your account, verify that you are a genuine buyer, and route your requirement to authorised dealerships through the Closed Virtual Offer Room (see Section 5).

● To handle your commitment deposit. To collect your refundable deposit through our payment gateway and to process refunds (see Section 7).

● To connect you with your chosen dealership. Once you select a private offer, to introduce you to that dealership and to coordinate the pre-delivery inspection at the showroom.

● To communicate with you. To send you offer updates, service messages, and responses to your queries over WhatsApp, email or a masked call.

● To improve and secure the Platform. To understand how the Platform is used, prevent fraud and misuse, and keep our systems safe.

● To measure our advertising. To understand which campaigns bring genuine buyers, where you have given consent (see Section 8).

● To meet legal obligations. To comply with applicable law, respond to lawful requests, and maintain required records.

We process your data on the basis of the consent you give us and, where permitted, for the legitimate uses recognised under the DPDP framework. You can withdraw your consent at any time, as easily as you gave it (see Section 12).

5. THE CLOSED VIRTUAL OFFER ROOM — HOW YOUR DATA FLOWS

The Closed Virtual Offer Room is the heart of CarBounty, and it is designed to protect your privacy. Here is exactly what happens to your information:

● You stay private while offers come in. When you post a requirement, up to four authorised dealerships are invited to submit private, competitive offers for the exact car you asked for. During this stage the dealerships can see the car requirement, but they cannot see your name or contact details.

● You choose — then, and only then, you are introduced. Your identity and contact details are shared with a dealership only after you select their offer. The dealerships you do not choose never receive your personal contact information.

● We never sit in the money path for your car. CarBounty does not collect, hold or pass on the purchase price of your car. You pay the dealership directly. The only amount you pay us is your refundable commitment deposit.

● Offers are ranked by price, nothing hidden. Offers are presented to you clearly so you can decide. We do not share one dealership’s offer with another and we do not coordinate pricing between them.

6. WHEN AND WITH WHOM WE SHARE YOUR INFORMATION

We do not sell your personal data. We share it only in the limited ways below:

● Your selected dealership. Your name and contact details are shared with the single dealership whose offer you choose, so they can complete your purchase.

● Payment gateway. Our payment partner (Cashfree) processes your commitment deposit and any refund. They handle your payment credentials under their own security standards; we do not store them.

● Communication providers. We use a masked-calling and messaging provider (Exotel) so that you and a dealership can speak without exposing each other’s personal phone numbers.

● Analytics and advertising partners. Where you consent, we share limited and, where possible, hashed identifiers with providers such as Google and Meta to measure advertising performance (see Section 8).

● Professional advisers and authorities. We may share information with our auditors, legal advisers, or with government or regulatory authorities where we are required to do so by law.

We require our service providers to protect your information and to use it only for the purposes we specify.

7. YOUR COMMITMENT DEPOSIT AND PAYMENTS

To confirm you are a serious buyer, we ask for a small commitment deposit. This deposit is fully refundable in line with our Deal Seal terms. It is held as a refundable amount, is never treated as our income, and does not include the price of your car, which you always pay the dealership directly. Your deposit is collected and refunded through our regulated payment gateway, which processes your card, UPI or bank details securely; CarBounty does not see or store those details.

8. COOKIES, ANALYTICS AND ADVERTISING

We use cookies and similar technologies to keep the Platform working, remember your preferences, understand how it is used, and measure our advertising.

Analytics and conversion measurement

We use tools such as Google Analytics and the Meta Pixel with its Conversions API to understand which pages and campaigns are effective. Where you consent, we may share hashed (irreversibly encoded) versions of your email or phone number with Google and Meta so they can confirm that an advertisement led to a genuine action, without revealing your details in readable form.

Your choices

We apply consent controls (including Google Consent Mode) so that advertising and analytics cookies are set only where you allow them. You can change your cookie choices at any time through the cookie banner or your browser settings. Turning off non-essential cookies will not stop you from using the core Platform.

9. COMMUNICATIONS AND YOUR PREFERENCES

We contact you mainly through WhatsApp and email for offer updates and service messages, and through masked calls where a conversation is needed. Service messages that are essential to a purchase you have started (for example, a deposit confirmation or refund update) are part of providing the service. You can opt out of promotional messages at any time by using the unsubscribe link in an email, replying to stop on WhatsApp, or writing to admin@carbounty.com.

10. HOW LONG WE KEEP YOUR INFORMATION

We keep your personal data only for as long as it is needed for the purposes described in this Policy, or for as long as the law requires us to keep it. When your requirement is complete or withdrawn and no legal reason remains to retain it, we delete or irreversibly anonymise your personal data. Records tied to a completed transaction, a deposit, or a refund may be kept longer to meet tax, accounting and legal obligations.

11. HOW WE PROTECT YOUR INFORMATION

We apply reasonable security safeguards to protect your personal data against unauthorised access, disclosure, alteration and loss. These include encryption of data in transit, access controls that limit who can see your information, and regular review of our systems. No method of transmission or storage is completely secure, but we work to protect your data and, in the event of a personal data breach, we will act in line with the DPDP framework, including notifying you and the Data Protection Board of India where required.

12. YOUR RIGHTS AS A DATA PRINCIPAL

Under the DPDP framework, you have the following rights over your personal data:

● The right to access a summary of the personal data we hold about you and how we process it.

● The right to correction, completion and updating of your personal data.

● The right to erasure of your personal data where it is no longer needed and no law requires us to keep it.

● The right to withdraw your consent at any time, as easily as you gave it. Withdrawing consent does not affect processing already carried out.

● The right to nominate another individual to exercise your rights in the event of your death or incapacity.

● The right to grievance redressal (see Section 13).

To exercise any of these rights, write to us at admin@carbounty.com. We may need to verify your identity before acting on your request, and we will respond within the timelines set by law.

13. GRIEVANCE REDRESSAL

If you have a concern about how we handle your personal data, please contact our Grievance Officer:

● Grievance Officer: Piyush Anand, Founder & CEO.

● Email: admin@carbounty.com.

● Address: urbanFleet Technology Private Limited, Omaxe Celebration Mall, Sector 48, Sohna Road, Gurugram, Haryana.

We will acknowledge and address your grievance within the timelines required under the DPDP framework. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

14. CHILDREN’S DATA

The Platform is intended for individuals aged 18 and above. We do not knowingly collect the personal data of anyone under 18. We do not use children’s data for tracking or targeted advertising. If you believe a minor has provided us with personal data, please contact us at admin@carbounty.com and we will delete it.

15. THIRD-PARTY LINKS

The Platform may contain links to websites operated by others, such as a dealership or a payment provider. This Policy does not cover those websites. We encourage you to read their privacy policies before sharing information with them.

16. CHANGES TO THIS POLICY

We may update this Policy from time to time to reflect changes in our services or in the law. When we make a material change, we will post the updated Policy on the Platform and update the effective date at the top. Where required, we will also notify you directly.

17. CONTACT US

For any questions about this Policy or your personal data:

urbanFleet Technology Private Limited (CarBounty)

Email: admin@carbounty.com

Address: Omaxe Celebration Mall, Sector 48, Sohna Road, Gurugram, Haryana

Website: carbounty.com

urbanFleet Technology Private Limited