Privacy Policy

Azumi Technologies Private Limited, a company incorporated under the Companies Act, 2013 bearing Corporate Identity Number U68200MH2026PTC473580 and having its registered office at 14-L, 6th Floor, 3, Navjeevan Society, Dr Dadasaheb, Mumbai Central, Mumbai, Mumbai, Maharashtra, India, 400008 (“Azumi”, “we”, “us” or “our”), operates a technology platform for the discovery, listing, marketing, purchase, sale and rental of residential and commercial real estate, together with related brokerage, advisory and transaction facilitation services (the “Platform”).

This Privacy Policy explains what personal data we collect about you, why we collect it, how we use and share it, how long we keep it, and the rights you have in relation to it. It is the notice required to be given by a Data Fiduciary under Section 5 of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) read with Rule 3 of the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), and it forms part of the information we publish under Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

In relation to the personal data described in this Policy, Azumi is the “Data Fiduciary” and you are the “Data Principal”, as those expressions are used in the DPDP Act.

This Policy should be read together with our Terms of Use, which govern your use of the Platform, and with any Master Platform Services Agreement you enter into with us if you go on to list a property or engage us in relation to a transaction.

This Policy is a single, complete notice. It covers all processing of personal data by Azumi in connection with the Platform, both the processing that applies to everyone who visits or registers, and the additional processing that arises only if you enter into a Master Platform Services Agreement with us. Clauses 4 and 6 distinguish the two.

Where a Master Platform Services Agreement allocates responsibility between us as Data Fiduciary and Data Processor, or imposes obligations on you in relation to another user’s personal data, those provisions operate in addition to this Policy and do not narrow it.

This Policy applies to every person whose personal data we process in connection with the Platform. That includes:

• (a)

  visitors to our website and mobile applications who have not registered an account;

• (b)

  persons who register an account, complete a profile, run searches, post listings or requirements, or make enquiries; and

• (c)

  persons who go on to enter into a Master Platform Services Agreement with us, whether as a seller, a buyer, a tenant, a landlord, a broker, a channel partner or a developer.

Most of this Policy applies to everyone in Clause 2.1. Where processing arises only because you have entered into a Master Platform Services Agreement, this Policy says so.

This Policy does not apply to the processing of personal data of our employees and consultants, which is dealt with in our internal employee privacy notice.

The Platform is intended only for persons who have attained eighteen years of age and are competent to contract under Section 11 of the Indian Contract Act, 1872. We do not knowingly collect or process the personal data of a child.

If we become aware that we have collected personal data of a child without the verifiable consent of a parent or lawful guardian as required by Section 9 of the DPDP Act and Rule 10 of the DPDP Rules, we will erase that data and close the associated account.

We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children.

If you believe a person under eighteen has registered on the Platform, please contact our Grievance Officer using the details in Clause 13.

If you visit, register on or use the Platform, we collect the following categories of personal data. Not every category applies to every user; what we collect depends on how you use the Platform.

If you enter into a Master Platform Services Agreement with us, we additionally collect the following, because the services under that agreement cannot be provided without it:

Where you provide us with personal data relating to another person — for example a co-owner, a family member, an authorised representative or a tenant, you confirm that you are authorised to do so and that you have informed that person of this Policy.

We collect personal data directly from you when you register, complete your profile, list a property, run a search, make an enquiry, communicate through the Platform, or correspond with our team.

We collect technical and usage data automatically when you use the Platform, through server logs and the technologies described in Clause 11.

We may receive personal data from third parties, including verification agencies, public registries, municipal records, developers, brokers, and other users who identify you in connection with a transaction.

The Platform may allow you to register or sign in using credentials held with a third-party service, including a social media account, an email or messaging account, or any other identity provider (each a “Third-Party Service”). The Third-Party Services available for this purpose may change from time to time.

Where you register or sign in through a Third-Party Service, we receive from that provider the personal data you authorise it to disclose to us. That ordinarily comprises your name, email address and an account identifier, and may include your telephone number and profile photograph, depending on the provider and on the permissions you grant. We do not receive your password for that service.

Personal data received from a Third-Party Service is processed for the purposes set out in Clause 7 and is otherwise subject to this Policy in the same way as personal data you give us directly.

The collection and use of your personal data by the Third-Party Service itself is governed by that provider’s own privacy policy and terms, and not by this Policy. We do not control that provider and are not responsible for its practices. You should read its privacy policy before you sign in, and keep yourself informed of any change to it.

You may disconnect a Third-Party Service from your account at any time from your account settings. Disconnecting stops further disclosure to us but does not by itself erase personal data already received. To have that erased, use the rights in Clause 14.

The Platform integrates services supplied by third parties, including hosting, communications, messaging, telephony, mapping, analytics, electronic signature, customer support and payment providers. Where such a provider processes personal data on our documented instructions it acts as a Data Processor and is bound as described in Clause 9.1(b). Where a provider acts on its own account, its own privacy policy governs that processing.

The Platform may contain links to websites and applications operated by others, including developers, brokers, financial institutions, valuers and government portals. We do not control those sites and are not responsible for their content, security or privacy practices. This Policy ceases to apply once you leave the Platform, and the privacy policy of the site you visit will apply instead.

If you visit, register on or use the Platform, we process personal data for the following specified purposes:

If you enter into a Master Platform Services Agreement with us, we additionally process personal data for these purposes:

We will not process your personal data for any purpose other than those listed above, or a purpose you have separately consented to, or a purpose permitted by law.

We do not sell personal data.

We do not use your personal data to make any decision about you that produces a legal or similarly significant effect solely by automated means.

Where we process your personal data on the basis of consent, that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and is limited to the personal data necessary for the specified purpose.

You may withdraw your consent at any time. Withdrawal is as easy as giving consent, and may be done from your account settings or by writing to our Grievance Officer.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal we will cease processing and erase the relevant personal data within a reasonable time, unless we are required or permitted by law to retain it, in which case we will tell you what we are retaining and why.

Withdrawing consent to processing that is necessary for the Platform to function will mean that we can no longer provide you with the relevant Services, and we may close your account. Any consequences of withdrawal will be borne by you.

Once the framework for Consent Managers under Section 6(7) of the DPDP Act and Rule 4 of the DPDP Rules is operational, you will be able to give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India.

We share personal data only as described below.

• (a)

  With other users. Where you list a property, the particulars of the property and such of your contact details as you have chosen to publish are made available to prospective counterparties. Where you enquire about a property, your name and contact details are made available to the person offering it and to the broker or developer concerned, so that your enquiry can be answered.

• (b)

  With service providers. We share personal data with providers who process it on our instructions, including hosting and cloud providers, communication and messaging providers, analytics providers, customer support tools, verification agencies and professional advisers. Each is bound by contract to process the data only on our documented instructions, to apply reasonable security safeguards, and to notify us of any personal data breach.

• (c)

  With financial institutions. Where you have engaged us under a Master Platform Services Agreement and ask us to, we share particulars with banks and housing finance companies so that they can assess a loan application.

• (d)

  With authorities. We disclose personal data where required by law or by a competent authority, including under the Real Estate (Regulation and Development) Act, 2016, the Income-tax Act, 1961 and the Code of Criminal Procedure as replaced by the Bharatiya Nagarik Suraksha Sanhita, 2023. Where lawful and practicable, we will tell you before we do so.

• (e)

  On a business transfer. If our business is merged, acquired or reorganised, personal data may be transferred to the successor entity, which will be bound by this Policy or by a policy no less protective.

We do not disclose your personal data to any other person for that person’s own marketing purposes.

Our Terms of Use, and any Master Platform Services Agreement between us, restrict what another user may do with personal data of yours that we disclose to them. Those restrictions are contractual obligations on that user; they are recorded here so that you know they exist.

We retain personal data only for as long as is necessary for the purpose for which it was collected, or for as long as we are required to retain it by law.

Where you have entered into a Master Platform Services Agreement with us, records relating to a concluded transaction are retained for the period prescribed under Section 10 of the Real Estate (Regulation and Development) Act, 2016 and the rules made thereunder, and for the period required under tax law. Records relating to our fees are retained for eight years from the end of the relevant financial year. If you have only browsed or registered, these longer periods do not apply to you.

Where you have not engaged with your account for a continuous period of 12 months, and we are under no legal obligation to retain your personal data, we will erase it. We will give you at least forty-eight hours’ notice before doing so, in accordance with Rule 8 of the DPDP Rules, so that you may log in and prevent erasure if you wish.

We retain logs and records of processing for not less than one year, for the purpose of detecting, investigating and remedying unauthorised access.

On erasure we will also instruct our Data Processors to erase the personal data, unless retention is required by law.

We implement reasonable security safeguards to prevent personal data breaches, in accordance with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules. These include encryption of data in transit and at rest, masking or tokenisation where appropriate, role-based access control, logging and monitoring of access, secure backups, periodic security testing, and contractual security obligations on our Data Processors.

No system is entirely secure. You are responsible for keeping your account credentials confidential and for notifying us promptly if you believe your account has been compromised.

If a personal data breach occurs, we will intimate each affected Data Principal without delay, describing in plain language the nature and extent of the breach, the personal data affected, the measures we have taken, the measures you may take to protect yourself, and how to contact us. We will also intimate the Data Protection Board of India without delay and will furnish the detailed report required within seventy-two hours of becoming aware of the breach, in accordance with Rule 7 of the DPDP Rules.

We use cookies and similar technologies to keep you signed in, to remember your preferences, to measure how the Platform is used, and to improve it.

We currently use analytics cookies only, through Google Analytics, to help us understand how the Platform is used. We do not currently use strictly necessary, functional or advertising cookies. We obtain your consent before analytics cookies are set, and you may change your choice at any time through our cookie settings.

You may also configure your browser to refuse cookies, although parts of the Platform may then not function.

The cookies currently set on the Platform are:

Personal data collected through the Platform is stored on servers located in India.

Where we transfer personal data outside India — for example because a hosting, communications or analytics provider processes data abroad — we do so in accordance with Section 16 of the DPDP Act. We do not transfer personal data to any country or territory in respect of which the Central Government has notified a restriction.

A transfer outside India does not reduce our obligations to you under this Policy or under the DPDP Act.

As a Data Principal you have the following rights under Chapter III of the DPDP Act:

• (a)

  Access. To obtain a summary of the personal data we process about you, the processing activities we undertake, and the identities of the Data Fiduciaries and Data Processors with whom we have shared it.

• (b)

  Correction and completion. To have inaccurate or misleading personal data corrected, and incomplete personal data completed and updated.

• (c)

  Erasure. To have your personal data erased, unless retention is necessary for the specified purpose or is required by law.

• (d)

  Grievance redressal. To a readily available means of grievance redressal in respect of any act or omission of ours regarding your rights.

• (e)

  Nomination. To nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, write to our Grievance Officer at the address in Clause 14, or use the request facility in your account settings. We will respond within 15 days of receiving your request and, where we are unable to act on it, will tell you why.

We may ask you to verify your identity before acting on a request, so that we do not disclose personal data to the wrong person.

Section 15 of the DPDP Act places certain duties on you as a Data Principal, including not impersonating another person when furnishing personal data, not suppressing material information, not registering a false or frivolous grievance, and furnishing only authentic information when exercising the right of correction.

If you have a question or complaint about how we handle your personal data, please contact:

We will acknowledge your grievance within twenty-four hours and will resolve it within fifteen days of receipt, in accordance with Rule 3(2)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

If you are not satisfied with our response, or if we do not respond within the period stated above, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act.

We may amend this Policy from time to time. Where an amendment is material, we will notify you by email or through the Platform before it takes effect, and where the amendment requires your consent we will obtain it.

The date at the head of this Policy records when it was last updated. Previous versions are available on request.

This Policy is governed by the laws of India. Subject to the dispute resolution provisions of our Terms of Use, the courts at Mumbai shall have jurisdiction.