Privacy Policy
Effective: 17 October 2026 · Operated by Industrodrome India Research Private Limited
This Privacy Policy explains how Industrodrome India Research Private Limited handles personal data when you use the Dypzo website and platform. It is written to align with the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the rules made under it as they come into force, the Information Technology Act, 2000 (the IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules).
1.Who we are
Industrodrome India Research Private Limited (we, us, our) operates Dypzo. Our registered office is at No. 220, 5/2, 5/3, Prestige Kew Gardens, Yemalur, Bengaluru, Karnataka 560037, India. Our CIN is U85220KA2023PTC180781.
For the personal data of our own users (the people who register for and use Dypzo, and the contacts of the businesses we deal with), we decide why and how the data is processed. We are the data fiduciary for that data under the DPDP Act.
For the personal data of a Merchant's End Customers that a Merchant processes through Dypzo, the Merchant decides why and how it is processed. For that data, the Merchant is the data fiduciary and we act as its data processor, processing it on the Merchant's instructions. Terms used here, such as Merchant, Supplier and Courier Partner, have the meaning given in our Terms and Conditions.
Dypzo is for businesses. It is not meant for personal or consumer use.
2.Personal data we collect
We collect the following kinds of personal data, depending on how you use Dypzo:
| Category | Examples |
|---|---|
| Account and contact details | Name, email address, mobile number, job title, business name, sign-in credentials (passwords are stored in a protected, one-way form), and records of sign-in and verification. |
| Business and KYC details | GSTIN, PAN, company registration details, business address, bank account details for payouts (account holder name, account number, IFSC), and documents you upload to verify your business. |
| Order and shipment data | Orders, products, prices, shipments, tracking updates, returns, COD collection and remittance records, wallet charges, top-ups and payouts. This includes End Customer delivery details (name, phone number, address and email) that Merchants process through us. |
| Payment records | Records of top-ups and payments, such as the payment reference, amount and status reported by the payment gateway. Card, UPI and bank credentials are entered with the payment gateway and are handled by it. |
| Connected-service data | Orders, products and store details we receive from a store platform such as Shopify, within the permissions you approve. |
| Device and log data | IP address, browser and device type, pages and actions in the application, timestamps, error records and security events. |
| Communications | Messages you send us by email or through support, and the details you give in them. |
The Dypzo website at dypzo.com does not collect personal data by itself. It sets no cookies and has no forms that send data to us. If you write to us from it, your email app sends the message, not the website.
3.Why we use personal data
We use personal data for these purposes:
- to create and run your account, verify your identity and your business, and give you the Platform;
- to process orders: sending them to Suppliers, booking shipments with Courier Partners and showing tracking;
- to run the Wallet, take top-ups, reconcile COD remittances and make payouts, including tax deductions the law requires;
- to provide support and respond to your requests and complaints;
- to keep the Platform secure and to prevent, detect and investigate fraud, abuse and misuse, including risk checks on orders;
- to comply with the law, including tax, accounting and anti-money-laundering obligations, and to respond to lawful requests from authorities;
- to send you service messages, such as order, payment, security and policy notices;
- to understand how the Platform is used and to improve it, using operational and, where possible, aggregated data; and
- to establish, exercise or defend legal claims.
We do not sell personal data.
4.Our legal basis
We process personal data on the basis of your consent, which you give, for example, when you create an account, submit your KYC details or connect a store. You can withdraw consent at any time, as set out in section 9. Withdrawing consent does not affect processing already done, and it may mean we can no longer provide the Platform to you.
We also process personal data for the legitimate uses the DPDP Act allows without consent. These include using data you have voluntarily given us for the purpose for which you gave it, complying with the law or a court order, and responding to a medical emergency or a threat to life or health.
Bank account details, passwords and certain other financial details are sensitive personal data or information under the SPDI Rules. We collect them with your consent, only for a lawful purpose connected with the Platform, and we handle them with the security measures described in section 8.
5.Who we share personal data with
We share personal data only as needed for the purposes above, with:
- Suppliers, who receive the order and End Customer delivery details needed to pack and hand over an order;
- Courier Partners, who receive pickup and delivery details to collect, deliver and, for COD, collect payment;
- payment gateways and banks, which process top-ups, payments and payouts under their own terms and privacy policies;
- e-commerce platforms you connect, such as Shopify, with which we exchange the order and product data your permissions allow;
- cloud hosting on Amazon Web Services in India (see section 6);
- email and messaging providers that deliver service messages for us;
- professional advisers, such as auditors and lawyers, under duties of confidence;
- government authorities, courts and regulators, where the law requires or a lawful order is made;
- a buyer or successor of our business, if we are reorganised, merged or sold, subject to this policy; and
- anyone else you ask us to share it with, or have agreed to.
Where we share data with a service provider acting for us, we require it to use the data only for our purposes and to protect it.
6.Where we store personal data
We store personal data in India. Production data is hosted on Amazon Web Services in the Mumbai region (ap-south-1), and encrypted backups are copied to the Hyderabad region (ap-south-2).
If personal data is ever transferred outside India, we will do so only to countries or territories that the Central Government has not restricted under the DPDP Act, and in line with the law.
7.How long we keep personal data
We keep personal data for as long as your account is active and as long as we need it for the purposes above.
After your account is closed, we keep the data we are required to keep by law. In particular, financial, invoicing, tax and accounting records are generally kept for 8 years, or for any longer period the law requires.
When we no longer need personal data, and the law does not require us to keep it, we delete it or make it anonymous within a reasonable time. Backups are overwritten on their regular cycle.
8.How we protect personal data
We use reasonable security practices and procedures appropriate to the data we hold. Our measures include encryption in transit using TLS and encryption at rest using keys managed in AWS Key Management Service, a web application firewall, multi-factor authentication for operator access, malware scanning of uploaded documents, screening of passwords against known breaches, and audit logging. See our Security page for details.
No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and the people affected, as the law requires.
9.Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we process about you and the processing we carry out;
- correct and complete inaccurate or incomplete personal data, and update it;
- erase personal data we no longer need, unless the law requires us to keep it;
- grievance redressal: to have a complaint about our handling of your data heard and answered (see section 12);
- nominate another person to exercise your rights if you die or become unable to; and
- withdraw consent at any time. Withdrawal is as easy as giving consent.
To exercise a right, write to support@dypzo.com from the email address on your account, say what you want, and give enough detail for us to find your data. We may ask you to verify your identity first. We aim to respond within the timelines in our Grievance Redressal page.
Some data we cannot erase or change straight away, for example because the law requires us to keep a financial record, or because it relates to a shipment that is still in progress.
If you are an End Customer of a Merchant, please contact that Merchant first: it decides how your data is used. We will help the Merchant to act on your request.
You agree to give accurate information, not to impersonate anyone and not to make false or frivolous complaints.
10.Children
Dypzo is a business service and is not meant for anyone under 18. We do not knowingly collect personal data of children. If we learn that we have, we will delete it. If you believe a child has given us data, write to support@dypzo.com.
11.Cookies
The Dypzo website sets no cookies and uses no analytics or advertising trackers. The Dypzo application uses only the cookies and local storage it needs to work. See the Cookie Policy.
12.Grievance Officer and the Data Protection Board
If you have a concern about how we handle your personal data, or want to use a right, write to our Grievance Officer:
- Devanshu Kaithwas, Founder and CEO (Grievance Officer)
- Industrodrome India Research Private Limited, No. 220, 5/2, 5/3, Prestige Kew Gardens, Yemalur, Bengaluru, Karnataka 560037, India
- Email: support@dypzo.com
We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. See Grievance Redressal for how complaints are handled.
If you are not satisfied with our response, you may make a complaint to the Data Protection Board of India, as provided under the DPDP Act. The Act expects you to use our grievance process first.
13.Links to other sites
The Dypzo website links only to Dypzo's own application. When you use other services, such as a store platform or a payment gateway, their own privacy policies apply.
14.Changes to this policy
We may update this policy as our service or the law changes. The effective date at the top shows when it last changed. For material changes we will notify you by email or in the Platform.
15.Contact us
Industrodrome India Research Private Limited, CIN U85220KA2023PTC180781. Registered office: No. 220, 5/2, 5/3, Prestige Kew Gardens, Yemalur, Bengaluru, Karnataka 560037, India.
Privacy questions and requests: support@dypzo.com.