Privacy Policy

1. Introduction & Scope

BBA Consulting Services, LLC ("Oreo", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, process, disclose, and protect personal data collected through our website (getoreo.com) and cloud application (app.getoreo.com). This policy is formulated in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023, India), the General Data Protection Regulation (GDPR), and relevant data protection laws.

2. Roles: Data Fiduciary vs. Data Processor

2.1 Oreo as Data Processor: For client guest records, pet owner phone numbers, pet vaccination certificates, and identification documents uploaded by pet parents or boarding kennel operators, Oreo acts strictly as a Data Processor. The kennel business operator acts as the Data Fiduciary.

2.2 Oreo as Data Fiduciary: For account registration, tenant billing profiles, and direct business communications with our customers, BBA Consulting Services, LLC acts as the Data Fiduciary.

3. Information We Collect

• Tenant Account Information: Business name, owner email, mobile number, physical address, business logo, and GSTIN (where applicable).
• Boarding Operations Data: Guest pet names, breeds, vaccination expiry records, feeding notes, medical logs, and emergency contact details.
• Identity Proofs & UIDAI Compliance: Government identity documents (Aadhaar, Driving License, PAN) uploaded during client check-in. In strict accordance with UIDAI mandates and DPDP rules:
  • Raw 12-digit Aadhaar numbers are never stored in our databases. The first 8 digits are permanently masked (e.g., XXXX-XXXX-1234).
  • Uploaded identity documents in cloud storage are automatically expired and deleted after 90 days under our S3 Lifecycle policy.
• Payment & Billing Information: Payment transactions are handled directly by our Merchant of Record, Paddle.com. Oreo never stores raw credit card numbers or banking passwords.

4. Granular Consent Tracking (DPDP Section 6)

In adherence to India's DPDP Act, every personal data capture event is linked to an immutable, timestamped ConsentRecord audit log recording the consenting subject ID, consent type (e.g., Terms, Data Processing, Vaccination Verification), IP address, and browser agent. Data principals have the statutory right to withdraw consent at any time.

5. Data Security & Technical Safeguards

Oreo implements defense-in-depth technical safeguards to protect your personal data:

• Encryption at Rest: All database stores and file storage buckets enforce AWS Key Management Service (AWS KMS) / AES-256 encryption.
• Encryption in Transit: Strict TLS 1.3 encryption across all API and web interactions.
• Short-Lived Document Access: Document access URLs are pre-signed with a maximum lifespan of 15 minutes (900s).
• Tenant Isolation: Strict multi-tenant isolation via partition keys and row-level authorization rules.

6. Data Retention & Erasure

We retain operational pet boarding logs for as long as your tenant subscription is active. Upon receipt of a verified right-to-erasure request under DPDP Act 2023 Section 12 or account termination, client documents and personal identifiers are permanently purged within 30 days, retaining only legally mandated financial accounting records.

7. Third-Party Processors

We share minimal necessary data with trusted cloud infrastructure and payment partners:

• Paddle.com: Merchant of Record for global checkout, billing, and tax remittance.
• Amazon Web Services (AWS): Cloud hosting, AppSync, DynamoDB, and encrypted S3 storage.
• Twilio / WhatsApp Business API: Verified operational reminders and check-in updates.

8. Data Protection Officer & Grievance Redressal

In compliance with DPDP Act 2023 regulations, we have appointed a Grievance Officer to address data privacy inquiries or rights requests: