Privacy
Privacy Policy
This Privacy Policy explains how JaanCar collects, uses, discloses and retains personal data, and the rights available to a Data Principal under the Digital Personal Data Protection Act, 2023.
Last updated 5 October 2026
Identity of the Data Fiduciary
JaanCar (“JaanCar”, “we”, “us” or “our”) operates an independent assessment and listing service for used vehicles in India through the website identified below (the “Website”). In respect of the personal data described in this Privacy Policy, JaanCar is the Data Fiduciary within the meaning of the Digital Personal Data Protection Act, 2023 (the “Act”), and the individual to whom that personal data relates is the Data Principal.
- Website
- jaancar.com
Categories of personal data collected
JaanCar does not acquire personal data from data brokers. Each category set out below is either provided directly by the Data Principal or generated by the Data Principal's browser in the course of using the Website.
Visitors to the Website
- Pages viewed, the approximate location derived from the internet protocol address, device and browser characteristics, and the source from which the visit originated. This data is collected by Google Analytics and PostHog on every visit, without cookies and without any identifier stored on the device, so that one visit cannot be linked to another. Where the Data Principal selects Accept all on the cookie banner, analytics cookies are also set, which allow a later visit from the same browser to be recognised.
- The language preference and the cookie preference recorded, which are stored in two necessary cookies on the Data Principal's own device so that the Website does not repeat the request.
Persons submitting an enquiry or booking an assessment
- Name, telephone number, the vehicle in respect of which the enquiry is made, and the contents of any message submitted.
- Email address, where an assessment is booked rather than an enquiry sent to a dealer.
- All such data is obtained from the form submitted. Buyers do not hold an account on the Website, and no password or profile is created for them.
Dealers holding a dashboard account
- The email address associated with the account used to sign in through a third-party identity provider, together with the dealership name, dealer code and locality.
- The yard profile: dealership name, address, telephone number, messaging number, the description supplied, and the cover and profile images uploaded.
- Each vehicle listed, the images accompanying it, and each buyer enquiry received through those listings.
Applicants to the dealer network
- The information submitted in the application form: the dealership, contact details, city and the volume of stock held.
- Applications are retained whether or not they are accepted, so that the outcome may be communicated and so that an applicant is not required to submit the same information a second time.
Applicants for employment or an internship
- Name, contact details, the role applied for, the responses submitted to the assessment task, and any links provided.
- The resume submitted, which is held in private storage that is not accessible from any public page.
Purposes for which personal data is processed
- To transmit an enquiry to the single dealer in respect of whose vehicle the enquiry was made, so that the enquiry may be answered.
- To operate the dealer dashboard, including authentication and the display of the yard profile, the listings and the enquiries received against them.
- To publish a dealer's yard page and vehicle listings on the Website.
- To open a dealer account upon an application to the dealer network, which is done by matching the email address given on the application against the email address of the Google account with which the applicant signs in.
- To determine an application for employment, and to communicate the outcome.
- To understand, in aggregate, how the Website is used, which is the purpose of the anonymous visit counts and of the analytics cookies.
- To protect the Website against misuse, including rate limiting, fraud prevention and the security measures appropriate to a service that receives telephone numbers.
Lawful basis for processing
JaanCar processes personal data on the basis of consent under section 6 of the Act and, where applicable, on the basis of certain legitimate uses under section 7 of the Act. The basis that applies depends on the manner in which the personal data was provided.
Consent under section 6
Analytics cookies are set only on the basis of consent, given by selecting Accept all on the cookie banner displayed at the foot of the Website, and that consent may be withdrawn at any time by selecting Necessary only. Anonymous, cookieless counting of page visits, which stores nothing on the device, runs whichever choice is made. Vehicle images and a yard description submitted by a dealer for publication are processed on the basis of the consent given when that content is submitted.
Certain legitimate uses under section 7
Where a Data Principal voluntarily provides personal data to JaanCar for a specified purpose and has not indicated an objection to its use for that purpose, the personal data is processed on that basis. This applies to an enquiry submitted to a dealer, to an assessment booking, to an application to the dealer network and to an application for employment, in each case only for the purpose for which the personal data was provided.
A Data Principal is entitled to notice of the processing before it is undertaken, and this Privacy Policy constitutes that notice. Where JaanCar proposes to process personal data for a purpose not described above, consent will be obtained before that processing is undertaken.
Disclosure of personal data
Personal data is disclosed only to the following categories of recipient.
- The dealer to whom an enquiry is addressed. The name, telephone number and message of the Data Principal are disclosed to that dealer alone, so that the enquiry may be answered. No other dealer receives them.
- Third-party service providers engaged for hosting, database, storage, authentication and analytics, who process personal data on our instructions under contract and are not permitted to process it for their own purposes.
- A third-party identity provider, which verifies the identity of a dealer at sign-in.
- Analytics services, which receive anonymous usage data on every visit and, where analytics cookies have been accepted, the identifiers held in those cookies.
- A court, a regulator or a law enforcement authority, where disclosure is required by law.
JaanCar does not sell personal data and does not disclose it to advertising networks. No arrangement exists under which any person pays JaanCar for the telephone number of a Data Principal.
Storage of personal data
The database and the files uploaded to the Website are held with third-party service providers engaged for hosting, database and storage, who process personal data on our instructions under contract. Material submitted in confidence, including resumes, is held in private storage. Vehicle images submitted for publication are held in public storage, a listing image being intended for publication.
Access is restricted at record level, so that the account of one dealer cannot read the enquiries received by another, and private storage is not addressable from any public location.
Retention of personal data
Personal data is retained until it is deleted by the Data Principal or until its erasure is requested, and is erased thereafter unless its retention is required by law. Where a dealer deletes a dealer account, the yard profile, the listings, the images accompanying them and the enquiries received against them are erased at the same time.
Analytics services retain their own aggregate records for the retention periods applicable to those services. Selecting Necessary only stops analytics cookies from being set and removes those the Website has already set on the browser. Anonymous, cookieless visit counts continue to be transmitted.
Rights of the Data Principal
A Data Principal has the following rights under the Act. No fee is charged for the exercise of any of them.
- The right to obtain a summary of the personal data processed and of the processing activities undertaken in respect of it.
- The right to have inaccurate or misleading personal data corrected, and incomplete personal data completed.
- The right to have personal data erased, unless its retention is required for a purpose specified under the Act or by any other law.
- The right to grievance redressal in respect of any act or omission of JaanCar concerning the performance of its obligations under the Act.
- The right to nominate another individual to exercise these rights in the event of death or incapacity.
- The right to withdraw consent previously given, at any time and with the same ease with which it was given.
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before the withdrawal.
How these rights may be exercised
Dealers holding an account
The dashboard provides, at the foot of the yard profile page, a control from which the account may be deleted. Deletion takes effect immediately: the yard page is withdrawn from publication, the listings and their images are erased, the enquiries received against them are erased, and the sign-in credentials cease to operate. No such request is held for review.
Withdrawal of consent to analytics cookies
The control set out below, which is also reached from the Cookie settings link at the foot of every page, records the choice on the browser in use. The choice is stored on the device, and a choice recorded on one device does not apply to another.
All other requests
A request to exercise any other right may be submitted to JaanCar through the contact channels published on the Website, from the email address or telephone number previously provided, stating the right to be exercised and the personal data concerned.
JaanCar responds to such requests within the period prescribed under the Act. A Data Principal who is not satisfied with the response may approach the Data Protection Board of India.
Cookie preferences
Necessary cookies are always set, and anonymous, cookieless visit counts are always collected. Analytics cookies are set only after Accept all is selected, and stop as soon as Necessary only is selected. The control below shows the choice recorded on this browser and permits it to be changed.
No cookie preference has been recorded on this browser. Only necessary cookies are used until one is.
Contact and grievance redressal
Questions concerning this Privacy Policy, requests to exercise the rights described above and complaints concerning the processing of personal data may be raised with JaanCar through the contact channels published on the Website.
Such complaints are acknowledged and addressed within the period prescribed under the Digital Personal Data Protection Act, 2023. A Data Principal who is not satisfied with the response received may approach the Data Protection Board of India.
Children
The Website is intended for the purchase, sale and assessment of vehicles by adults and is not directed at any person below the age of eighteen years. JaanCar does not knowingly process the personal data of a child, and does not undertake tracking, behavioural monitoring or targeted advertising directed at children. Where JaanCar is informed that the personal data of a child has been submitted, that personal data is erased.
Personal data breach
In the event of a personal data breach, JaanCar notifies the Data Protection Board of India and each affected Data Principal in the manner and within the period prescribed under the Act. The notification states the nature and extent of the breach, its likely consequences and the measures taken to remedy it.
Changes to this Privacy Policy
Where this Privacy Policy is amended, the date stated above is updated accordingly. Where an amendment involves the processing of personal data for a purpose not previously notified, consent will be obtained before that processing is undertaken.