Privacy notice
This notice explains what personal data KarbonZ collects, why, who we share it with, how long we keep it, and how to use your rights under India’s Digital Personal Data Protection Act, 2023. Parv Communications Private Limited is the data fiduciary. You can withdraw consent or ask us anything at info@karbonz.com.
Version 1.1, effective
Who we are
KarbonZ is operated by Parv Communications Private Limited (CIN U64202DL2011PTC212929), B-110 Amar Colony, Lajpat Nagar-4, New Delhi 110024, India. For privacy questions, write to info@karbonz.com.
What we collect and why
We collect only what each purpose below needs. You give us most of it; the rest is created as you use the app.
| Data | Why we use it | What it makes possible |
|---|---|---|
| Mobile number | To sign you in with a one-time code, identify your account, and send reminders you opt into | Sign-in, SMS and WhatsApp reminders |
| Name | To show on your profile and to match against your employee ID card | Profile, employer linking |
| Email address (corporate users, and individuals who add one) | To sign corporate users in and send reminders and service emails | Corporate portal, email reminders |
| Home, energy, travel, food, shopping, waste and water answers, and your city | To calculate your footprint and your KarbonZ score | Footprint, score, insights |
| Bill amounts, bill types, biller and consumer or account numbers | To replace estimates with real figures and fetch bills automatically if you ask us to | Bills, auto-fetch |
| Photos of bills and the text read from them | To verify the bills you upload | Bill verification |
| Employee ID, ID-card photo and the text read from it, and your company’s Corporate ID | To confirm you work where you say before linking you to your employer | Employer linking |
| Employer, branch, department and the program activity you log (for example commute distance or work-from-home days) | To run company programs and include your emissions in your employer’s BRSR reporting | Company programs, employer reporting |
| Points, rewards, invite links and who invited whom | To award points, run rewards and manage invite-only sign-up | Rewards, invites |
| Notification preferences | To send only the messages you have chosen | Reminders |
| Name, work email, company, company size and phone, if you book a demo | To contact you about a demo of KarbonZ for your organisation | Book a demo |
| Consent records and a log of account and data access | To show what you agreed to and when, and to keep the logs the law requires | Legal compliance |
We do not store your IP address, and we do not use advertising or analytics trackers.
Your consent
When you create an account, we ask you to agree to this notice and to confirm you are 18 or older. Marketing messages are a separate choice, and you can sign up without them. We record what you agreed to, which version of this notice you saw, and when.
You can withdraw consent at any time, as easily as you gave it: in the app, open Profile, then Privacy and data. Withdrawing consent to the core service means closing your account, which you can do from the same screen. Withdrawal does not affect processing that happened before it.
Who we share it with
- Your employer, only if you link your account to it. It sees your emissions, score and program activity, limited by role: the ESG head sees the whole organisation, branch and department heads see only their own branch or department.
- Companies that process data for us, listed with their locations on the subprocessor page. They act only on our instructions and are bound to protect it.
- Authorities, when the law requires it.
We never sell your personal data.
Transfers outside India
Some processors handle data outside India, as listed on the subprocessor page. We do not transfer personal data to any country the Government of India restricts.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, answers, bills, scores and activity | While your account is open. Erased when you delete it. |
| Sign-in codes (OTP records) | 7 days |
| ID-card photos and the text read from them | 30 days after the verification decision |
| Bill photos and the text read from them | 90 days after the bill is processed |
| Account and data-access logs | 1 year |
| Records of your data-rights requests | 3 years after the request is closed |
| Demo requests from organisations | 2 years |
| Records of your consent and its withdrawal | 7 years after your account is deleted, to show what you agreed to |
When a period ends, or you withdraw consent, we erase the data unless a law requires us to keep it.
Your rights
Under the DPDP Act you can:
- Access a summary of your data and who we shared it with. In the app: Profile, Privacy and data, Download my data.
- Correct, complete or update your data. Most of it you can edit in the app; for the rest, use the data rights form.
- Erase your data. In the app: Privacy and data, Delete my account.
- Nominate someone to use these rights for you if you die or become unable to.
- Raise a grievance with our Grievance Officer.
We reply to access, correction, erasure and nomination requests within 30 days, and to grievances within 30 days. Use the data rights form or write to the Grievance Officer.
Grievance Officer
Abhishek Khurana, Parv Communications Private Limited, B-110 Amar Colony, Lajpat Nagar-4, New Delhi 110024, India. Email: grievance.officer@karbonz.com.
If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Children
KarbonZ is for people aged 18 and over. We ask you to confirm your age at sign-up. If we learn that someone under 18 has an account, we delete it.
How we protect it
Data is encrypted in transit, access is limited to the staff who need it, access is logged, and backups are kept. See the subprocessor page for who else handles data.
If a breach affects your data, we will tell you without delay, in plain words: what happened, the likely impact, what we are doing, and what you should do. We will also report it to the Data Protection Board.
Changes to this notice
When we change this notice we update the version and date above. If a change affects what you agreed to, we will ask you again.