The Malba Free Gurugram Transport Permit System ("the Platform", "we", "us", or "our") is owned and operated by Indo Enviro Integrated Solutions Ltd. ("the Operator"), a company engaged in Construction & Demolition (C&D) waste collection, transport monitoring, and processing services for Gurugram.

The Platform digitizes the end-to-end lifecycle of C&D waste transport permits — from permit application and approval to vehicle tracking, QR code verification at checkpoints, and final delivery confirmation at our waste processing plant. It is used by Transporters, Drivers, Waste Generators, Companies, Projects, Municipal Authorities, Plant Operators, and Administrators.

We understand that operating a permit and compliance system requires handling sensitive personal, vehicular, and location information, and we are committed to processing this data lawfully, transparently, and only to the extent necessary to deliver the service and meet our regulatory obligations to the Municipal Corporation of Gurugram and other competent authorities.

This Policy is drafted to comply with the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), the principles of the General Data Protection Regulation (GDPR) where applicable, and the Google Play User Data Policy and Google Play Account Deletion Policy. Under the DPDP Act, the Operator acts as the "Data Fiduciary" in respect of personal data processed through the Platform.

This Policy applies to all personal data collected through:

• The Malba Free Gurugram website and web dashboard.
• The Malba Free Gurugram Android application.
• Any user role interacting with the Platform, including Transporters, Drivers, Waste Generators, Companies, Project Administrators, Municipal Authorities, Plant Operators, and System Administrators.

By registering on, logging into, or otherwise using the Platform in any of these roles, you agree to the collection and use of your information as described in this Policy.

We collect only the information required to register users, process permits, verify identity, and meet legal and municipal reporting obligations. This includes:

Our Android application requests only the permissions necessary to operate core permit functions. We do not request or use any permission beyond what is described below.

We use industry-standard JSON Web Tokens (JWT) to authenticate users after login. Access tokens are short-lived and are used to authorize requests to our Node.js/Express backend.

Authentication tokens and refresh tokens are stored in secure, HTTP-only cookies where supported, to reduce exposure to client-side scripts. Refresh tokens are used to renew your session without requiring you to repeatedly re-enter your password, and are automatically invalidated on logout, password change, or after a period of inactivity.

All authentication traffic between your device and our servers is encrypted using HTTPS/TLS.

As a permit system operating within Gurugram's municipal waste management framework, certain permit and transport data may be processed by or shared with:

• Municipal Authorities (e.g., Municipal Corporation of Gurugram)
• Relevant Government Agencies overseeing C&D waste management
• Law Enforcement Agencies, where legally required
• Waste Processing Plants receiving the transported material

This sharing occurs only where necessary for permit verification, checkpoint enforcement, regulatory reporting, or to comply with a legal obligation, court order, or lawful request from a competent authority. We do not share data with government bodies for any purpose unrelated to C&D waste transport compliance.

We do not sell your personal information to anyone, for any purpose.

We may share information only with the following categories of recipients, and only to the extent necessary:

• Authorized Government Authorities, for permit verification and compliance reporting
• Law Enforcement, when legally compelled to do so
• Municipal Bodies overseeing C&D waste transport in Gurugram
• Waste Processing Plants, to confirm delivery and closure of a permit
• Legal Service Providers, where required to protect our legal rights or comply with law
• Email Service Providers (Zoho Mail), solely to deliver transactional emails and notifications

We do not share your personal data with advertisers, data brokers, or unrelated third parties.

We apply a layered set of technical and organizational safeguards to protect your data:

• Encryption — passwords are hashed, and sensitive data is encrypted at rest where applicable.
• HTTPS — all data transmitted between the app/website and our servers is encrypted in transit via TLS.
• Role-Based Access Control (RBAC) — users can only access data and functions relevant to their assigned role (Transporter, Driver, Company, Authority, Administrator, etc.).
• Audit Logs — key actions on permits and accounts are logged to support accountability and investigation of misuse.
• Secure Authentication — JWT-based sessions with secure, HTTP-only cookies and refresh-token rotation.
• Access Controls — administrative access to production systems is restricted to authorized personnel only.
• Monitoring — our systems are monitored for suspicious activity and unauthorized access attempts.

While we take these precautions seriously, no method of transmission or storage is completely secure. We continuously work to improve our safeguards.

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law:

• Account Data (name, email, phone) — retained for as long as your account remains active, and for a limited period thereafter to handle disputes or legal requirements.
• Permit Records (applications, approvals, routes) — retained for the period required under municipal C&D waste regulations, typically for the statutory record-keeping period applicable to waste transport compliance.
• Audit Logs — retained to support security investigations and regulatory accountability, in line with our internal retention schedule.
• Identity Documents — retained only as long as necessary to verify eligibility and for compliance record-keeping, after which they are securely deleted or anonymized.

Where we are required by Indian law, municipal regulation, or an ongoing legal proceeding to retain specific records beyond the periods above, we will do so only for the duration of that legal obligation.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of your personal data, subject to legal retention requirements.
• Restrict certain processing of your data.
• Withdraw consent for processing that is based on consent, without affecting the lawfulness of prior processing.
• Contact our support team with any privacy-related question, complaint, or request.

To exercise any of these rights, write to us at info@malbafreegurugram.com or call our helpline at +91 90153 39966. We will respond within a reasonable time and in accordance with applicable law.

You may request deletion of your account and associated personal data at any time by visiting: malbafreegurugram.com/delete-account. You can also submit a deletion request by emailing info@malbafreegurugram.com from your registered email address, or by calling our helpline at +91 90153 39966.

We rely on a limited number of third-party services to operate the Platform:

• Zoho Mail — used to send transactional and account-related emails, such as verification, notifications, and support communication.
• Government & Municipal Systems — used to submit or verify permit and compliance data with relevant municipal and regulatory authorities, where required.
• Google Play Services — used, where applicable, to distribute and update the Android application through the Google Play Store.

We do not integrate with advertising networks, social media trackers, or data broker services.