Mahindra & Mahindra Limited having its registered office at Gateway Building, Apollo Bunder, Colaba, Mumbai – 400 001, Maharashtra, India (“we”, “us”, “our”, “M&M”) is committed to protecting the privacy and security of your personal data. Your privacy is important to us.
This Privacy Notice is for individuals who interact with us either as users, applicants, customers, website visitors or other people whose personal data we process in connection with our products, services, programs, platforms, communications and related business activities (“you”, “your”, or “user(s)”) in the course of their visit to our Website, Mahindra Auto - Passenger & Commercial Vehicles (“Website”). This Privacy Notice shall also apply, where relevant, to personal data relating to your guarantors, nominees, and any other individuals whose personal data is submitted in connection with such interactions. This Privacy Notice explains how we collect and process information that personally identifies you, the purposes for which we use it, and how you can exercise your privacy rights.
For the purposes described in this Privacy Notice, M&M will generally act as a data fiduciary/controller of the personal data processed in connection with the relevant interaction, service, program or business activity.
The scope of this Privacy Notice is limited to the products, services, programs, platforms, communications and related business activities within the territory of India and applies to users who request for these products and services within the territory of India.
1. Personal data that we collect
We endeavor to collect only such information that is necessary for the purposes specified in this Privacy Notice. The following are the categories and types of personal data that we collect and process:
Website: This Privacy Notice applies to all products and/or services offered by us to all individuals (“you”, “your” or “user”) when they access, browse, or use the Website.
- If you interact with us to enquire about a certain product or service, converse with the chatbot, or book a test drive, we may collect the following personal data from you directly: name, mobile number, email ID, residential address, pin code, location data, product interest, occupation type, and age group.
- If you interact with our Website to book a vehicle, exchange your vehicle and opt to finance your purchase, we may collect the personal data mentioned above along with gender, age, date of birth, gross or net annual income, government ID proof like passport, voter ID, driving license, PAN card, Aadhaar card, GST details if applicable, IT returns, salary slips, Form 16, bank statements, educational qualification, and vehicle finance-related information.
- If you wish to make certain service-related queries on the Website, we may collect vehicle serial number and mobile number.
Mahindra For You Application: This Privacy Notice applies to the services offered by us to all individuals (“you”, “your” or “user”) when they access, browse, or use our Mahindra For You Application (“Application” or “App”). You can visit the App without telling us who you are or providing personal data. Such use does not result in any personally identifiable data being collected or stored.
- We may collect information about you when you visit the App, use our services, or view our online advertisements.
- Unless you submit personal data about yourself by filling in any form on the App or by sending us an email, we are not obliged to maintain any other personal data as a result of your access and usage of this App.
- If you wish to interact with our App or make certain service-related queries, we may collect: name, mobile number, login ID and password for the App, residential address, pin code, any KYC documents like Aadhaar, PAN, passport, voter ID or driver’s license, vehicle registration details, and vehicle serial number, being the last 8 digits of the 17-digit VIN.
Products and Services at Dealership: This Privacy Notice applies to the services offered by us to all individuals (“you”, “your” or “user”) when you use the products and/or services provided by our dealership on behalf of us.
- If you interact with our dealership to enquire about a certain product or book a test drive, we may collect: name, mobile number, email ID, corporate name if applicable, residential address, pin code, gender, existing vehicle details if applicable, and driving license number.
- If you interact with our dealership to book a vehicle, exchange your vehicle and opt to finance your purchase, we may collect the information mentioned above along with age, date of birth, government ID proof like passport, voter ID, driving license or PAN card, GST details if applicable, address of vehicle delivery, financier, branch name, file number, insurance and insurance cover note, vehicle registration number, gross or net annual income, IT returns, salary slips, Form 16, bank statements, qualification, vehicle finance-related information, RC book for exchange vehicle, and images of current vehicle for exchange service.
- If you wish to make certain service-related queries, we may collect vehicle serial number and mobile number.
2. Sources of personal data
We collect your personal data that you provide us with, in connection with your interaction with us through our Website forms or when you communicate with us via phone or email or when you write to us or when you submit any document.
We may also collect technical information when you use our Website or online application portal, including, but not limited to cookies and similar trackers, where applicable and in accordance with law.
Sources include:
- Website interactions, including product or service enquiries, chatbot conversations, test drive bookings, vehicle bookings, vehicle exchange, finance requests, and service-related queries.
- Mahindra For You Application interactions, including visiting the App, using our services, viewing online advertisements, filling in forms, sending emails, interacting with the App, and making service-related queries.
- Dealership interactions, including product enquiries, test drive bookings, vehicle bookings, vehicle exchange, finance requests, and service-related queries through our dealership on behalf of us.
3. Purpose of data collection
Website: We collect your personal data for the following purposes:
- To make this Website and its content available to you and to further optimize and develop it.
- To provide you with information, products and/or services that we or other third parties may offer you on our Website.
- To enable account creation and login on our Website and provide notices about your account, subscription or other notices.
- To provide chat services to you, book your vehicle of choice, enable vehicle finance if you opt in, book a test drive, provide exchange offers if you opt in, and provide lease service if you opt in.
- To communicate with you, give you service actions for your vehicle, respond to an enquiry or concern raised by you, and notify you about changes to our Website or products and/or services offered through it.
- To monitor the use of our Website and receive feedback to help in further development of our products and/or services.
- To manage your accounts, service, and other personalized features, and improve the user experience on the Website.
- For marketing, where you opt in, including newsletters, communications about our services or affiliates’ services, new services, promotions, product enhancements, and event-related communications across emails, telephones, text messaging, WhatsApp and direct mail, depending on your preferred mode of correspondence.
Mahindra For You Application: We collect your personal data for the following purposes:
- To make this App and its services available to you and to further optimize and develop it.
- To complete your vehicle registration.
- To provide chat services including customer services to you via the App.
- To give you service actions for your vehicle and respond to an enquiry made by you.
- To identify your geographic location in connection with the required services.
- To facilitate the provision of roadside assistance and other services you acquire from us, our dealers, agents or contractors.
- To monitor the use of the App and help further develop our products and services.
- To manage your accounts, services, and other personalized features, and improve the user experience of the App.
- To create App usage statistics and assess and improve your user experience on the App.
- To recognize, prevent and investigate attacks on this App.
- For marketing, where you opt in, including newsletters, communications about our services or affiliates’ services, new services, promotions, product enhancements, and event-related communications across emails, telephones, text messaging, WhatsApp and direct mail, depending on your preferred mode of correspondence.
Products and Services at Dealership: We collect your personal data for the following purposes:
- To book your vehicle of choice, enable you to finance your vehicle if you opt for the same, book a test drive, and provide you with offers.
- To give you service actions for your vehicle, respond to an enquiry or concern raised by you, and enable RSA option for your vehicle.
- To perform Know Your Customer validation.
- For internal business purposes, including receiving feedback to help in further development of our products and services, managing your accounts, services, and other personalized features, and responding to queries or requests submitted by you when you want to exercise your rights with respect to your personal data.
- For marketing, where you opt in, including alerts about new products or enhancements to our services and marketing or event-related communications across emails, telephones, text messaging, and WhatsApp, depending on your preferred mode of correspondence.
4. Lawful Basis of processing
We use your personal data only if we have a legal basis for doing so. In case, we wish to use your personal data for purposes other than certain legitimate uses, we shall seek specific consent from you in a separate process prior to processing your personal data for such additional purposes.
We may also be required to process your personal data for certain legitimate uses, such as:
- To ensure compliance with our legal obligations and to also comply with our obligations towards public authorities;
- Voluntarily for specified purpose(s) in respect of which you have not denied your consent;
- To enforce any legal right or claim;
- For responding to a medical emergency involving a threat to your health or life or that of any other individual;
- For taking measures to ensure safety of, or provide assistance or services to any individual, any disaster, or any breakdown of public order;
- For the prevention, detection, or investigation of a crime or prevention of fraud;
- As otherwise described to you at the time of collection of your personal data.
The collection, processing, use and storage of personal data shall only be undertaken where a valid legal basis exists. Such lawfulness may arise from your consent, the performance of a contract, compliance with legal obligations, or our legitimate business interests, as applicable. For each specific purpose of processing, we will clearly inform you of the applicable legal basis and the rights available to you in relation to your personal data. In cases where consent is relied upon, it shall be obtained in a clear, specific, unconditional, unambiguous and informed manner and may be withdrawn at any time in accordance with applicable requirements.
5. Sharing/Disclosure of your personal data
As far as this is necessary for the purposes set out above, we will share your personal data with the following recipients who either have a need to know or who will process it for us based on our instructions and for no other purpose:
Mahindra Group Companies and potential partnerships: Our businesses around the world are supported by different teams and functions, and personal data may be made available to them, if necessary, for the provision of products and services, account administration, sales and marketing, customer and technical support, and business and product development. All our employees and contractors are required to follow our data protection and security policies when handling personal data. Your personal data might also have to be shared in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
External service providers: Occasionally, to provide our products and services, it is necessary to collaborate with external service providers. These external service providers shall process your personal data on our behalf subject to appropriate safeguards only insofar as it is necessary for them to provide their services to us. Our prior authorization is required before they are permitted to transfer responsibility for processing personal data to a third-party. We may share your personal data under a valid contract with our channel partners/service partners/third-party entities for the purpose of completing the transaction.
We only share your personal data with recipients who have an adequate level of data protection by implementing appropriate technical and organizational security measures as prescribed by applicable law. We do not sell your personal data to anyone.
Courts and public authorities: We will share your personal data, when required, for the following purposes:
- To comply with legal obligations and respond to requests from government agencies, including law enforcement agencies and other public authorities.
- To prevent or detect or investigate offences or cyber incidents or for the prosecution or punishment of offences.
- To raise or defend against legal claims.
- To protect our users, systems, and product and/or services.
We only share your personal data with recipients that have an adequate level of data protection by implementing appropriate technical and organizational security measures, or we take measures to ensure that all recipients provide an adequate level of data protection as prescribed by applicable law. We do not sell your personal data to anyone.
6. International Transfers
Your personal data may be transferred to, stored in, or accessed from jurisdictions outside India, including where relevant for administration, document review, communications, cloud hosting, support, or and related service providers. Where such transfers occur, we will take steps to ensure that your personal data remains protected in accordance with applicable law and our internal policies.
7. Security Safeguards
We maintain reasonable and appropriate physical, technical, organizational, and administrative security safeguards to protect personal data from unauthorized access, use, disclosure, alteration, loss, or destruction. Access to personal data is strictly controlled through role-based mechanisms and limited to authorized personnel on a need-to-know basis. All personnel are bound by confidentiality obligations and receive regular data protection training. Your personal data is stored and handled using secure practices, supported by monitoring and enhanced protections. Our safeguards are regularly reviewed and strengthened to address evolving risks and security requirements.
8. Retention of Personal Data
We will retain your personal data for as long as we reasonably consider it necessary for achieving the above-mentioned purposes and as is permissible under applicable law. We will, in any case, retain your personal data for as long as there are statutory retention obligations or potential legal claims are not, yet time barred.
9. Third Party Personal Data submitted by you
If you provide us with personal data relating to nominees, or any other individual, you confirm that you are authorised to disclose such data to us and, where required by applicable law, have informed such individuals of such disclosure and the processing contemplated under this Privacy Notice.
10. Safeguarding the privacy of children
We do not knowingly collect or solicit personal data from minors. Our products, services, programs, or platforms are ordinarily intended for individuals who are 18 years of age or older. If you are under 18, please do not attempt to send any personal data about yourself to us.
Further, we do not undertake tracking and behavioural monitoring of children or targeted advertising directed to minors.
If we learn that we have collected personal data from a minor without verified parental consent, we will erase such personal data.
11. How do we use Cookies and other Tracking Mechanisms?
We use cookies and similar technologies to support the proper functioning of our Website and to enhance your user experience. These tools help us recognize returning users, understand how the Website is used, and improve performance and usability over time.
Cookies generally capture device-related information rather than directly identifying a User. Please note that we do not govern or assume responsibility for cookies placed by third-party websites that may be accessible through our platform. Users can manage or disable cookies through their browser settings. However, this may limit certain functionalities or affect the overall user experience. For more information on the cookies, you may refer to the cookie policy.
12.Automated decision-making
We do not take decisions solely by automated means that produce legal or similarly significant effects on you. If any automated tools are used to support administrative review, final decisions will remain subject to human involvement and review.
13. Data privacy for Aadhaar-related information
For your Aadhaar-related data, the following shall apply:
- Appropriate physical, technical, and managerial safeguards are in place to protect your personal data in accordance with applicable laws and regulations. We shall not publish, display, or post your Aadhaar-related data publicly, except were permitted or required by applicable law.
- We do not retain your Aadhaar number or any document or database containing your Aadhaar number for longer than is necessary for the purposes specified above.
14. Your rights in connection with your personal data
We respect your right to access and control your personal data, and we will respond to requests to exercise your rights under applicable laws for information and, where applicable, will correct, update, or erase your personal data.
Please note that applicable law might require that we cannot comply with every request. We will be required to retain your personal data due to legitimate business/ regulatory/ statutory retention requirements despite your request for erasure.
You have the following rights:
- Right to access information about your personal data: At any point, you can contact us for a summary of your personal data we hold about you, the processing activities undertaken with respect to such personal data, the identities of all those persons with whom your Personal Data has been shared by us along with a description of the Personal Data so shared, and any other information related to your personal data and its processing.
- Right to request correction: If your personal data is incomplete, inaccurate or misleading, or out of date, you can inform us about the same, and your personal data will be corrected, completed, or updated, as the case maybe. It is important that the personal data we hold about you is accurate and updated. Please write to us if the personal data given to us changes during the period for which we hold it.
- Right to request erasure: If you believe that we should discontinue the use of your personal data, you have the option to request the deletion of your personal data, unless retention is necessary for compliance with any law for the time being in force.
- Right of grievance redressal: We are committed to protecting your personal data collected by us. However, in case of any act or omission regarding the performance of our obligation in relation to your personal data or in the exercise of your rights under applicable law
- Right to nominate: In the event of death or incapacity to exercise these rights, you can nominate any other individual to exercise such rights.
- Right to withdraw your consent to process personal data: You can withdraw/revoke your consent at any time, to the processing of your personal data for which consent was sought earlier. You can withdraw your consent easily It is important that the personal data we hold about you is accurate and updated. Please write to us if the personal data given to us changes during the period for which we hold it. The withdrawal of consent previously granted for the processing does not affect the lawfulness of the processing until the withdrawal.
For exercising any of your rights, you can contact us using the contact details given below. We will need you to provide proof of your identity before you can exercise these rights. We may not be able to process any requests made in the event you fail to establish your identity or if we are unable to authenticate your identity.
15.Links to other websites of Mahindra Group Companies and businesses
Our Website may contain links to other Mahindra Group Companies and businesses. This Privacy Notice does not cover how the other Mahindra Group Companies or businesses process your personal data. We encourage you to read the privacy policies and terms and conditions of such other websites you visit. M&M is not responsible for content accessible through the websites of other organizations or businesses.
16.Revision to the Privacy Notice
We reserve the right to update or modify this Privacy Notice at our sole discretion at any time.
We reserve the right to update or modify this Privacy Notice at our sole discretion at any time. If any material change affects the way we process your personal data, we will provide you with prior notice through email, or other appropriate means, and where required, seek your consent. Any updates will become effective upon being published on the Website, unless stated otherwise.
Users are encouraged to review this Privacy Notice at regular intervals to stay informed about how their information is handled. Continued access to or use of the Website / Mobile Application following any updates will be considered as acceptance of the revised terms. M&M recommends that users remain aware of such changes to ensure they are fully informed of the current Privacy Notice.
17.Inquiry and Complaints
For any queries, please follow the undermentioned link and register your concerns or reach out to us at Mahindra & Mahindra Limited, Gateway Building, St. Steven Street, Apollo Bunder, Mumbai – 400 001.
This Privacy Notice was last updated: 29th July, 2026.
To exercise your rights or submit a Data Subject Access Request, please use the following link: https://privacy-central6.securiti.ai/#/dsr/459e0a78-d7fd-4d46-b339-c80c9f28a3c6