Kotiyo Privacy Policy

1. Scope and role of Mywe

Kotiyo is a residential/community management platform. Depending on the deployment and contract, the housing association, RWA, property manager, builder, facility operator or other subscribing organisation may determine the purposes for which resident/community data is processed. Mywe may act as a service provider/data processor for such organisation and, for Mywe-operated account, billing, support and platform functions, may act as a data fiduciary/data controller where applicable.

2. Personal data we may process

• Identity and profile information: name, photograph, resident type, flat/unit, occupancy status and relationship to household.
• Contact information: mobile number, email address, postal/address details and emergency contact information.
• Account and authentication information: login credentials, OTP-related records, account identifiers, role, permissions and access history.
• Residential and operational information: unit details, move-in/move-out information, parking allocation, vehicle information, amenity bookings, maintenance requests, complaints and service requests.
• Visitor/security information: visitor name, contact details, purpose of visit, host/unit, entry/exit timestamps, vehicle details and status. Where enabled by the community, security personnel may record photographs or other verification information.
• Payment and billing information: invoices, dues, transaction identifiers, payment status, refunds and reconciliation information. Mywe should not store full card numbers, CVV or banking credentials unless expressly required and lawfully permitted; payments may be handled by authorised payment service providers.
• Technical and usage information: IP address, device information, operating system, app version, browser information, logs, crash reports, approximate location where enabled, and usage/activity data.
• Communications: announcements, complaints, support requests, feedback and communications submitted through Kotiyo.
• Any other information you voluntarily submit or that the subscribing community lawfully provides to us.

3. Purposes of processing

• Creating and administering user accounts and resident profiles.
• Resident onboarding, verification, access control and community administration.
• Security, visitor management, gate operations and emergency communications.
• Parking and vehicle management.
• Maintenance requests, complaints, service tickets and vendor coordination.
• Billing, dues, subscription administration, payment reconciliation and refunds.
• Amenity discovery, reservations and usage administration.
• Announcements, notices, alerts and community communications.
• Fraud prevention, abuse detection, audit logging, troubleshooting and cybersecurity.
• Customer support, service improvement, analytics and product development, using aggregated or appropriately de-identified information where feasible.
• Compliance with applicable law, lawful requests, court/authority orders, contractual obligations and protection of rights and safety.

4. Consent and lawful basis

Where consent is required, Kotiyo will seek consent in a clear and specific manner and will not treat unrelated consent as a condition for unrelated services. Where processing is based on another lawful ground permitted by applicable law, we may process data without separate consent to the extent legally permitted. Users may withdraw consent where consent is the legal basis, subject to legal, contractual, security and operational limitations.

5. Sharing and disclosure

• With the subscribing residential/community organisation and authorised administrators.
• With security personnel and authorised staff strictly for community/security operations.
• With payment gateways, messaging providers, cloud hosting providers, analytics, customer-support and other technology vendors that process information on our behalf.
• With professional advisers, auditors, insurers, acquirers or investors where reasonably necessary and subject to confidentiality and applicable law.
• With government, law-enforcement or regulatory authorities where disclosure is required or permitted by law.
• During a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, subject to applicable legal requirements.

Mywe does not authorise third parties to use resident data for unrelated purposes merely because they have access to the platform.

6. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide services, resolve disputes, maintain financial and audit records, comply with legal obligations, enforce agreements, prevent fraud and protect security. Retention periods may vary by data category, contract and applicable law. Community organisations may have separate retention requirements for records they control.

7. Security

Mywe will maintain reasonable technical and organisational safeguards appropriate to the nature of the data and risks, which may include access controls, role-based permissions, encryption in transit, secure hosting, logging, backups, vulnerability management and incident response. No internet or information system can be guaranteed to be completely secure. Users must protect OTPs, passwords and devices and promptly report suspected unauthorised access.

8. User rights and requests

Subject to applicable law, users may request access to personal data, correction/update, deletion where permitted, withdrawal of consent where applicable, information about processing, and grievance redressal. Requests should be sent to mywetechnologiesbusiness@gmail.com. Where the community organisation controls the relevant data, Mywe may route the request to that organisation or assist it in responding.

9. Children

Kotiyo is intended for use by authorised residents and community users. Where a child's personal data is processed, the subscribing organisation and Mywe will apply safeguards required by applicable law, including any applicable requirements relating to verifiable parental consent and processing of children's data.

10. International processing

Service providers or infrastructure may process data in jurisdictions outside India where legally permitted. Where applicable, Mywe will implement contractual, technical or other safeguards required by law.

11. Cookies and similar technologies

Web versions of Kotiyo may use cookies or similar technologies for authentication, security, preferences, analytics and service operation. Users can manage browser controls where available, although disabling essential technologies may affect functionality.

12. Data breaches and incident response

If a personal data breach occurs, Mywe will assess and respond in accordance with applicable law and contractual obligations, including required notifications to affected persons, customers and/or authorities where legally required.

13. Changes

We may update this Policy to reflect changes in Kotiyo, law, technology or business practices. Material changes will be communicated through appropriate channels where required.

14. Grievance / privacy contact

• Privacy and grievance contact: mywetechnologiesbusiness@gmail.com
• Phone: +91 90724 89489
• Registered office: Sawmil Road, Koorkenchery, Thrissur, Kerala 680007
• Company: Mywe Technologies