DATA RETENTION POLICY

Responsible Information Management · Data Privacy · Information Security · Regulatory Compliance

Document Control

Table of Contents

1. Introduction

2. Purpose of This Data Retention Policy

3. Scope and Applicability

4. Definitions

5. Nature of Platform Services

6. Compliance Commitment

7. Categories of Information Covered

8. Principles of Data Retention

9. Retention Period Determination Criteria

10. Data Storage and Security Measures

11. Data Review and Disposal Procedures

12. User Rights and Requests

13. Incident Management and Record Preservation

14. Compliance Monitoring and Periodic Reviews

15. Data Security and Record Disposal

16. Disclaimer

17. Amendments and Updates

18. Governing Law and Jurisdiction

19. Contact Information

20. Conclusion — Our Commitment

1. Introduction

PRNV Services (“PRNV Services,” “we,” “us,” or “our”) is a technology-enabled digital listing, advertising, and service-discovery platform that connects independent service professionals, technicians, vendors, and businesses with customers across India through a unified set of digital properties. In the course of operating this platform, PRNV Services collects, processes, stores, and manages various categories of information in order to deliver reliable services, maintain platform integrity, ensure security, and comply with applicable legal and regulatory obligations.

This Data Retention Policy (the “Policy”) sets out the principles, standards, criteria, and procedures that govern how long PRNV Services retains information, how such information is stored and secured during its lifecycle, and how it is reviewed, archived, and securely disposed of when it is no longer required. The Policy reflects our commitment to responsible information management, data privacy, information security, transparency, and lawful record management across every stage of the data lifecycle.

This Policy forms part of the broader governance, privacy, and information-security framework of PRNV Services and should be read together with our Privacy Policy, Terms and Conditions, Cookie Policy, and other policies published on our digital platforms. By accessing or using any PRNV Services platform, you acknowledge that you have read and understood the manner in which information is retained and disposed of as described in this Policy.

2. Purpose of This Data Retention Policy

The purpose of this Policy is to establish a clear, consistent, and accountable framework for the retention and disposal of information across all digital platforms and services operated by PRNV Services. Specifically, this Policy is intended to:

•       define the categories of information covered and the principles that govern their retention;

•       ensure that information is retained only for as long as it is necessary to fulfil legitimate, specified, and lawful purposes;

•       set out the criteria used to determine appropriate retention periods, having regard to legal, regulatory, operational, and security requirements;

•       describe the administrative, technical, and physical safeguards applied to protect information throughout its retention lifecycle;

•       establish secure, auditable, and irreversible methods for the review, archival, and disposal of information that is no longer required;

•       support compliance with applicable Indian laws and regulations relating to data protection, information security, and record management; and

•       affirm our ongoing commitment to data minimisation, accountability, transparency, and the continuous improvement of our data-governance practices.

3. Scope and Applicability

This Policy applies to all information that is collected, generated, received, processed, stored, or otherwise handled by PRNV Services across the entirety of its digital ecosystem. Without limitation, this Policy applies to all of the following platforms, channels, and environments operated or controlled by PRNV Services:

•       Website — the PRNV Services website and all associated web pages, subdomains, and online interfaces;

•       Mobile Applications — all PRNV Services mobile and tablet applications across supported operating systems;

•       Customer Portals — account dashboards, profile pages, and self-service interfaces made available to users;

•       Online Services — listing, discovery, search, booking-management, communication, and related digital services;

•       Communication Channels — in-platform messaging, notifications, email, support tickets, and other electronic communication facilities;

•       Digital Content and Technology Platforms — content-management, hosting, analytics, and related technology infrastructure; and

•       Information Systems and Databases — all production, backup, archival, and supporting databases, servers, logs, and storage systems.

This Policy applies to information relating to customers, service professionals, technicians, vendors, business partners, visitors, and other users of the platform, as well as to operational and system-generated records. It binds all personnel, contractors, and authorised third-party processors who handle information on behalf of PRNV Services, each of whom is required to act in accordance with this Policy and applicable law.

4. Definitions

For the purposes of this Policy, the following terms have the meanings set out below. Terms not defined here carry the meaning given to them under applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

5. Nature of Platform Services

PRNV Services operates as a technology-enabled digital intermediary and listing, advertising, and service-discovery platform. The platform enables independent service professionals, technicians, vendors, and businesses to publish listings and connect with customers seeking their services. PRNV Services functions as an “intermediary” within the meaning of the Information Technology Act, 2000, and facilitates digital connections between independent parties through its technology infrastructure.

PRNV Services is not itself a provider of the underlying professional, technical, repair, healthcare, educational, or other end-services that are listed on the platform. Such services are rendered solely by independent service professionals and businesses in their own capacity. The information-handling and retention practices described in this Policy relate to PRNV Services’ role as the operator of the technology platform and as a custodian of the information processed through it.

6. Compliance Commitment

PRNV Services is committed to managing information in a lawful, fair, transparent, and accountable manner. Our retention and disposal practices are designed to be consistent with applicable Indian laws and regulations, including, without limitation:

•       the Digital Personal Data Protection Act, 2023 and rules made thereunder;

•       the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;

•       the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;

•       applicable provisions of the Indian Evidence Act, 1872 / Bharatiya Sakshya Adhiniyam, 2023 relating to electronic records;

•       the Indian Contract Act, 1872, the Consumer Protection Act, 2019, and rules made thereunder; and

•       all other applicable statutes, rules, regulations, notifications, and directions in force from time to time.

Where this Policy refers to specific retention practices, those practices are intended to operate in harmony with our statutory obligations. In the event of any conflict between this Policy and a mandatory requirement of applicable law, the requirement of applicable law shall prevail.

7. Categories of Information Covered

This Policy governs the retention and disposal of the categories of information described below. Not all categories apply to every user, and the information actually held depends on how an individual interacts with the platform. PRNV Services applies the principle of data minimisation to ensure that only information that is relevant and necessary for a specified purpose is collected and retained.

7.1 Personal Information

Identification and profile information relating to an identifiable individual, which may include name, gender, date of birth, photograph, and government-issued identifiers where lawfully required for verification or compliance purposes. Such information is retained to establish and maintain user identity, enable verification, and meet legal and regulatory obligations.

7.2 Account Registration Information

Information provided when creating or maintaining an account, including login credentials (stored in protected form), account settings, preferences, display names, and profile details. This information is retained for the duration of the account relationship and for such further period as is necessary to address disputes, enforce terms, or comply with law.

7.3 Service Request Information

Information relating to listings, enquiries, search activity, service requests, bookings, and related interactions facilitated through the platform. This information is retained to operate the platform, maintain service continuity, support dispute resolution, and meet record-keeping obligations.

7.4 Communication Records

Records of communications exchanged through the platform, including in-platform messages, notifications, emails, and, where lawfully captured with appropriate notice and consent, other electronic communications. Such records are retained to provide and improve services, maintain a reliable communication history, and address grievances, disputes, and compliance requirements.

7.5 Customer Support Records

Records relating to customer-support and grievance-handling interactions, including support tickets, queries, complaints, escalations, and their resolution. These records are retained to ensure accountability, enable effective grievance redressal, and demonstrate compliance with applicable consumer-protection and grievance-handling obligations.

7.6 Technical and Usage Information

Technical and usage information generated through interaction with the platform, including device identifiers, IP addresses, browser and operating-system information, application logs, cookies and similar tracking technologies, and aggregated usage and performance metrics. This information is retained to operate, secure, analyse, and improve the platform, and to detect and prevent fraud, abuse, and security incidents.

7.7 Security Logs and Monitoring Records

Security and audit logs, access records, authentication records, monitoring data, and digital evidence relating to the integrity and security of the platform. Such records are retained to support information-security operations, incident detection and response, audits, investigations, and the preservation of evidence where required.

7.8 User-Generated Content

Content submitted or published by users, including listing content, descriptions, images, ratings, reviews, feedback, and other materials. Such content is retained for as long as it remains relevant to the operation of the platform, subject to applicable moderation, takedown, dispute, and legal-preservation requirements.

7.9 Business and Operational Records

Operational, administrative, and statutory records generated in the ordinary course of operating the platform, including transactional and billing records, accounting and tax records, compliance documentation, contractual records, and other records that PRNV Services is required to maintain under applicable law. Such records are retained for the periods prescribed by applicable accounting, tax, regulatory, and statutory record-keeping requirements, and for such additional period as may be necessary for legitimate operational, audit, or legal purposes.

8. Principles of Data Retention

The retention and disposal of information by PRNV Services is guided by the following core principles, which apply across all categories of information and all platforms.

8.1 Data Minimisation and Necessity

PRNV Services retains information only where, and only for as long as, it is necessary to fulfil the specific, legitimate, and lawful purpose for which it was collected, or to satisfy a legal, regulatory, operational, or security requirement. Information that is no longer necessary for any such purpose is securely disposed of, anonymised, or de-identified in accordance with this Policy. We do not retain information indefinitely or without a defined and justifiable purpose.

8.2 Accuracy and Integrity of Records

PRNV Services takes reasonable steps to ensure that retained information is accurate, complete, and kept up to date to the extent appropriate for the purpose for which it is held. We maintain the integrity of records throughout their retention lifecycle through appropriate access controls, change management, logging, and backup procedures, so that retained information remains reliable, attributable, and protected against unauthorised alteration.

8.3 Purpose Limitation and Lawfulness

Information is retained and used only for purposes that are compatible with those for which it was originally collected, or as otherwise permitted or required by applicable law. PRNV Services applies a lawful basis to its retention activities and ensures that retention is proportionate to the purpose it serves.

8.4 Accountability and Transparency

PRNV Services maintains internal standards, documentation, and oversight to demonstrate compliance with this Policy. We provide transparent information about our retention practices through this Policy and our Privacy Policy, and we respond to legitimate requests and queries in accordance with applicable law.

9. Retention Period Determination Criteria

PRNV Services does not apply a single, uniform retention period to all information. Instead, retention periods are determined for each category of information on a reasoned basis, taking into account the criteria set out below. Because these criteria vary by category and by circumstance, retention periods may differ across information types and may be extended where a continuing legal, regulatory, operational, or security justification exists.

9.1 Legal and Regulatory Requirements

Retention periods are determined first by reference to applicable legal and regulatory obligations. Certain categories of records must be retained for minimum periods prescribed by law, including obligations arising under data-protection, information-technology, accounting, tax, consumer-protection, and other applicable legislation. Where the law mandates a minimum retention period, PRNV Services retains the relevant records for at least that period, and may retain them longer where a legitimate basis exists.

9.2 Operational and Security Requirements

Retention periods also reflect legitimate operational and security requirements, including the need to operate and maintain the platform, ensure service continuity, support audits and reconciliations, detect and prevent fraud and abuse, maintain security logs and evidence, and resolve disputes, complaints, and claims. Information required for these purposes is retained for as long as the relevant operational or security need subsists.

9.3 Determination Framework

In determining the appropriate retention period for a category of information, PRNV Services considers, among other factors:

•       the purpose for which the information was collected and whether that purpose remains valid;

•       any minimum or maximum retention period prescribed by applicable law or regulatory guidance;

•       the existence of any ongoing or anticipated dispute, investigation, audit, claim, or legal proceeding;

•       operational, continuity, and service-delivery requirements;

•       information-security, fraud-prevention, and evidence-preservation needs;

•       the sensitivity of the information and the risk associated with its retention; and

•       the principle of data minimisation and the feasibility of anonymisation or de-identification as an alternative to retention.

10. Data Storage and Security Measures

Throughout the retention lifecycle, PRNV Services applies reasonable and appropriate security safeguards designed to protect information against unauthorised access, alteration, disclosure, loss, or destruction. Our information-security framework comprises administrative, technical, and physical safeguards aligned with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and informed by internationally recognised information-security standards.

10.1 Access Controls and Confidentiality

Access to retained information is restricted on a need-to-know basis through role-based access controls and least-privilege principles. Personnel, contractors, and authorised processors who handle information are bound by confidentiality obligations and are granted access only to the extent necessary to perform their authorised functions. Authentication, authorisation, and logging mechanisms are applied to govern and record access to information systems and databases.

10.2 Archiving and Backup Procedures

PRNV Services maintains backup and archival procedures to support service continuity, disaster recovery, and the integrity of records. Backups are created and retained in accordance with defined schedules and are protected by appropriate access controls and, where applicable, encryption. Archived information is segregated from active production data and is retained only for as long as a legitimate purpose or legal obligation requires, after which it is securely disposed of in accordance with this Policy.

10.3 Encryption and Protective Controls

Where appropriate, PRNV Services applies encryption of information in transit and at rest, secure configuration of systems, network protection measures, and other protective controls. These measures are designed to safeguard the confidentiality, integrity, and availability of information throughout its retention period.

11. Data Review and Disposal Procedures

PRNV Services conducts periodic reviews of retained information to identify records that have reached the end of their applicable retention period or that are otherwise no longer required for any legitimate purpose. Information identified for disposal is securely deleted, destroyed, anonymised, or de-identified in a controlled and auditable manner.

11.1 Periodic Review

Retained information is reviewed at appropriate intervals against the retention criteria set out in this Policy. Where information is found to be no longer necessary and is not subject to any preservation requirement, it is queued for secure disposal. Records subject to a legal hold, dispute, investigation, audit, or other preservation requirement are excluded from disposal until the relevant requirement no longer applies.

11.2 Secure Deletion and Destruction Methods

PRNV Services employs secure and, where feasible, irreversible methods for disposing of information that is no longer required. These methods are selected according to the nature and medium of the information and may include:

•       secure deletion of electronic records from production, backup, and archival systems using methods designed to render the data unrecoverable;

•       cryptographic erasure or overwriting of storage media where appropriate;

•       anonymisation or de-identification of information that may be retained in aggregate or non-identifiable form for legitimate analytical or statistical purposes;

•       secure wiping, degaussing, or physical destruction of decommissioned electronic storage media; and

•       secure shredding or destruction of any physical records.

Disposal activities are conducted by authorised personnel or vetted service providers under appropriate controls, and records of disposal are maintained where required to demonstrate accountability and compliance.

12. User Rights and Requests

PRNV Services respects the rights of individuals in relation to their Personal Information, as recognised under applicable Indian law, including the Digital Personal Data Protection Act, 2023. This Policy operates alongside our Privacy Policy, which describes these rights in further detail.

12.1 Data Access, Correction, and Deletion Requests

Subject to applicable law, individuals may request access to a summary of their Personal Information, request correction, completion, or updating of inaccurate or incomplete information, and request erasure of information that is no longer necessary for the purpose for which it was collected, where no overriding legal basis for retention applies. Requests may be submitted to the contact points set out in Section 19 of this Policy. PRNV Services may verify the identity of the requester before acting on a request and may decline requests that are unlawful, frivolous, vexatious, or repetitive, or that would compromise the rights of others or the integrity of the platform.

12.2 Exceptions and Preservation Requirements

The exercise of a deletion or erasure request does not override retention obligations that arise under applicable law or other legitimate grounds. PRNV Services may continue to retain information, notwithstanding a deletion request, where retention is necessary to:

•       comply with a legal, regulatory, accounting, or tax obligation;

•       establish, exercise, or defend legal claims, or to resolve disputes;

•       preserve records relevant to an ongoing or anticipated investigation, audit, or legal proceeding;

•       prevent, detect, or investigate fraud, abuse, or security incidents; or

•       protect the rights, property, safety, or legitimate interests of PRNV Services, its users, or other parties.

Where information is retained under such an exception, it will be securely disposed of once the applicable preservation requirement no longer applies.

13. Incident Management and Record Preservation

PRNV Services maintains incident-management procedures to detect, respond to, contain, and recover from information-security incidents and data breaches. In the event of a notifiable Personal Data breach, PRNV Services will follow the notification and reporting requirements prescribed under applicable law, including the Digital Personal Data Protection Act, 2023, and will take reasonable steps to mitigate the impact of the incident.

Where an incident, dispute, investigation, audit, or legal obligation requires the preservation of records, PRNV Services applies a preservation hold to the relevant information. Information subject to a preservation hold is retained securely and is excluded from routine disposal until the hold is lifted. Security logs, audit trails, transaction records, and digital evidence may be preserved for these purposes and may constitute admissible electronic records under applicable law, including Sections 65A and 65B of the Indian Evidence Act, 1872 and the corresponding provisions of the Bharatiya Sakshya Adhiniyam, 2023, as applicable.

14. Compliance Monitoring and Periodic Reviews

PRNV Services monitors compliance with this Policy through internal oversight, periodic reviews, and, where appropriate, audits of its retention and disposal practices. These activities are designed to confirm that information is being retained in accordance with the applicable criteria, that disposal is being carried out securely and on schedule, and that safeguards remain effective.

This Policy is reviewed periodically, and at least once every twelve (12) months, or earlier where there is a material change in applicable law, regulatory expectations, platform operations, or information-security risk. Findings from monitoring and review activities are used to update and strengthen our retention practices as part of our commitment to continuous improvement in data governance.

15. Data Security and Record Disposal

This section sets out in greater detail the safeguards that PRNV Services applies to protect information throughout its retention lifecycle and the methods by which records are securely disposed of when they are no longer required. These safeguards are organised into administrative, technical, and physical measures, supported by monitoring, auditing, secure-disposal, and incident-recovery practices.

15.1 Administrative Safeguards

Administrative safeguards include documented policies and procedures governing information handling and retention, defined roles and responsibilities for data governance, confidentiality undertakings binding personnel and authorised processors, access-management procedures based on need-to-know and least-privilege principles, training and awareness measures, and written arrangements with third-party processors that impose confidentiality, security, and data-handling obligations.

15.2 Technical Safeguards

Technical safeguards include role-based access controls and authentication mechanisms, encryption of information in transit and at rest where appropriate, secure system configuration and hardening, network and endpoint protection measures, logging and audit trails, vulnerability management, and secure backup and recovery procedures. These controls are designed to protect the confidentiality, integrity, and availability of retained information.

15.3 Physical Safeguards

Physical safeguards include controls over the facilities, equipment, and media used to store or process information, such as restricted physical access to systems and storage, environmental and operational protections at hosting and data-storage locations, and secure handling and decommissioning of physical media. Where hosting is provided by third parties, PRNV Services relies on contractual arrangements and assurances regarding the physical security of the relevant infrastructure.

15.4 Monitoring and Auditing Practices

PRNV Services maintains logging, monitoring, and auditing practices to oversee access to and use of retained information, to detect anomalous or unauthorised activity, and to verify adherence to retention and disposal schedules. Audit trails and security logs are themselves retained and protected for periods consistent with operational, security, and legal requirements.

15.5 Secure Deletion Methods

When electronic records reach the end of their retention period and are not subject to any preservation requirement, they are securely deleted using methods designed to render the information unrecoverable. Depending on the system and storage medium, this may involve secure deletion routines, cryptographic erasure, overwriting, or controlled removal from production, backup, and archival environments in a coordinated manner.

15.6 Destruction of Physical and Electronic Records

Physical records that are no longer required are destroyed through secure means such as shredding or other irreversible destruction methods. Electronic storage media that are decommissioned are securely wiped, degaussed, or physically destroyed before disposal or reuse. Destruction activities are carried out by authorised personnel or vetted providers under appropriate controls.

15.7 Incident Management and Recovery Procedures

PRNV Services maintains incident-response and recovery procedures designed to identify, contain, investigate, remediate, and recover from security incidents and data breaches affecting retained information. These procedures include backup and disaster-recovery capabilities intended to restore the availability and integrity of information following a disruptive event, as well as post-incident review to strengthen safeguards. Where an incident gives rise to notification obligations, PRNV Services complies with the applicable reporting requirements under law.

16. Disclaimer

17. Amendments and Updates

PRNV Services may amend, revise, or update this Policy from time to time to reflect changes in applicable law, regulatory expectations, platform operations, technology, or information-security practices. The most current version of this Policy will be published on our digital platforms, and the “Effective Date” and version reference will be updated accordingly. Material changes will be communicated through appropriate means where required. Continued use of the platform after a revised Policy takes effect constitutes acknowledgement of the updated Policy. Users are encouraged to review this Policy periodically.

18. Governing Law and Jurisdiction

This Policy is governed by, and shall be construed in accordance with, the laws of the Republic of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made thereunder, and all other applicable Indian statutes, rules, and regulations in force from time to time.

Subject to any applicable dispute-resolution provisions contained in the Terms and Conditions of PRNV Services, the courts at Hyderabad, Telangana, India shall have exclusive jurisdiction over any dispute, claim, or matter arising out of or in connection with this Policy. Nothing in this Policy limits any right or remedy available to any person under applicable law, including the right to approach the relevant regulatory or judicial authorities.

19. Contact Information

If you have any questions, requests, or concerns regarding this Data Retention Policy or the manner in which PRNV Services retains and disposes of information, or if you wish to exercise your rights in relation to your Personal Information, you may contact us using the details below.

Grievances and requests will be acknowledged and addressed within the timelines prescribed under applicable law. PRNV Services may verify the identity of any requester before acting on a request relating to Personal Information.

20. Conclusion — Our Commitment

PRNV Services is committed to responsible data lifecycle management across all of its digital platforms and services. We retain information only for legitimate, specified, and lawful purposes; we protect it with reasonable administrative, technical, and physical safeguards throughout its lifecycle; and we dispose of it securely once it is no longer required. Through data minimisation, robust information security, transparency, lawful record management, and ongoing oversight, we seek to uphold the trust placed in us by our users and partners.

This Policy reflects our continuing dedication to information security, privacy protection, regulatory compliance, transparency, and the continuous improvement of our data-governance practices. PRNV Services will keep this Policy under review and will adapt its practices as law, technology, and best practice evolve, so that the information entrusted to us is managed responsibly at every stage of its lifecycle.