Privacy Policy
IGZ SOLUTIONS PRIVATE LIMITED (“We” / “IGZ” / “Data Fiduciary”) is committed to protecting the privacy of the users (“You” / “Your” / “Yourself” / “Data Principal”) of its website located at www.superexp.in and its mobile application titled IGZ (together, the “Platform”). This Privacy Policy (“Policy”) explains how IGZ collects, uses, discloses, stores and protects personal data in accordance with the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and (to the extent still applicable) the Information Technology Act, 2000 and rules made thereunder.
The terms of this Policy govern Your use of the Platform. By using the Platform, You agree to be bound by this Policy. If You do not agree with the terms of this Policy, please do not use the Platform.
Definitions
“Data Fiduciary” means IGZ, being the person who determines the purpose and means of processing personal data.
“Data Processor” means any person who processes personal data on behalf of IGZ.
“Data Principal” means the individual to whom the personal data relates, and where such individual is a child, includes the parent or lawful guardian of such child.
“Consent Manager” means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review and withdraw consent.
“Personal Data” means any data about an individual who is identifiable by or in relation to such data. “Digital Personal Data” means personal data in digital form.
“Personal Data Breach” means any unauthorised processing of personal data, or accidental or unlawful disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
Collection of Information
2.1 You can browse the Platform without revealing any personal information about Yourself. Certain personal information will be required if You create an account. We indicate, wherever possible, which fields are mandatory and which are optional.
2.2 IGZ collects Personal Data such as Your name, email address, physical address, phone number and other relevant demographic information (e.g., gender, PIN code) when You create an account. Where You provide financial information (e.g., bank account, payment instrument or tax details) for the purpose of availing the Services, such information will also be treated as Personal Data and protected accordingly. If You do not provide the Personal Data classified as mandatory, You may not be able to avail the Services.
2.3 You represent that the information You provide is correct, current and updated, and that You have all rights, permissions and consents required to provide it.
2.4 We may automatically collect Non-Personal Information (session and usage data, log data, and aggregate information collected through cookies) while You browse the Platform, as described in Clause 11 (Cookies) below.
2.5 You may delete Your account at any time. Certain information may continue to be retained in archival form thereafter only to the extent permitted under Clause 6.4 (Data Retention & Erasure) below.
Consent
3.1 Where IGZ relies on Your consent as the lawful basis for processing Your Personal Data, such consent shall be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the Personal Data necessary for the specified purpose.
3.2 You have the right to withdraw Your consent at any time, and withdrawing consent shall be as easy as giving it. You may withdraw consent by writing to the Data Protection Officer/Grievance Officer named in Clause 13. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, and IGZ may continue to retain or process data thereafter only where permitted by law (e.g., to comply with a legal obligation).
3.3 Where IGZ processes Personal Data on a lawful basis other than consent, IGZ relies on the ‘legitimate use’ ground recognised under Section 7 of the DPDP Act — in particular, where You have voluntarily provided Your Personal Data to IGZ for a specified purpose (such as creating an account or availing the Services) and have not indicated that You do not consent to the use of Your Personal Data for that purpose. IGZ will identify the specific purpose relied upon at the point of collection.
Use of the Information Collected
4.1 We use Personal Data that we believe to be relevant and necessary to provide the Services effectively, including to: resolve disputes; troubleshoot problems; help promote a safe service; process payments; measure interest in our products and services; inform You about offers, products, services and updates (subject to Your marketing preferences under Clause 5); customise Your experience; detect and prevent error, fraud and other unlawful activity; and enforce our terms and conditions.
4.2 To the extent Personal Data is used for marketing or advertising, We will provide You the ability to opt out, as described in Clause 5.
4.3 We may use and disclose Non-Personal Information (which does not identify You) for any purpose connected with operating and improving the Platform, since it does not constitute Personal Data.
Marketing, Promotional Communications and Newsletters
You may opt out of receiving non-essential (promotional/marketing) communications at any time by updating Your account settings or by writing to us. We reserve the right to send service-related communications necessary for Your account, which are not subject to opt-out.
Information We Share, Data Localisation, and Retention
6.1 We do not sell or trade Your Personal Data, except as described in this Policy or where express consent is sought from You. We may disclose Personal Data to an authorised GST Suvidha Service Provider, the Government of India, and to IGZ’s employees, independent contractors, affiliates, consultants, business associates, service providers and distributors, strictly on a need-to-know basis and only to enable them to provide business, professional or technical support in connection with the Services.
6.2 We may disclose Personal Data where required by law or in the good-faith belief that disclosure is reasonably necessary to respond to legal process, or to protect the rights, property or safety of IGZ, its users, or others. We (and our affiliates) may also share Personal Data with another business entity in connection with a merger, acquisition, reorganisation or restructuring of IGZ’s business, provided that the receiving entity remains bound by this Policy in respect of such Personal Data.
6.3 Data Localisation (India Only): All Personal Data collected or processed by IGZ in connection with the Platform is stored and processed exclusively within the territory of India. IGZ does not transfer, store, host, or process Personal Data outside India, and does not permit access to Personal Data from outside India, whether by IGZ itself or by any Data Processor, sub-contractor, affiliate, or other third party engaged by IGZ. Where IGZ engages any third party (including cloud infrastructure or service providers) to store or process Personal Data, IGZ requires that such storage and processing take place solely on servers located within India, and that such third party adopt reasonable security safeguards consistent with this Policy and applicable law.
6.4 Data Retention & Erasure: IGZ retains Personal Data only for as long as necessary to fulfil the specified purpose for which it was collected, in accordance with Section 8(7) and 8(8) of the DPDP Act and the timelines prescribed under the DPDP Rules. Once the specified purpose is no longer being served and retention is not otherwise required to comply with any law in force (including for the establishment, exercise or defence of a legal claim), IGZ will erase the relevant Personal Data — and cause its Data Processors to do the same — within the applicable prescribed timeline. Where a specific statutory retention period applies to a category of data (for example, financial or tax records), IGZ will retain such data only for that mandated period.
Rights of the Data Principal
Subject to the DPDP Act and Rules, You have the right to: (a) obtain a summary of the Personal Data being processed and the processing activities undertaken; (b) request correction, completion, updating or erasure of Your Personal Data; (c) nominate another individual to exercise Your rights in the event of Your death or incapacity; (d) withdraw consent as described in Clause 3.2; and (e) grievance redressal, as described in Clause 8. You may exercise these rights by contacting the Data Protection Officer/Grievance Officer named in Clause 13.
Grievance Redressal
If You have a grievance regarding the processing of Your Personal Data, You may contact the Data Protection Officer/Grievance Officer named in Clause 13. IGZ will endeavour to resolve grievances promptly, and in any event within ninety (90) days, in line with the DPDP Rules. If You are not satisfied with the resolution, You may approach the Data Protection Board of India.
Children’s / Minors’ Data
The Platform is intended for use by individuals who are 18 years of age or older. IGZ does not knowingly collect, process or store Personal Data of children (i.e., individuals below 18 years of age, as defined under the DPDP Act) on the Platform. If IGZ becomes aware that it has inadvertently collected Personal Data from a child, it will take steps to promptly delete such data. Should IGZ, at any point in the future, decide to offer a service directed at children, this Policy will be updated to include verifiable parental/guardian consent mechanisms and the other safeguards required under the DPDP Act before any such processing commences.
Information Security and Personal Data Breach Notification
10.1 We employ reasonable security safeguards (including SSL encryption for data in transit, access controls on a need-to-know basis, and restricted server access) to protect Personal Data against unauthorised access, alteration, disclosure or destruction, in compliance with the DPDP Act, the DPDP Rules, and (to the extent still applicable) the Information Technology Act, 2000 and rules made thereunder.
10.2 In the event of a Personal Data Breach, IGZ will notify the Data Protection Board of India and the affected Data Principal(s) without undue delay, in the manner and within the timelines prescribed under the DPDP Rules, together with the nature of the breach, the likely consequences, and the measures taken or proposed to mitigate its effects.
10.3 While IGZ takes reasonable measures to protect Personal Data, no transmission over the internet or telecom network can be guaranteed to be completely secure, and IGZ’s liability for unauthorised third-party acts or transmission errors shall be as set out in this Policy and applicable law.
Cookies and Similar Technologies
Cookies are pieces of information stored by Your web browser for record-keeping purposes and are used to store Your preferences, record session information, and tailor the Services to Your needs. Most browsers allow You to disable cookies; doing so may limit Your ability to use certain Services. By continuing to use the Platform with cookies enabled, You consent to Our use of cookies as described in this Policy.
Policy Updates
This Policy shall be effective 30th March 2018 and may be updated from time to time to reflect changes in law (including further DPDP Rules or notifications) or IGZ’s practices.
Access, Correction and Data Protection Officer / Grievance Officer
You may exercise the rights described in Clause 7, or raise any query or grievance, by contacting IGZ’s Data Protection Officer/Grievance Officer:
Mr. Shaurya Bajaj, Data Protection Officer / Grievance Officer, IGZ Solutions Private Limited. Phone: +91 9553336875. Email: shaurya@superexp.in.
Registered Office: Office No. 1904, 19th Floor, Plot No. 36/6, Shankesh Crown, Sion Station Road, Sion, Mumbai 400022, Maharashtra, India.
Jurisdiction
Any dispute arising out of this Policy shall be governed by the laws of India, and the courts at Mumbai shall have exclusive jurisdiction. Links to third-party websites from the Platform are provided for convenience only; IGZ is not responsible for the privacy practices of such third-party websites.
Advertisements
We may use third-party advertising companies to serve advertisements when You visit the Platform. Such companies may use aggregated, non-identifying information about Your visits to this and other websites to serve advertisements of interest to You.
