Privacy Policy.

1. Introduction and Scope

1. EBuilding Private Limited (“EBuilding”, “we”, “us”, “our”) operates the E Building platform, a mobile application and associated web services that bring together three connected offerings: digital society management for resident welfare associations and managing committees, an on-demand home-services marketplace for residents, and a direct staffing platform through which societies hire community staff.
2. This Privacy Policy explains what personal data we handle, why we handle it, the lawful basis on which we do so, who we share it with, how long we keep it, and the rights available to you. It is issued under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).
3. This Policy applies to the E Building mobile applications for Android and iOS, the website at www.ebuilding.in, the committee and administrator web panels, the vendor application, and every communication channel we operate including in-app messaging, e-mail, SMS and WhatsApp.
4. This Policy does not apply to the independent processing of your personal data by a service vendor after a booking is completed, by your society or resident welfare association for its own purposes, or by any third-party website or application you reach through a link on our platform. Those entities handle your personal data in their own capacity and under their own policies.
5. This Policy is governed by Indian law. We do not represent that our platform complies with the data protection laws of any jurisdiction outside India, and the platform is not offered to data principals outside India.

2. The Two Capacities in Which We Act

Where your society is the Data Fiduciary and we are its Data Processor

1. When your society, resident welfare association, apartment owners association or managing committee (“Society”) subscribes to the E Building society-management platform, it is the Society that decides which residents are enrolled, what records are maintained at the gate, how maintenance is billed, and what the data is used for. In law, the Society is the Data Fiduciary for that data and EBuilding is its Data Processor, acting only on the Society's documented instructions under a written agreement as required by section 8(2) of the DPDP Act.
2. The following categories fall into this capacity: resident and flat master records created by the Society, visitor and gate entry logs, domestic staff attendance records, vehicle and parking registries, maintenance bills, receipts and ledgers, amenity booking records, complaint and service-request records, and the Society's own income and expense records.
3. For these categories, EBuilding does not determine the purpose of processing and does not use the data for its own purposes. If you wish to access, correct or erase data in these categories, your request must ultimately be decided by your Society. You may still raise the request with us and we will route it to your Society and assist the Society in answering it, but we cannot independently grant or refuse it.

Where EBuilding is the Data Fiduciary

1. EBuilding is the Data Fiduciary — that is, it determines the purpose and means of processing and answers for it directly — for the following: your E Building user account and login credentials; home-services marketplace bookings and the matching of those bookings to vendors; vendor and agency onboarding and identity verification records; Recharge Pack purchase and entitlement records; vendor location data captured during an active job; ratings and reviews; staffing candidate records; website and application usage data; support correspondence with us; and any marketing communications you consent to receive.
2. For these categories, you may exercise your rights directly against EBuilding under clause 14 of this Policy.
3. Where a single screen in the application collects data falling into both capacities, the consent notice presented to you at that screen will identify which entity is the Data Fiduciary for each item.

Where a service agency handles your data

1. Some bookings are performed by a service agency rather than by an individual professional. Where an agency receives your name, mobile number and service address to perform a booking, EBuilding remains the Data Fiduciary and the agency is a Data Processor, bound by a written Agency Data Processing Agreement. Only the single individual assigned to your booking may see your details; the agency may not circulate them internally, hold them in a customer list, or keep them after the booking.

Where you are an individual working for an agency

1. If you are a worker deployed by a service agency to attend bookings, EBuilding is a Data Fiduciary in its own right for the information it holds about you — your identity and address documents, photograph, verification record, Roster status and location during a booking. EBuilding decides what is collected about you, what verification is carried out and how long it is kept, so it answers to you directly. Your agency cannot consent on your behalf and cannot exercise your rights for you. A separate notice, the Agency Personnel Notice and Consent, is given to you at registration and explains this in full.

Whether you belong to a society or not

1. The marketplace is open both to residents of societies that subscribe to the platform and to standalone users who have no society on the platform at all. If you are a standalone user, only the parts of this Policy dealing with your account, your marketplace bookings, your support correspondence and your marketing preferences apply to you. The society-module processing in clause 2.1 does not apply to you, is not collected from you, and is not presented to you at sign-up.

3. Definitions

1. Child means an individual who has not completed eighteen years of age, in accordance with the DPDP Act.
2. Data Fiduciary means the person who alone or with others determines the purpose and means of processing personal data.
3. Data Principal means the individual to whom the personal data relates — in this Policy, you.
4. Data Processor means a person who processes personal data on behalf of a Data Fiduciary.
5. Member or Resident means an individual resident, flat owner or occupant who holds an E Building user account linked to a Society.
6. Personal data means any data about an individual who is identifiable by or in relation to such data. The DPDP Act does not recognise a separate category of “sensitive personal data”; all personal data is treated as one class and is protected on the same footing under this Policy.
7. Personal data breach means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
8. Vendor means an independent service professional or firm onboarded to the E Building home-services marketplace.
9. Processing means a wholly or partly automated operation or set of operations performed on digital personal data, including collection, storage, use, sharing, indexing, alteration, disclosure, erasure and destruction.

4. Personal Data We Handle

1. We handle the following categories of personal data. Not every category applies to every person — what we hold about you depends on how you use the platform.

Table 4A — Society committee members and authorised signatories

Table 4B — Residents and members

Table 4C — Visitors, guests, delivery agents and domestic staff of residents

Table 4D — Marketplace vendors

Table 4E — Staffing candidates

2. We do not knowingly collect personal data from any person who has not completed eighteen years of age. See clause 8.
3. We do not collect biometric data, and we do not operate facial recognition on any image captured at the gate or uploaded to a profile.

5. Why We Handle Personal Data, and on What Lawful Basis

1. The DPDP Act permits processing on only two grounds: the consent of the Data Principal under section 6, or a certain legitimate use specified in section 7. We do not rely on any concept of “legitimate interest”, and we do not treat the existence of a contract as a standalone ground for processing. Every activity below is mapped to one of the two permitted grounds.

2. We will not use your personal data for a purpose outside this table without first giving you a fresh notice and, where consent is the basis, obtaining fresh consent.

6. Consent — How We Take It and How You Withdraw It

1. Where we rely on consent, that consent is taken by a clear affirmative action by you, is free, specific, informed, unconditional and unambiguous, and is limited to the personal data necessary for the specified purpose, as required by section 6 of the DPDP Act.
2. Consent is not bundled. Acceptance of our Terms of Use is not treated as consent to processing. Consent for optional purposes — in particular marketing and advertising — is taken through a separate control which is off by default, and declining it does not affect your access to the platform or to any service you have paid for.
3. Every request for consent is accompanied by a notice under section 5 of the DPDP Act which tells you, in plain language, what personal data is being collected, the purpose for which it will be processed, how you may exercise your rights, how you may withdraw consent, and how you may complain to the Data Protection Board of India.
4. The notice and this Policy are available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India, in accordance with section 6(9) of the DPDP Act. Because the platform operates across Gujarat, Maharashtra and Jharkhand, we maintain Gujarati, Hindi and Marathi versions of this Policy and of every consent notice as a matter of course. To request a copy in another Eighth Schedule language, write to us at the address in clause 16.
5. You may withdraw your consent at any time. To withdraw, write to our Grievance Officer at grievance@ebuilding.in from the mobile number or e-mail address registered on your account, telling us what you wish to withdraw. We will act on a withdrawal without undue delay. We are building a self-service control in the application so that you can withdraw in the same number of taps in which you gave consent, and we will tell you on the platform when it is available.
6. On withdrawal we will stop the processing that depended on that consent, and will erase the personal data concerned and cause our data processors to erase it, unless retention is required by law or for the establishment or defence of a legal claim, in accordance with section 8(6) and 8(7) of the DPDP Act.
7. Withdrawal operates prospectively. It does not make unlawful any processing carried out on the basis of your consent before you withdrew it, and you will bear the consequences of withdrawal — for example, if you withdraw consent to share your service address with a vendor, we cannot deliver a home service to you.
8. When a withdrawal takes effect. Withdrawal stops the processing that depended on your consent, and when it takes effect depends on what you are using. If you have asked us for a one-time service, such as a cleaning or a repair, your withdrawal takes effect once that service has been performed — we cannot stop processing the booking of a job that is still being done. If you hold a subscription, we may continue to process the personal data necessary to provide it for the remainder of the period you have paid for, and your withdrawal takes effect from the start of the next renewal period. In either case we stop sending you anything optional, such as marketing, immediately.
9. Withdrawal and your account. Because almost everything the platform does for you rests on your consent, a withdrawal of the consents at items 1 to 4 of our consent notice means we can no longer operate your account, and we will close it and erase the personal data in it in accordance with clause 10. If you wish to withdraw only an optional consent — marketing, advertising, ratings and reviews, or group order notifications — say so, and your account continues unaffected.
10. You may also give, manage, review and withdraw your consent through a Consent Manager registered with the Data Protection Board of India, once we integrate with one. We will notify you on the platform when that facility becomes available.

7. Processing Without Consent — Certain Legitimate Uses

1. For a limited set of activities we process personal data without consent, relying on the specified legitimate uses in section 7 of the DPDP Act. These are exhaustively listed in the basis table at clause 5. In summary, they are: data you voluntarily provide for a specified purpose and in respect of which you have not indicated an objection; responding to a medical emergency or a threat to life or immediate threat to health; complying with a legal obligation to disclose, or with a judgment, decree or order; and the processing of our own employees' data for employment purposes.
2. Where we rely on a legitimate use, your rights of access, correction, erasure, grievance and nomination continue to apply, but the right to withdraw consent does not, because consent was not the basis of that processing.

8. Children and Persons Under Eighteen

1. The E Building platform is intended for use only by individuals who have completed eighteen years of age. Under the DPDP Act a “child” is any individual below eighteen, and the obligations that attach to children's data are strict and admit no exception based on the nature of the service.
2. By creating an account you confirm that you have completed eighteen years of age. We do not knowingly create accounts for, or permit access by, any person below that age. Where a resident adds a family member to their unit, that family member receives their own login — so the same rule applies to them. Date of birth is captured at the point a family member is added, no account is created for a person below eighteen, and the check is enforced in our systems and not only on the screen. The resident who adds a family member confirms that the person has completed eighteen years of age.
3. We do not carry out tracking or behavioural monitoring of children, and we do not direct advertising at children, in accordance with section 9(3) of the DPDP Act. This prohibition applies absolutely and is not affected by any consent.
4. We do not undertake any processing that is likely to cause a detrimental effect on the well-being of a child, in accordance with section 9(2) of the DPDP Act.
5. Personal data relating to a person below eighteen may nevertheless be recorded incidentally in a Society's gate or visitor logs — for example, where a minor visits a resident, or where a resident records a family member. Those records are created under the control of the Society as Data Fiduciary, and the Society is responsible for obtaining verifiable parental consent where it is required under section 9(1). We process such records only on the Society's instructions and apply the same restrictions on tracking, monitoring and advertising set out above.
6. If we become aware that an account has been created by a person below eighteen, we will suspend the account and erase the associated personal data, save where retention is required by law.

9. Who We Share Personal Data With

1. We do not sell personal data. We do not trade, rent or otherwise make personal data available to third parties for their own independent commercial purposes. We share personal data only as set out below.

2. Every processor engaged by us is engaged under a valid written contract containing the data protection obligations required by section 8(2) of the DPDP Act.
3. When a vendor attends your home, the vendor sees your name, mobile number and address. Once the booking is complete, the vendor must delete that data and may not contact you again through it. If a vendor contacts you outside the platform or retains your details, report it to our Grievance Officer and we will act against the vendor under the vendor Data Processing Agreement.

10. Processing Outside India

1. Our application and database are hosted in India. Application infrastructure runs on Amazon Web Services in the ap-south-1 (Mumbai) region and our database runs on MongoDB Atlas in the ap-south-1 (Mumbai) region. Your account data, society records, gate records, bookings and financial records are stored there.
2. Some processing takes place outside India, and we state that plainly rather than claim otherwise. Mobile push notifications are delivered through Google infrastructure. E-mail we send you — including one-time passwords, booking confirmations and grievance correspondence — is delivered through Google's Gmail servers. Messages we send to you on WhatsApp are delivered by Meta Platforms, Inc. Application crash and diagnostic reports are routed to Slack Technologies, LLC, a workplace messaging service we use to alert our engineers. All of them operate outside India.
3. Under section 16 of the DPDP Act, transfers of personal data outside India are permitted by default and are restricted only in respect of countries or territories notified by the Central Government. No country relevant to the providers described above has been so notified. We do not transfer personal data to any country or territory that is notified, and we will cease any transfer that becomes restricted by such a notification.
4. Section 16(2) preserves stricter requirements imposed by other laws. Where a sectoral law — including directions of the Reserve Bank of India on the storage of payment system data — requires particular data to be stored only in India, that requirement prevails, and the relevant data is stored only in India. Payment instrument data is handled by our payment gateway within its own regulated environment and is not stored on our systems.
5. A current list of the providers who process personal data on our behalf, and where each of them processes it, is maintained and is given to any Society on request and to any Data Principal who asks under clause 14.
6. Where personal data is processed outside India by a processor engaged by us, that processor is bound by a written contract imposing the security safeguards and purpose limitations required by the DPDP Act, and our obligations to you under this Policy continue to apply.

11. How Long We Keep Personal Data

1. We keep personal data only for as long as the purpose for which it was collected continues to be served, and thereafter only for so long as retention is required by law or for the establishment, exercise or defence of a legal claim. When the purpose is no longer served and no legal requirement to retain applies, we erase the data and cause our processors to erase it, in accordance with section 8(6) and 8(7) of the DPDP Act.
2. Erasure operates on an automated schedule configured in our systems. It is not dependent on a manual request or on a manual review.

3. Where your Society is the Data Fiduciary, the retention periods above are those we apply by default under our agreement with the Society. A Society may instruct a shorter period. A Society may instruct a longer period only where it is lawfully justified, and we will record that instruction in writing.
4. We will give you notice before erasing your account data on inactivity, at the contact details we hold for you, so that you have an opportunity to retain your account.

12. How We Protect Personal Data

1. We implement reasonable security safeguards to prevent personal data breaches, as required by section 8(4) of the DPDP Act. Our safeguards include, at a minimum:
   • encryption of personal data in transit using current transport layer security, and encryption of personal data at rest in our databases and backups;
   • role-based access control, so that each member of our personnel can access only the data required for their role, with committee, vendor, member and administrator roles strictly separated;
   • multi-factor authentication for administrative and engineering access to production systems;
   • storage of account passwords only in salted and hashed form, never in plain text and never in a recoverable form;
   • logging and retention of access, configuration and administrative activity logs, and monitoring of those logs for anomalous access;
   • segregation of production data from development and testing environments, and a prohibition on the use of live personal data in testing;
   • encrypted, access-controlled backups and a tested restoration procedure to preserve continuity of processing in the event of a compromise;
   • contractual data protection and confidentiality obligations on every processor, vendor and employee who may access personal data;
   • periodic review of access rights, and immediate revocation of access on the exit or role change of any person; and
   • a documented incident response procedure, tested at defined intervals.
2. No system can be guaranteed to be absolutely secure. We do not represent that our platform is immune from compromise. What we undertake is to maintain the safeguards described above, to keep them under review, and to deal with any breach in the manner set out in clause 13.
3. You are responsible for keeping your account credentials confidential and for the activity carried out through your account. Tell us immediately if you believe your credentials have been compromised.

13. Personal Data Breaches

1. If a personal data breach occurs, we act on three separate clocks, each of which runs independently. There is no materiality or harm threshold: the obligations below apply to every personal data breach, however small, and regardless of whether we assess that any harm has resulted.

2. Our notification to you will describe the nature and extent of the breach, when and where it occurred, the likely consequences relevant to you, the measures we have taken or propose to take to mitigate risk, the safety measures you may take, and the contact details of the person able to answer your questions.
3. We maintain a written record of every personal data breach, including those we determine not to be notifiable, together with the reasoning for that determination.

14. Your Rights as a Data Principal

1. The DPDP Act gives you the following rights. They are set out here precisely, because the rights available under Indian law differ from those under other data protection regimes and you should not assume the position is the same.

Right to access information — section 11

1. You may obtain from us a summary of the personal data we are processing about you and the processing activities we undertake, the identities of the other Data Fiduciaries and Data Processors with whom we have shared your personal data together with a description of what was shared, and any other information related to that personal data and its processing that is prescribed.

Right to correction, completion, updating and erasure — section 12

1. You may require us to correct inaccurate or misleading personal data, complete incomplete personal data, update personal data, and erase personal data that is no longer necessary for the purpose for which it was processed, unless retention is necessary for a specified purpose or for compliance with law.
2. Erasure is a distinct right from withdrawal of consent. Erasure removes the data. Withdrawal stops the processing. Asking us to stop using your data is a withdrawal of consent under clause 6; asking us to delete it is an erasure request under this clause. You may exercise either or both.

Right of grievance redressal — section 13

1. You have the right to a readily available means of registering a grievance with us about any act or omission regarding the performance of our obligations or the exercise of your rights. You must exhaust this remedy before approaching the Data Protection Board of India.

Right to nominate — section 14

1. You may nominate any other individual to exercise your rights under the DPDP Act on your behalf in the event of your death or of your incapacity by reason of unsoundness of mind or infirmity of body. You may record a nomination in the application under Profile → Privacy → Nomination, or by writing to our Grievance Officer.

Right to withdraw consent — section 6(4)

1. Where processing rests on your consent, you may withdraw it at any time, as described in clause 6.

Rights that the DPDP Act does not confer

1. For the avoidance of doubt, and so that you are not misled by provisions found in other jurisdictions, the DPDP Act does not confer a right to data portability, a general right to object to processing, a right to be forgotten beyond the right of erasure described above, or a right not to be subject to automated decision-making. We do not offer these as legal rights. Where we choose to provide a comparable facility as a matter of service, we will say so expressly and it will not be a statutory entitlement.

How to exercise your rights

1. Send your request to the Grievance Officer at the address in clause 16, from the mobile number or e-mail address registered on your account, or raise it in the application under Profile → Privacy. We may ask you for information reasonably necessary to verify your identity before acting on a request; we will not use that information for any other purpose.
2. We will acknowledge your request within twenty-four hours and respond to it within the period prescribed under the DPDP Rules, and in any event as expeditiously as possible. If we decline a request in whole or in part, we will tell you why and how you may escalate.
3. There is no charge for exercising your rights.
4. Where your request concerns data for which your Society is the Data Fiduciary, we will forward it to the Society within three working days and tell you that we have done so, together with the Society's contact for the purpose.

15. Your Duties as a Data Principal

1. Section 15 of the DPDP Act places duties on you as well. You must comply with applicable law when exercising your rights; you must not impersonate another person while providing personal data; you must not suppress material information when providing personal data for any document, identifier, proof of address or identity issued by the State; you must not register a false or frivolous grievance or complaint; and you must furnish only information that is verifiably authentic when seeking correction or erasure.
2. A breach of these duties is punishable by a penalty of up to ten thousand rupees under the Schedule to the DPDP Act.

16. Grievance Redressal and How to Contact Us

1. We have appointed a Grievance Officer to answer questions about this Policy and to receive and decide grievances about our handling of personal data, in accordance with section 8(10) of the DPDP Act. The Grievance Officer also discharges the function of a grievance officer under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 in respect of the marketplace.

2. If you are not satisfied with the outcome, or if we fail to respond within the stated period, you may complain to the Data Protection Board of India in the manner provided under the DPDP Act and the DPDP Rules. You must first have exhausted the grievance procedure above.
3. EBuilding is not, as at the date of this Policy, notified as a Significant Data Fiduciary under section 10 of the DPDP Act. If it is so notified, we will appoint a Data Protection Officer based in India who will report to our board, appoint an independent data auditor, carry out Data Protection Impact Assessments and periodic audits, and update this Policy accordingly.

17. Changes to This Policy

1. We will update this Policy whenever our processing changes — including if we introduce in-app payment for home services, launch advertising or monetisation of platform data, begin processing a new category of personal data, or engage a new category of processor.
2. We will publish the updated Policy in the application and on www.ebuilding.in, with the version number and effective date. Where the change materially affects you, or where it requires a fresh basis for processing, we will notify you and, where consent is the basis, seek fresh consent before the change takes effect. Continued use of the platform is not treated as consent to a new processing purpose.
3. We maintain an archive of previous versions of this Policy and will provide any previous version on request.

18. Governing Law

1. This Policy is governed by the laws of India. Subject to the statutory jurisdiction of the Data Protection Board of India and any appeal from it, the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction.