This page describes how InnovRent Services Pvt Ltd handles personal data across jurisdictions. India's Digital Personal Data Protection Act 2023 (DPDP) is the primary framework that governs our processing. For EU and UK visitors, the General Data Protection Regulation (GDPR) and UK GDPR additionally apply where relevant. For specifics on what the marketing site collects, see our Privacy Policy.
Our role under DPDP 2023
Under DPDP 2023, InnovRent acts as a Data Fiduciary when we determine the purpose and means of processing personal data. For employee programmes run on behalf of corporate customers, we may act as a Data Processor under instructions from the customer. The applicable role is documented in the data processing agreement with each customer. We do not currently process volumes that would trigger Significant Data Fiduciary obligations, but we apply equivalent practices voluntarily.
Lawful basis for processing
- Consent: contact-form submissions, marketing communications you opt into, demo bookings.
- Contract: processing necessary to perform a contract you or your employer have with us.
- Legitimate interests: security logging, fraud prevention, internal record-keeping. Applied narrowly.
- Legal obligation: tax records, statutory employment data, responses to legally binding requests.
Your rights under DPDP 2023 (India residents)
- Access a summary of personal data we hold about you.
- Correction and erasure of inaccurate, incomplete, or outdated data.
- Grievance redressal: complain to us first; escalate to the Data Protection Board of India if unresolved.
- Nominate a person to exercise your rights in case of death or incapacity.
To exercise any right, email hello@innovrent.com with the subject "Data Subject Request". We respond within 30 days.
Your rights under GDPR (EU and UK residents)
- Data portability: receive your data in a structured, machine-readable format.
- Restriction of processing in defined circumstances.
- Object to processing based on legitimate interests or direct marketing.
- Lodge a complaint with your local supervisory authority.
We respond to GDPR requests within one month, extendable by two months for complex cases.
Cross-border transfers
We are based in India. Data we process may be stored on infrastructure located in India and in other jurisdictions where our service providers operate. For EU or UK residents, we rely on Standard Contractual Clauses where appropriate. For India residents, we comply with DPDP 2023's restrictions on cross-border transfers and monitor the Central Government's notifications on restricted territories.
Security
- HTTPS / TLS for all data in transit.
- Encrypted-at-rest storage for sensitive customer data on our portals.
- Role-based access control with audit logs.
- Periodic third-party penetration tests on the SmartLease order portal.
In the event of a personal data breach affecting you, we notify the Data Protection Board of India and the affected individuals as required.
Retention
We keep personal data only as long as needed for the purpose for which it was collected, or as required by law. Specific retention periods are documented in the Privacy Policy.
Children
We do not knowingly process personal data of any person under 18. If you believe we are processing data about a minor without parental consent, contact us immediately.
Contact
For all data protection enquiries: hello@innovrent.com.
InnovRent Services Pvt Ltd
Sector 66, Gurugram, Haryana, India
CIN: U77291HR2024PTC126832