India DPDP Act Compliance

1-1Purpose of This Notice

This document supplements our Privacy Policy with India-specific information about data fiduciary responsibilities, user rights, grievance redressal, and intermediary due diligence.

It is provided for transparency and operational guidance. It does not constitute legal advice.

1-2Data Fiduciary

For personal data covered by the DPDP Act, Listifys acts as a Data Fiduciary when we determine the purpose and means of processing through the Platform, except where we process data solely on behalf of another entity as a Data Processor under contract.

2-1Personal Data We Process

• Registration details: name, mobile number, email, city, language preference
• Account and trust data: phone and email verification status, and business registration details where a seller provides them
• Marketplace activity: listings, photos, messages, offers, reviews, transaction metadata
• Payment and payout information processed through regulated partners
• Device and log data: IP address, app version, crash reports, security events
• Grievance and moderation records relating to user reports

2-2Lawful Processing Grounds

We process personal data for specified purposes based on consent where required, and otherwise for legitimate uses permitted under the DPDP Act, including performance of a contract, compliance with law, and certain legitimate interests consistent with user expectations for a marketplace service.

For children, we do not knowingly offer account registration below eighteen (18) years of age. Where parental consent mechanisms are introduced for permitted minor use, we will implement verifiable consent workflows as required.

2-3Notice and Consent

At or before collection, we provide itemized notice describing data collected, purposes, retention, rights, and grievance contacts. Non-essential processing, including certain marketing or optional analytics, relies on consent that may be withdrawn through settings or contact@listifys.com.

2-4Data Principal Rights

Submit rights requests to contact@listifys.com with sufficient identity verification. We respond within timelines prescribed under applicable rules, subject to permitted extensions for complex requests.

• Right to access information about personal data processed and sharing
• Right to correction and erasure subject to legal and transactional retention needs
• Right to grievance redressal and nomination of another individual to exercise rights in the event of death or incapacity where supported
• Right to withdraw consent for consent-based processing

3-1Retention

We retain personal data only as long as necessary for the purposes described in our Privacy Policy and Data Retention Policy, including open transactions, tax records, fraud investigations, and legal holds.

3-2Security Safeguards

We implement reasonable security safeguards including access controls, encryption for data in transit, monitoring for unauthorized access, vendor due diligence, and employee training. No method of transmission or storage is completely secure.

3-3Personal Data Breach

If we become aware of a personal data breach affecting users in India, we will take reasonable steps to mitigate harm and notify affected Data Principals and the Data Protection Board of India or other competent authority as required by applicable law.

4-1Transfer Outside India

Because Listifys is headquartered in the United States, personal data of Indian users may be stored or processed outside India through our infrastructure and subprocessors. We conduct transfers in accordance with DPDP Act requirements and government notifications on permissible destinations and safeguards.

4-2Processor Contracts

Vendors processing Indian personal data on our behalf are bound by contracts requiring confidentiality, security measures, deletion upon termination, and assistance with breach notification and rights requests.

5-1Reasonable Security Practices

For sensitive personal data or information as defined under the IT Act and SPDI Rules where still applicable to legacy categories, we follow reasonable security practices and procedures including managerial, technical, and operational controls proportionate to the data processed.

5-2Lawful Collection and Disclosure

We collect information lawfully and disclose it to government agencies only where required by valid legal process, emergency threat mitigation, or user consent, consistent with our Law Enforcement Request Policy.

6-1Due Diligence

As an intermediary, Listifys observes due diligence under Rule 3 of the IT Rules, including publishing rules and regulations, terms of use, and privacy policies; informing users not to host prohibited content; and providing mechanisms for grievance redressal and content complaints.

6-2Grievance Officer

Our India grievance contact is available at contact@listifys.com with subject line "India Grievance Officer." Complaints are acknowledged within twenty-four (24) hours and disposed of within fifteen (15) days for content and Platform grievances covered by the IT Rules, unless a longer period is permitted by law or required for investigation.

6-3Content Complaints

Users may report content that is defamatory, obscene, invasive of privacy, impersonation, or otherwise prohibited under Rule 3(1)(b). We may request clarifying information and take removal or visibility actions consistent with our Content Moderation Policy and legal obligations.

6-4Significant Social Media Intermediary Obligations

If Listifys meets thresholds for classification as a significant social media intermediary, we implement additional obligations including appointing India-based compliance roles, publishing periodic compliance reports, and enabling identification of the first originator of information only where required by law and technically feasible.

7-1Seller and Buyer Responsibilities

Listifys connects buyers and sellers. Sellers who qualify as traders under Indian consumer law are responsible for accurate disclosures, honor of lawful refund obligations, and product safety. Our Seller Policy and Buyer Policy describe Platform rules that support fair dealing.

7-2Consumer Protection Act, 2019

Nothing in this notice limits non-waivable rights of consumers under the Consumer Protection Act, 2019, including remedies for defective goods or deficient services purchased from sellers through the Platform.

8-1Contact Points

Data protection and privacy rights: contact@listifys.com

Grievance and intermediary complaints: contact@listifys.com

Law enforcement: contact@listifys.com

Postal address: Listifys, 1000 Bearcat Way Suite 105 Unit 5, Morrisville, NC 27560, USA | Workafella Cyber Crown HiTech City, 7th Floor HUDA Techno Enclave Madhapur, Hyderabad Telangana 500081, India

8-2Updates

We revise this notice as the DPDP Act rules, Board guidance, and intermediary obligations evolve. Material changes will be communicated through the Platform or email where appropriate.