DIGITAL PERSONAL DATA PROTECTION POLICY

Policy adopted and approved in the Board Meeting dated 07/04/2026

DIGITAL PERSONAL DATA PROTECTION POLICY

[Formulated under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025]

Policy adopted and approved in the Board Meeting dated 07/04/2026

1. Introduction and Purpose

This Digital Personal Data Protection Policy (“Policy”) is formulated in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified thereunder, as applicable to the Organisation from time to time.

Logix Built Solutions Limited (“Organisation”, “We”, “Us”, or “Our”) owns and operates “Pandits Near Me”, an integrated spiritual services discovery and booking platform accessible via website (https://panditsnearme.com/) and mobile application (the “Platform”). The Platform connects individuals seeking puja, homa, astrology, rituals, and related spiritual services (“Devotees”) with independent Vedic priests and astrologers (“Pandits”) registered on the Platform. We are committed to processing the digital personal data of both Devotees and Pandits lawfully, fairly, transparently, and securely.

This Policy sets out the principles, procedures, technical standards, and operational obligations governing the collection, processing, storage, security, disclosure, and transfer of the personal data of individuals (“Data Principals”) who interact with the Platform. This Policy is intended to:

  • Establish a robust internal governance framework for comprehensive compliance with the DPDP Act and DPDP Rules across all Platform operations, digital workflows, and user engagements.
  • Protect, uphold, and give full effect to the statutory rights of Devotees and Pandits as Data Principals under Indian data privacy law.
  • Define clear roles, standards of care, and operational responsibilities for internal Personnel handling personal data collected through the Platform.
  • Establish appropriate contractual, confidentiality, and data protection benchmarks for third-party service providers, cloud infrastructure vendors, and payment intermediaries.
  • Foster an organisation-wide institutional culture of data minimization, purpose limitation, technological security, and regulatory accountability.

2. Scope and Applicability

2.1 Scope of Activities

This Policy applies to:

  • All processing of digital personal data carried out by or on behalf of the Organisation within the territory of India in connection with the Platform, including personal data collected in digital form or collected in non-digital form (for example, through customer support representatives over telephone or manual booking forms) and subsequently digitised.
  • Processing of digital personal data outside India, where such processing is in connection with offering the Platform's services or spiritual consultations to Data Principals within the territory of India.
  • All directors, officers, permanent employees, temporary employees, contractors, consultants, and other persons acting under the Organisation’s direct authority who are authorized to handle personal data on behalf of the Organisation (“Personnel”).
  • All personal data collected across all user interfaces, including registration forms, booking forms, Pandit onboarding workflows, consultation requests, customer care channels, WhatsApp communications, and backend administration consoles.
2.2 Statutory Exclusions

This Policy does not apply to:

  • Personal data processed by an individual for any purely personal or domestic purpose.
  • Personal data that is made or caused to be made publicly available by the Data Principal to whom such personal data relates, or by any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.

3. Definitions

Unless the context otherwise requires, capitalized terms used in this Policy shall carry the meaning assigned to them under the DPDP Act and DPDP Rules:

  • “Act” or “DPDP Act”: Means the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), and any statutory modifications or re-enactments thereof from time to time.
  • “Consent”: Means any freely given, specific, informed, unconditional, and unambiguous indication of the Data Principal's wishes, signified through a clear affirmative action, agreeing to the processing of their personal data for a specified purpose.
  • “Consent Manager”: Means a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
  • “Data Fiduciary”: Means any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data. Where the Organisation determines the purpose and means of processing personal datathrough the Platform, the Organisation shall act as a Data Fiduciary. Where the Organisation processes personal data solely on behalf of another Data Fiduciary and in accordance with its documented instructions, the Organisation shall act as a Data Processor to the extent applicable under the DPDP Act and DPDP Rules.
  • “Data Principal”: Means the individual to whom the personal data relates, and includes both a “Devotee” and a “Pandit” as defined herein, as well as the parent or lawful guardian in the case of a child, or the lawful guardian in the case of a person with disability.
  • “Data Processor”: Means any person who processes personal data on behalf of a Data Fiduciary under a valid contract.
  • “Devotee”: Means any individual user who accesses or registers on the Platform to discover, request, schedule, book, or avail puja, homa, astrology, ritual, or spiritual coordination services.
  • “Pandit”: Means an individual priest, purohit, vedic scholar, or astrologer who applies for registration or is empanelled on the Platform to render spiritual, ritual, or consultation services to Devotees.
  • “Personal Data”: Means any data about an individual who is identifiable by or in relation to such data.
  • “Personal Data Breach”: Means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data.
  • “Platform”: Means the website https://panditsnearme.com/, mobile applications, and associated digital properties operated by the Organisation under the brand name “Pandits Near Me”.
  • “Processing”: Means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination, restriction, erasure, or destruction.
  • “Significant Data Fiduciary” or “SDF”: Means any Data Fiduciary or class of Data Fiduciaries notified as such by the Central Government under Section 10 of the DPDP Act, having regard to statutory factors such as data volume, sensitivity, and systemic impact.

4. Categories of Data Principals and Personal Data Processed

The Platform processes digital personal data across distinct categories of Data Principals, strictly adhering to the principle of data minimisation. The Organisation does not collect data that is extraneous to the stated spiritual, verification, and facilitation purposes.

4.1 Devotees / Platform Users
  • Identity & Contact Data: Full name, gender, WhatsApp number, primary mobile number, city, location, and communication details voluntarily submitted during registration, inquiry, or booking. Primary communications and service updates are transmitted via WhatsApp.
  • Birth & Astrological Data: Date of birth, time of birth, and place of birth (of the Devotee or of the specific family member for whom the ritual or consultation is sought), collected strictly when necessary for Kundali preparation, horoscope matching, and auspicious muhurat determination. Where a Devotee provides personal data of a third-party individual, the Devotee represents that they are duly authorized to share such data.
  • Booking, Ritual & Consultation Data: Selected puja/ritual/service requested, preferred Pandit/language/sampradaya preference, scheduled date and time window, ceremony venue address, specific ritual samagri instructions, and names/gotra details voluntarily provided for the sankalp ceremony.
  • Financial & Payment Data: Booking amount, payment transaction identifiers, payment status, and reconciliation records. Detailed payment credentials (such as credit/debit card numbers, CVV, net banking passwords, or UPI PIN) are processed directly by authorized third-party payment gateways and are not stored by the Organisation.
  • Technical, Location & Usage Data: IP address, browser type, device identifiers, session cookies, activity logs, and, where the Devotee explicitly enables device location access, device GPS location data used solely to display nearby Pandits or check local service availability.
4.2 Pandits / Empanelled Priests
  • Identity & Contact Data: Full name, mobile number, WhatsApp number, residential address, city, state, country, and service territory. (Date of birth, age records, educational degrees/padvis, and profile photographs are not collected on the Platform).
  • Professional Profile Data: Vedic and ritual expertise, specific pujas capable of performing, and languages spoken, collected for the purpose of creating and maintaining the public Pandit profile.
  • Government-Issued Identity Documents: A copy of the Aadhaar Card, collected solely for offline/manual identity verification and onboarding by the internal sales/empanelment team. (PAN cards, experience certificates, and bank account payout credentials are not collected).
  • Technical & Usage Telemetry: IP address, device identifiers, app version, and login session logs captured during portal interactions.
4.3 All Platform Users (Common Categories)
  • Consultation Communication Data: Recordings and transcripts of phone, chat, or video consultations between Devotees and Pandits, collected strictly where the Data Principal has provided separate, explicit opt-in consent for quality assurance, safety, and dispute resolution.
  • Special Safeguards on Aadhaar Records: Aadhaar Card copies collected from Pandits for manual onboarding verification are subject to strict data handling controls. Aadhaar documents shall be stored in a restricted-access repository with server-side encryption. The corresponding object path and file metadata maintained in the application database shall be protected through appropriate access controls and encryption. Access to stored identity documents shall be granted only to authorized compliance Personnel through application-controlled, time-limited access mechanisms. Aadhaar records shall never be displayed to Devotees or made part of any public directory. The Platform does not conduct online Aadhaar e-KYC authentication unless specifically permissible and authorized under the Aadhaar Act and UIDAI regulations.

5. Grounds for Processing Personal Data

The Organisation shall process personal data of Devotees and Pandits only in accordance with the provisions of the DPDP Act and for a lawful purpose, based on valid consent under Section 6 or recognized legitimate uses under Section 7 of the Act.

5.1 Consent Framework
  • Where consent is the applicable basis for processing, such consent must be free, specific, informed, unconditional, and unambiguous, signified through a clear affirmative opt-in action. Pre-ticked checkboxes, bundled terms, or default opt-ins are strictly prohibited across both Devotee booking forms and Pandit onboarding workflows.
  • Every request for consent shall be accompanied or preceded by an itemised notice in plain, comprehensible language, describing the personal data sought, specified purpose(s), manner of exercising rights, and grievance redressal channels.
  • The Data Principal may withdraw consent at any time, with the ease of withdrawal being comparable to the ease with which consent was granted. Upon receiving a valid withdrawal request, the Organisation shall cease processing based on that consent within a reasonable time and cause its Data Processors to cease processing, unless retention is required or permitted under applicable law.
  • Where the Organisation integrates with a registered Consent Manager, Data Principals may review, manage, or withdraw consent through that platform.
  • For Data Principals who are children (under 18 years of age) or persons with disabilities having a lawful guardian, verifiable consent shall be obtained from the parent or lawful guardian prior to processing, using reasonable verification measures.
5.2 Certain Legitimate Uses (Section 7)

The Organisation may process personal data without separate consent where such processing is permitted as a “certain legitimate use” under Section 7 of the DPDP Act, as applicable to the relevant processing activity, including:

  • For the specified purpose for which the Data Principal has voluntarily provided their personal data to the Organisation, and in respect of which they have not indicated that they do not consent to its use.
  • For compliance with any judgment, decree, or order issued under any law in India, or any order relating to claims of a civil or contractual nature under law outside India.
  • For compliance with any legal obligation under any Indian law to disclose information to the State or its instrumentalities.
  • For responding to a medical emergency involving a threat to the life or immediate health of the Data Principal or any other individual.
  • For taking measures to ensure safety or provide assistance during a disaster or breakdown of public order.
  • For purposes related to employment, where applicable, and for protecting the Organisation from loss or liability, including prevention of fraud, impersonation, or misrepresentation of professional credentials, to the extent permitted under the DPDP Act and applicable law.
  • The Organisation may also rely on any other certain legitimate use expressly recognised under Section 7 of the DPDP Act, where applicable.

6. Processing of Personal Data of Children and Persons with Disabilities

The Platform maintains rigorous statutory safeguards regarding minors and vulnerable individuals:

  • Before processing any personal data of a child (an individual below 18 years of age) or a person with disability having a lawful guardian (such as birth data provided for Namkaran, Mundan, or astrological consultations), the Organisation shall obtain verifiable consent from the parent or lawful guardian.
  • The Organisation shall not undertake tracking, behavioural monitoring, or targeted advertising directed at children, and shall not process children’s personal data in a manner likely to cause any detrimental effect on their wellbeing, except to the extent expressly permitted under the DPDP Act, DPDP Rules, or an applicable lawful exemption.
  • Registration and empanelment as a Pandit on the Platform is strictly restricted to individuals who have attained 18 years of age. The Organisation verifies age and legal capacity during the Pandit onboarding and document verification process.

7. Obligations of the Organisation as Data Fiduciary

7.1 Purpose Limitation and Data Minimisation

Personal data of Devotees and Pandits shall be collected and processed strictly for the specified purpose(s) disclosed in the applicable notice, and limited to such personal data as is reasonably necessary to fulfil that purpose.

7.2 Data Accuracy, Completeness and Consistency

The Organisation shall take reasonable steps to ensure that personal data processed by it or on its behalf—including a Pandit's stated Vedic expertise, contact information, and identity records, and a Devotee's birth details used for Kundali preparation or muhurat determination—is accurate, complete, and, where necessary for the specified purpose, kept up to date, particularly where such data is likely to be used to inform a Devotee's choice of Pandit or to provide the requested spiritual service.

7.3 Storage Limitation and Erasure

Personal data shall not be retained beyond the period necessary for the specified purpose, or beyond any applicable retention period prescribed under the DPDP Act, DPDP Rules, or other applicable law, unless further retention is required or permitted by law.

Where the Organisation is subject to a prescribed retention or erasure requirement under the DPDP Rules that requires prior notice to the Data Principal before erasure, the Organisation shall provide such notice in the manner and within the timeframe prescribed under applicable law.

Where processing is based on consent, upon withdrawal of consent, or where the specified purpose is no longer being served, whichever is earlier, the Organisation shall erase the relevant personal data and cause its Data Processors to erase such data, unless retention is required for legal, tax, dispute-resolution, or statutory compliance.

7.4 Reasonable Technical and Organisational Security Safeguards

The Organisation shall implement reasonable technical and organisational measures appropriate to the nature, scope, context, and risks of the processing, including:

  • Encryption of personal data in transit using TLS 1.3 / HTTPS protocols and industry-standard server-side encryption at rest.
  • Granular access controls restricting access to verification records, contact databases, and transaction logs strictly to authorized personnel on a need-to-know basis.
  • Continuous logging, monitoring, and administrative access audits to detect, prevent, address, and mitigate unauthorized access or data breaches.
  • Operational measures and backup redundancies designed to maintain business continuity and disaster recovery.
  • Enhanced access restrictions and segregated storage for Aadhaar identity records of Pandits as outlined in Section 4.3.
7.5 Personal Data Breach Incident Management

On becoming aware of a personal data breach, the Organisation shall notify the Data Protection Board of India and affected Data Principals, as applicable, without undue delay and in the form, manner, and within the timelines prescribed under the DPDP Act and DPDP Rules.

The Organisation maintains a documented Incident Response Plan. Appropriate personnel shall investigate, contain, and remediate any security incident, and comprehensive breach logs shall be maintained for regulatory inspection. Incident notifications required under CERT-In directives shall be executed in parallel.

7.6 Grievance Redressal Mechanism

The Organisation shall maintain an effective, accessible, and transparent grievance redressal mechanism through its designated Grievance Officer, available to both Devotees and Pandits, and shall address grievances within the timeline prescribed under applicable law.

7.7 Data Processor Oversight

Where the Organisation engages Data Processors (including payment aggregators, cloud infrastructure hosts, communication delivery networks, and customer support vendors), it shall do so under appropriate written contractual arrangements requiring confidentiality, applicable data protection and security safeguards, and notification of personal data breaches within the timeframe specified in applicable law and the relevant agreement.

8. Sharing and Disclosure of Personal Data

Given the core functionality of the Platform in connecting Devotees with Pandits, data sharing between users and with third parties is strictly regulated as follows:

  • To Devotees: Only a Pandit's authorized public profile information (full name, Vedic expertise, languages spoken, and pujas performed) is displayed. A Pandit's Aadhaar copy, residential address, and restricted verification records shall never be disclosed to Devotees, except where required or permitted by applicable law.
  • To Assigned Pandits: Only the minimum personal data reasonably necessary to render or coordinate the requested service, which may include the Devotee's name, WhatsApp/contact number, ceremony venue address, requested ritual, and, where necessary for the ritual or astrological consultation, relevant birth details or sankalp names. Payment instrument credentials are never shared with Pandits.
  • To Data Processors & Technical Partners: Cloud hosting platforms, database managers, SMS and WhatsApp Business gateways, and OTP service providers engaged under binding DPAs.
  • To Financial Institutions: Authorized payment gateways for online transaction processing, settlements, and refunds.
  • Statutory & Regulatory Disclosures: Personal Data shall not be disclosed to recipients or for purposes materially different from those described above where consent is the applicable basis for such processing, unless such disclosure or processing is otherwise permitted or required under the DPDP Act, DPDP Rules, or other applicable law.

9. Rights of Data Principals

Under the DPDP Act and DPDP Rules, Devotees and Pandits are entitled to exercise the following statutory rights:

  • Right to Access Information: To obtain, in the manner prescribed under applicable law, a summary of personal data being processed, details of processing activities undertaken, and the identities of Data Processors and other Data Fiduciaries with whom personal data has been shared, together with a description of the personal data so shared, subject to applicable legal exceptions.
  • Right to Correction, Completion, Updating and Erasure: To request correction of inaccurate or misleading personal data, completion of incomplete data, updating of records, and erasure of personal data where applicable under the DPDP Act and DPDP Rules, subject to applicable legal, contractual, and statutory retention requirements.
  • Right to Grievance Redressal: To access readily available grievance redressal mechanisms regarding any act or omission of the Organisation in relation to their personal data.
  • Right to Nominate: To nominate another individual to exercise statutory rights on their behalf in the event of death or incapacity, in the prescribed manner.
  • Right to Withdraw Consent: To withdraw consent at any time, with the same ease with which it was given, where processing is based on consent. Where continued Platform empanelment requires processing of personal data for a specified verification purpose and that processing is based on consent, withdrawal of such consent may result in suspension or de-empanelment where the Organisation can no longer lawfully maintain the Pandit's verified profile or provide Platform services.

10. Duties of Data Principals

In accordance with Section 15 of the DPDP Act, Devotees and Pandits shall:

  • Comply with the provisions of all applicable laws for the time being in force while exercising rights under the Act.
  • Ensure not to impersonate another person while providing personal data for a specified purpose.
  • Ensure not to suppress any material information while providing personal data for any document, unique identifier, proof of identity, or proof of address issued by the State or its instrumentalities.
  • Not knowingly provide false or materially misleading information required for registration, verification, empanelment, or use of the Platform.
  • Ensure not to register a false or frivolous grievance or complaint with the Organisation or the Data Protection Board of India.
  • Furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

11. Cross-Border Transfer of Personal Data

The Organisation may transfer personal data outside India, including to Data Processors, where permitted under applicable law. Any such transfer shall be subject to applicable requirements or restrictions prescribed by the Central Government, as well as appropriate contractual, technical, and organisational safeguards. Such transfer shall not affect the rights of Data Principals under applicable law.

12. Additional Obligations Where the Organisation is a Significant Data Fiduciary

As of the date of this Policy, the Organisation has not been notified as a Significant Data Fiduciary under Section 10 of the DPDP Act. If the Organisation is so notified in future, it shall fulfill the following additional statutory obligations:

  • Appoint a Data Protection Officer based in India, who shall represent the Organisation, be responsible to the Board of Directors, and act as the point of contact for grievance redressal.
  • Appoint an independent data auditor to carry out periodic data audits of its processing activities and compliance.
  • Undertake periodic Data Protection Impact Assessments (DPIA) and audits at the intervals and in the manner prescribed under the DPDP Act and DPDP Rules, including in relation to algorithmic tools deployed for matching Devotees with Pandits.

13. Grievance Officer / Authorised Privacy Contact Person

The Organisation has designated the following person as its Grievance Officer to oversee compliance with this Policy and the DPDP Act in relation to the Platform, and to act as the official point of contact for Devotees, Pandits, and the Data Protection Board of India:

Name: Mr. Chirag Patel | Designation: Chief Technology Officer & Grievance Officer

Email Address: cp@logixbuilt.com | Contact Number: +91-9724676277

Address: Sh. 314 - 322, Sahaj Icon, Near Prime Arcade, A M Road, Adajan, Surat - 395009, Gujarat, India

General Platform Inquiries: info@logixbuilt.com / info@panditsnearme.com

14. Training and Awareness

The Organisation shall conduct periodic training and awareness programmes for its Personnel—specifically staff handling Pandit onboarding, manual Aadhaar verification, Devotee booking coordination, and IT system management—on the principles of this Policy, data confidentiality, and statutory obligations under the DPDP Act.

15. Phased Implementation Timeline

The Organisation recognises that the DPDP Act and DPDP Rules are subject to the applicable commencement and implementation schedule notified by the Central Government. The Organisation shall align the Platform's technical systems, contracts, and operational processes with each applicable requirement by the relevant statutory commencement date, and this Policy shall be read consistently with the commencement schedule in force from time to time.

16. Policy Review, Governance and Updates

This Policy shall be reviewed at least annually, and additionally whenever necessitated by a change in data protection legislation, judicial directions, or Platform features. Amendments shall be approved in accordance with the Organisation’s corporate governance framework and communicated to relevant stakeholders.

17. Consequences of Non-Compliance and Statutory Penalties

Non-compliance with this Policy by any Personnel may result in disciplinary action, up to and including termination of employment or contract, subject to applicable law and terms of employment or contract, without prejudice to statutory or contractual liabilities. The Data Protection Board of India may impose monetary penalties and take such other action as may be prescribed under the DPDP Act, DPDP Rules, and applicable law, as amended from time to time, for breaches of statutory obligations.