RoutikQ — Privacy Policy

Last updated: 29 September 2026

RoutikQ is a multi-carrier shipping platform operated by RoutikQ Technologies Private Limited ("RoutikQ", "we", "us", "our"), with its registered office at RMZ Latitude Commercial, 10th Floor, Bellary Road, Bangalore, Karnataka, India. This Privacy Policy explains how we collect, use, protect, share and retain personal data when merchants connect their online stores to RoutikQ and use our platform to ship orders.

We are committed to processing personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable data-protection requirements, including the platform requirements of the sales channels we integrate with (such as Shopify and WooCommerce).

1. Our role

RoutikQ plays two distinct roles under the DPDP Act:

• For a merchant's own account data, RoutikQ is the Data Fiduciary (the entity that determines the purpose and means of processing). This covers the information a merchant gives us to open and operate a RoutikQ account.
• For a buyer's (end-customer's) personal data, RoutikQ acts as a Data Processor on the merchant's behalf. The merchant is the Data Fiduciary of their own customers' data; we process that data only to provide shipping and fulfilment services to the merchant, on their instructions and under their lawful basis for processing.

2. What data we process

Merchant account data — the information a merchant provides to open and run a RoutikQ account: name, business name, email, phone, address, KYC documents, wallet and billing details, pickup locations, and plan information.

Buyer (end-customer) data — for each order a merchant ships through RoutikQ, we process the minimum data required to generate a shipping label and deliver the parcel:

• Recipient name
• Recipient phone number
• Recipient shipping address (address lines, city, state, PIN code)
• Recipient email address (where provided by the store, used for shipment notifications)
• Order and parcel details (items, weight, dimensions, order value, payment mode such as prepaid or COD)

We do not request or process buyer payment-card numbers, buyer login credentials, or any special-category personal data. We request only the customer fields necessary to provide fulfilment functionality to the merchant.

We do not knowingly collect or process the personal data of children. Our services are intended for businesses and their fulfilment operations.

3. Why we process it (purpose)

We process buyer data for one purpose: to provide shipping and fulfilment services — rating a shipment, booking it with a courier, generating the shipping label and manifest, and returning tracking and delivery status to the merchant and their store. We limit our processing strictly to this stated purpose.

4. Who we share it with

To deliver a parcel, the recipient's name, phone, address and parcel details are shared with the courier partner selected for that shipment (for example Delhivery, Ekart, Shadowfax, or Amazon Shipping). Each courier receives only the data needed to carry and deliver that specific shipment, and processes it under its own terms and data-protection obligations.

We do not sell personal data, and we do not share it for advertising or any purpose beyond fulfilment. We may disclose data where required by law or to protect our legal rights.

5. How we protect it (security)

• Encryption at rest. Buyer personal data (name, phone, email, address) and stored order payloads are encrypted at rest using AES-256-GCM.
• Encryption in transit. All data is transmitted over encrypted connections (TLS).
• Access control. Access to personal data is restricted to authorised personnel and systems on a least-privilege basis, and access is logged.
• Environment separation. Production data is kept separate from test and development environments.
• Retention limits and incident response. We apply retention periods (see below) and maintain a security-incident response process.

6. How long we keep it

We retain buyer personal data only for as long as needed to provide fulfilment services and to meet legal, tax, accounting and dispute-resolution obligations. When a merchant disconnects their store or closes their account, we delete or de-identify the associated buyer personal data within a reasonable period, except where we are required to retain specific records by law.

7. Rights of data principals

Data principals (the individuals whose data is processed) may exercise their rights under the DPDP Act — including access, correction, grievance redressal, and erasure — by contacting the merchant they purchased from, who is the Data Fiduciary of their data. Where a request reaches us directly, we will forward it to the relevant merchant and assist them in responding, on a best-effort basis.

You may raise any grievance about our handling of personal data with our Grievance Officer at the contact in Section 10. If your grievance is not resolved to your satisfaction, you have the right to complain to the Data Protection Board of India.

8. International processing

RoutikQ operates in India and processes data on infrastructure consistent with applicable Indian data-protection law.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

For any question about this policy, to exercise your rights, or to raise a grievance about personal data we process, contact our Grievance Officer:

Grievance Officer, RoutikQ Technologies Private Limited Email: support@routikq.com Registered office: RMZ Latitude Commercial, 10th Floor, Bellary Road, Bangalore, Karnataka, India

We aim to acknowledge grievances promptly and resolve them within the timelines required under applicable law.