Privacy Policy

Effective Date: 27 June 2026  |  Last Updated: 27 June 2026

This Privacy Policy explains how Vilkkanundo, the operator of vilkkanundo.com (the "Platform"), collects, uses, stores, shares, and protects your personal data, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules thereunder.

BY CREATING AN ACCOUNT, YOU CONSENT TO THE COLLECTION AND PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY. ACCOUNT CREATION IS ONLY PERMITTED AFTER YOU ACCEPT THIS POLICY VIA THE MANDATORY CONSENT CHECKBOX AT SIGN-UP.

1. Information We Collect

1.1 Information you provide directly

• Name, mobile number, email address, and password at registration
• Profile details (location, profile photo)
• Listing details — item description, price, category, images, location
• Communications with us (support requests, grievance complaints)

1.2 Information collected automatically

• Device information, IP address, browser type, operating system
• Usage data (pages viewed, searches, listings viewed/clicked, login times)
• Cookies and similar tracking technologies (see Section 5)

1.3 Information from third parties

If you sign up via a third-party login (e.g., Google), we receive basic profile information as permitted by that service.

1.4 Identity verification (Aadhaar KYC)

Sellers may optionally verify their identity using Aadhaar OTP verification. This is processed entirely by Cashfree Payments India Pvt. Ltd. through its government-authorised Verification Suite (KYC) API. Your Aadhaar number is transmitted securely to Cashfree solely to trigger a one-time UIDAI OTP; we never store your full Aadhaar number on our servers. Upon successful verification we retain only: (a) your name as returned by the KYC provider, (b) the last four digits of the Aadhaar number in masked form (e.g., XXXX XXXX 1234), and (c) a one-way cryptographic fingerprint used exclusively to prevent the same Aadhaar from being used on multiple accounts. This fingerprint cannot be reversed to recover the Aadhaar number. We do not collect or process any biometric information.

2. Purpose of Collection and Use

We collect and use your personal data to:

• Create and manage your account;
• Enable you to post Listings and connect with other Users;
• Operate the mandatory sign-up consent and verification process;
• Communicate with you (account notices, OTP/security verification, support, grievance responses);
• Maintain administrative and evidentiary records of deleted Listings for a minimum of one (1) year, for fraud-prevention, dispute-resolution, and legal-compliance purposes;
• Detect, prevent, and investigate fraud, misuse, or violations of our Terms;
• Improve and secure the Platform;
• Comply with legal obligations, including responding to lawful requests from law enforcement or regulators.

3. Legal Basis for Processing

We process your personal data on the basis of your explicit consent, given at the time of account sign-up, and as otherwise necessary to perform our obligations to you, comply with law, or for legitimate uses recognised under the DPDP Act (such as fraud prevention and record-keeping for legal claims).

You may withdraw consent at any time by contacting us (Section 12), though this may result in suspension of your account.

4. How We Share Your Information

• With other Users: Listing details and contact information you choose to share may be visible to Users you interact with.
• With service providers: We may share data with third parties who help us operate the Platform (hosting, SMS/OTP gateways, analytics, payment processors, and Cashfree Payments for Aadhaar identity verification as described in Section 1.4), under contractual confidentiality obligations.
• For legal reasons: We may disclose your data, including retained records of deleted Listings, to law enforcement, courts, or regulators where required by law.
• We do not sell your personal data to third parties for unrelated marketing purposes.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to keep you logged in, remember preferences, and understand how the Platform is used. You can control cookies through your browser settings; disabling them may affect Platform functionality.

6. Data Retention

After the applicable retention period, data is securely deleted or anonymised, unless a longer period is required by law or an ongoing legal/dispute matter.

7. Data Security

We implement reasonable technical and organisational security measures, including encryption, access controls, and OTP-based authentication, to protect your data against unauthorised access, alteration, or loss. However, no system is completely secure, and we cannot guarantee absolute security.

8. Your Rights (under the DPDP Act, 2023)

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you;
• Request correction or updating of inaccurate or incomplete data;
• Request erasure of your personal data, subject to our legal retention obligations;
• Withdraw consent at any time;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Lodge a complaint with our Grievance Officer, and thereafter with the Data Protection Board of India.

9. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has registered, we will take steps to delete the relevant account and data.

10. Data Breach Notification

In the event of a personal data breach likely to cause harm, we will take prompt steps to notify affected Users and the Data Protection Board of India, as required under the DPDP Act.

11. Third-Party Links

The Platform may link to third-party websites or services. This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies separately.

12. Grievance Officer / Data Protection Contact

In accordance with the DPDP Act, 2023 and the IT Rules, 2021, you may contact our Grievance Officer for privacy-related complaints or data rights requests:

• Email: [email protected]
• Address: Kerala, India

We will acknowledge complaints within 24 hours and aim to resolve them within 15 days.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or email, and continued use after such changes constitutes acceptance of the updated policy.

14. Contact Us

Email: [email protected]  |  Address: Kerala, India