Privacy Policy

1. Introduction

iFleetify Technologies LLP ("we", "us", "our", or "Company"), a Limited Liability Partnership registered in Ahmedabad, Gujarat, India (LLPIN: ACD-6633), respects your privacy and complies with:

• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Digital Personal Data Protection Act, 2023 (DPDP) and the Digital Personal Data Protection Rules, 2025
• Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and applicable UIDAI regulations, to the extent relevant to Aadhaar numbers handled in HRMS

This policy applies to all users of iLogitix (the "Service") — including logistics / TMS, GST e-invoice & e-way bill modules, HRMS, and related features — and to tenants, administrators, employees using the platform, and other end users.

By using the Service, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, you must not use the Service.

2. Data We Collect

2.1 Personal Data

• Name, email address, phone number
• Login credentials (username, password)
• Role & permissions within the platform
• Profile information and preferences

2.2 Logistics & Business Data

Where you use logistics / TMS features, we process:

• Booking & LR Data: LR (Lorry Receipt) numbers, booking details, consignor/consignee information
• Transaction Data: Invoice amounts, payment records, GST details, billing accounts
• Logistics Data: Origin/destination addresses, pincodes, vehicle numbers, driver information
• Delivery Data: Delivery status, POD (Proof of Delivery), OTP verification records, delivery location
• Customer Data: Customer billing accounts, credit limits, customer contact information

2.3 E-Way Bill & GST Compliance Data (where enabled)

• GSTIN, transporter / vehicle details, consignment and invoice particulars used for e-way bills
• E-way bill numbers, status, distance, validity / expiry, extension history, consolidated e-way bill records
• GSP / portal credentials and authentication tokens you configure (stored securely; used only to provide the feature)
• Operational reports and notifications related to missing / expiring e-way bills

2.4 HRMS / Workforce Data (where enabled)

Where you use HRMS modules, we process employee and workforce data that you (Tenant) enter or that employees submit through self-service, which may include:

• Identity & contact: name, employee code, photo, date of birth, gender, marital status, addresses, personal/work email, phone, emergency contacts
• Employment: department, designation, branch/work location, joining/exit dates, reporting manager, employment category, shifts, week-offs
• Identifiers & statutory (where provided): PAN, UAN, ESI number, PF account number, passport details, tax regime, and Aadhaar in masked form only (see Section 5A.5)
• Bank & compensation: bank account number, IFSC, bank name, account holder name, wage type, salary structure / daily wage
• Attendance & leave: check-in/out times, attendance status, GPS location captured only at check-in / check-out where self-attendance is enabled, regularization requests, leave balances and leave requests
• Payroll & tax: payroll period data, payslips, deductions/earnings as configured by you, and tax declarations (Form 12BB)
• Documents & profile extras: employee photo, documents uploaded by the employer (e.g. ID proofs, licences, certificates, including expiry dates), education, experience, skills
• Records: change history / audit logs, exit and full-and-final settlement records

Sensitive / high-risk identifiers: PAN, bank account numbers, passport numbers, and similar identifiers are processed only because you choose to store them for employment / payroll purposes. The full Aadhaar number is not stored. You must collect and use these identifiers lawfully (including Aadhaar restrictions under Indian law). We process them as your Data Processor and do not use them for our own marketing. See Section 5A for details on employee data.

2.5 Technical Data

• IP address and location data
• Browser & device information
• Logs & API activity
• Usage patterns & analytics
• Cookies and tracking technologies

2.6 Payment & Billing Data (platform subscription)

• Subscription / service invoice details (invoice number, amounts, due dates, status)
• Online payment metadata from Razorpay (order id, payment id, status, charged amount, platform fee, timestamps)
• Offline / manual payment records (amount, method, reference, date/time)

We do not store raw card numbers, CVV, full track data, or UPI PINs. Sensitive payment credentials are handled by Razorpay on Hosted Checkout. We store only limited metadata needed for reconciliation, support, accounting, and dispute resolution.

3. Purpose of Processing

We process your data for the following purposes:

3.1 Logistics / TMS Service Delivery

• Managing booking and LR lifecycle
• Tracking deliveries and generating POD
• OTP verification for secure deliveries
• Route / dispatch related workflows
• Invoice generation with GST-aware calculations
• Payment tracking and reconciliation within your logistics operations

3.2 E-Way Bill & GST Compliance Features

• Generating, syncing, extending, consolidating, and reporting e-way bills via GSP / portal integrations you enable
• Authenticating to government-connected systems using credentials you provide
• Sending operational alerts (e.g. missing / expiring e-way bills) as configured

3.3 HRMS / Workforce Administration

• Maintaining employee masters and employment records you enter
• Recording attendance, leave, and regularization workflows
• Supporting geo-fenced self-attendance where you enable it
• Running payroll periods and generating payslips for your workforce
• Supporting statutory compliance workflows (PF, ESI, Professional Tax, LWF, TDS) and salary payout files
• Recording exit and full-and-final settlement
• Sending HRMS-related notifications (e.g. leave / action emails) as configured

3.4 Account Management

• User authentication and authorization
• Role-based access control (including HRMS self-service linkage to users)
• Account administration and support
• Communication regarding service updates

3.5 Financial Operations (platform subscription)

• Raising and sending service invoices for subscription / platform charges
• Processing online payments via Razorpay and recording manual / offline payments
• Payment reconciliation, duplicate-credit prevention, failed-payment and refund handling where applicable
• Maintaining records for accounting, audits, tax (when applicable), and dispute resolution
• Tenant billing account / credit features within the logistics product (separate from platform subscription)

3.6 Compliance & Security

• Supporting GST / e-invoice / e-way bill workflows you configure (you remain responsible for filings)
• Audit trails for logistics, e-way, and HRMS transactions
• Security monitoring and fraud prevention
• Regulatory reporting (if required of us as processor / platform operator)
• Legal compliance with applicable laws

3.7 Service Improvement

• Aggregated or de-identified usage statistics (for example feature usage, performance, and error rates)
• Platform optimization and enhancements
• Customer support and troubleshooting

Service improvement uses only technical / usage data and aggregated or de-identified information. We do not use the personal data in your Tenant (customers, consignees, drivers, employees) for our own purposes, marketing, or profiling.

4. Data Fiduciary & Processor Roles

Where we are the Data Fiduciary: For our own business data — tenant administrator and user account details, subscription billing and payment records, support tickets, website visitors, demo / contact-form enquiries, and our marketing communications — iFleetify Technologies LLP decides the purpose and means of processing and acts as the Data Fiduciary. You may exercise your rights for this data directly with us (Section 9).

You confirm that you have a lawful basis (including consent, employment relationship, contract, or legal obligation as applicable) for all data principals (your customers, employees, vendors, drivers) whose data is processed through the Service, in accordance with applicable data protection laws including the DPDP Act, 2023.

As Data Processor, we process data solely for the purposes specified in this Privacy Policy and on your documented instructions (as Data Fiduciary), as given through these terms, your configuration of the Service, and any signed agreement.

5. Customer & Third-Party Data (Data Fiduciary Responsibilities)

As Tenant, you collect and process data about your customers (consignors, consignees, drivers, etc.) and — where HRMS is enabled — your employees and related contacts. Important responsibilities:

5.1 Your Responsibilities as Data Fiduciary

• Establish a lawful basis before collecting/processing personal data (customers, employees, drivers, etc.)
• Inform data principals about processing purposes (including attendance geo-location and payroll identifiers where used)
• Handle data principal requests (access, correction, deletion, etc.)
• Comply with DPDP Act and employment / labour notice requirements for workforce data
• Respond to privacy complaints from customers and employees
• Ensure data accuracy and completeness (including e-way bill and payroll inputs)
• Implement appropriate security measures and limit internal access to sensitive HR / bank / ID data
• Use Aadhaar and other regulated identifiers only as permitted under Indian law

5.2 Our Role as Data Processor

• Process data only as instructed by you (Data Fiduciary)
• Assist with data subject requests (subject to fees for complex requests)
• Maintain reasonable security measures
• Notify you of data breaches affecting your data
• Comply with data processing agreements

5A. Employee Personal Data in HRMS (DPDP Act & Aadhaar)

This section describes how employee personal data processed through the HRMS modules is handled, with reference to the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Aadhaar Act, 2016 and UIDAI regulations. If you are an employee of a company that uses iLogitix, your employer decides what data is collected and why; please read this section together with your employer's own privacy notice.

5A.1 Roles

• Your employer (our customer / Tenant) is the Data Fiduciary for employee personal data in HRMS.
• iFleetify Technologies LLP acts as Data Processor on the employer's behalf and processes employee data only on the employer's documented instructions. We do not use employee data for our own purposes, marketing, or profiling, and we do not sell it.

5A.2 Categories of Employee Data

• Identity and contact details, and employee photo
• Employment details (department, designation, branch, joining / exit dates, reporting manager)
• Attendance records, including GPS location at check-in / check-out where enabled (see Section 5A.4)
• Leave records
• Payroll and salary structure
• Statutory identifiers: PAN, UAN, ESI number, PF account number
• Bank account details for salary payout
• Tax declarations (Form 12BB)
• Documents uploaded by the employer (e.g. ID proofs, licences, certificates with expiry dates)
• Change history / audit logs
• Exit and full-and-final settlement records

5A.3 Purposes & Legal Basis

Employee data is processed for:

• Employment administration
• Attendance and leave management
• Payroll and statutory compliance (PF, ESI, Professional Tax, LWF, TDS)
• Salary payout
• Exit and full-and-final settlement

The legal basis is determined by the employer as Data Fiduciary. Typically it is processing for employment purposes as a legitimate use under section 7 of the DPDP Act, consent obtained by the employer where required, and/or compliance with legal obligations (for example labour, tax, and social security laws).

5A.4 Attendance Location

• GPS location is captured only at check-in and check-out, and only when the employer enables self attendance.
• It is used to check the punch against the geofence configured by the employer.
• The handheld app checks for mock / spoofed locations at the time of the punch.
• The Service does not perform continuous location tracking of employees.

5A.5 Aadhaar

• The full 12-digit Aadhaar number is not stored.
• Only a masked form (last 4 digits) and a one-way keyed hash are retained. The hash is used only to detect duplicate employee records.
• Employers must collect, use, and store Aadhaar only as permitted under the Aadhaar Act, 2016 and UIDAI regulations, and must not upload Aadhaar numbers or documents beyond what is permitted.

5A.6 Security Safeguards for Employee Data

• PAN, bank account number, and passport number are encrypted at rest using field-level encryption
• Employee photos and documents are kept in private storage and served only through short-lived signed links
• Role-based access with branch scoping, as configured by the employer
• Sensitive fields are masked for users without HR / Admin rights
• A change history (audit log) records who changed salary, bank, statutory, and employment status fields

5A.7 Retention

Employee data is retained for as long as the employer keeps its iLogitix account and as required by applicable labour, tax, and statutory record-keeping laws. After that it is deleted or anonymised. Backups are purged on their normal rotation cycle. See also Section 8.

5A.8 Employee Rights

Under the DPDP Act, employees as data principals have the right to:

• Obtain a summary of their personal data and the processing carried out (access)
• Correction and completion of inaccurate or incomplete data
• Erasure, subject to retention required by law or for the employment relationship
• Grievance redressal
• Nominate another individual to exercise their rights in the event of death or incapacity

Employees should exercise these rights primarily through their employer, as the Data Fiduciary. We will assist the employer in responding. If an employee contacts us directly at info@ilogitix.com or info@ifleetify.com, we will refer the request to the relevant employer and support it as Data Processor.

5A.9 Personal Data Breach

If we become aware of a personal data breach affecting employee data, we will notify the affected employer without undue delay so that it can meet its obligations to notify the Data Protection Board of India and affected data principals under the DPDP Act and DPDP Rules, 2025. We will cooperate and share the information reasonably available to us. See also Section 6.

5A.10 Sub-processors

To run the Service, employee data is processed by our cloud hosting and storage providers (data centres located in India) and by email delivery providers for HRMS notifications, as described in Section 7.

6. Data Security & Breach Response

We implement reasonable technical and organizational safeguards to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Storage-level encryption provided by our cloud providers, plus field-level encryption for sensitive identifiers (Section 5A.6)
• Per-tenant database schema isolation and role-based access controls
• Password hashing, login rate limiting, and session timeouts
• Hosting in professionally managed cloud data centres with physical security controls maintained by the provider
• Regular backups and recovery procedures
• Network security and firewall protection
• Restricted, need-to-know access to production systems for our personnel
• Additional safeguards for HRMS employee data, described in Section 5A.6

We review and improve these safeguards over time. The specific measures may change, provided the overall level of protection is not materially reduced.

6.1 Breach Notification Timeline

• Affected tenants notified without undue delay, and within 72 hours of discovery
• You (as Data Fiduciary) notify the Data Protection Board of India and affected data principals (your customers, employees, etc.) as required under the DPDP Act and DPDP Rules, 2025
• We will cooperate and provide the breach details reasonably available to us to assist your notifications

7. Data Sharing

We do NOT sell your data to third parties.

Data may be shared with the following categories of service providers:

7.1 Communication Services

• SMS Providers: Twilio, MSG91, TextLocal, AWS SNS
• WhatsApp Services: Twilio WhatsApp, WhatsApp Business API, Gupshup
• Email delivery providers: For transactional emails (invoices, OTPs, HRMS / e-way notices)
• Purpose: Delivery notifications, OTP delivery, customer communications, and HRMS / e-way operational notices as configured by you
• Data Shared: Recipient phone numbers / emails, message content

7.2 Financial & Compliance Services

• Payment Gateway – Razorpay: To create payment orders, process Hosted Checkout, confirm payment status via APIs/webhooks, and process refunds where applicable
• Data Shared with Razorpay: Transaction amounts, currency, invoice/order references, and business contact details needed for checkout — not raw card/UPI secrets on our side
• E-Invoice / E-Way Bill / GSP & government systems: Where enabled by you, invoice / consignment / vehicle / GSTIN data and credentials you configure are transmitted to GSP and/or GST portal systems to perform e-invoice / e-way bill operations. Those systems process data under their rules; we do not control government portals.

7.3 Cloud Infrastructure

• Hosting: Reputable third-party cloud infrastructure providers, with the application, databases, and backups hosted in data centres located in India
• Purpose: Secure hosting, storage, backup, and infrastructure
• Data Shared: Platform data necessary to operate the Service (subject to cloud provider terms and safeguards)

7.4 Legal & Regulatory

• Legal Authorities: When required by law, court orders, or government requests
• Regulatory Bodies: For compliance with applicable regulations

7.5 Business Transfers

• In case of merger, acquisition, or sale of assets
• Data transfer subject to successor entity's privacy policy (with opt-out rights where applicable)

We select service providers whose contractual terms require them to keep data confidential, use it only to provide their services to us, and maintain appropriate security measures.

Sub-processor details and changes: Tenants may request the current list of sub-processors (name, purpose, and processing location) by writing to us. We will give reasonable prior notice of a new sub-processor that processes Tenant personal data; if you have a reasonable data-protection objection, you may raise it with us and, if we cannot address it, terminate the affected Service.

8. Data Retention & Deletion

8.1 Active Accounts

• All transaction data retained while account is active
• Historical LR/booking data: Indefinitely (or as per your subscription plan)
• E-way bill operational records: while active (or as required for your GST / audit needs)
• HRMS employee, attendance, leave, and payroll / payslip data: while active (you should export before offboarding employees or terminating the Tenant)
• Subscription invoices and payment records (including Razorpay metadata): retained while active and thereafter as needed for accounting, disputes, and applicable Indian record-keeping rules (commonly up to 8 years for books of account where relevant)
• User accounts: Retained while active

8.2 Terminated Accounts

• Booking/LR data: 90 days post-termination
• E-way bill records: 90 days post-termination (subject to longer retention if needed for legal hold)
• HRMS workforce data (employees, attendance, leave, payslips, documents): typically 30–90 days post-termination for operational deletion, after which data is deleted or anonymised in active systems, except where retention is required by applicable labour, tax, or statutory record-keeping laws or a legal hold; backups are purged on their normal cycle
• Invoice / payment / financial records: retained as required for accounting, disputes, and Indian tax / commercial record-keeping (even where GST is not currently charged on platform subscription invoices)
• User accounts: 30 days
• Audit logs: 90-365 days depending on log type
• Backups: Not restored for any purpose other than disaster recovery, and overwritten or deleted on their normal rotation cycle

8.3 Compliance Retention

• Financial and invoice records: As per applicable Indian laws and our accounting practice
• Where GST applies to any charges in future: retention as required under GST / tax laws
• You (Tenant) remain responsible for retaining payroll, wage, PF/ESI, and GST / e-way records for periods required by Indian labour and tax law — export from the Service as needed
• Audit trails: 90-365 days depending on log type
• Security logs: 90-180 days

You are responsible for exporting your data before account termination. We are not obligated to retain data beyond the retention periods stated herein. After retention period expires, data will be permanently deleted and cannot be recovered.

9. Your Rights (DPDP Act, 2023)

As a data principal, you have the following rights:

9.1 Right to Access

Request a summary of your personal data that we process and of the processing activities. Where we provide a copy, we will use a structured, commonly used format.

9.2 Right to Correction

Request correction of inaccurate or incomplete personal data. You can update most data through the Service interface.

9.3 Right to Deletion

Request deletion of personal data, subject to legal and legitimate retention requirements (for example invoice and payment records retained for accounting, disputes, and applicable Indian laws). Deletion may affect service availability.

9.4 Right to Withdrawal of Consent

Withdraw consent for data processing. Withdrawal may affect service availability as certain data processing is necessary for service delivery.

9.5 Right to Grievance Redressal

File complaints with our Grievance Officer (Ravi Patel, Designated Partner) using the contact details in Section 16, or with the Data Protection Board (DPB) if you believe your data rights have been violated.

9.6 Right to Nominate

Nominate another individual to exercise your rights in the event of your death or incapacity.

9.7 Exercising Your Rights

To exercise these rights, contact us at info@ilogitix.com or info@ifleetify.com. We aim to respond within 30 days, and in any case within the period required under the DPDP Act and DPDP Rules, 2025.

Note: For data that you (Tenant) collect about your customers or employees, you (as Data Fiduciary) are responsible for handling their data principal requests. We will assist you as Data Processor. Employees of our customers should contact their employer first (see Section 5A.8).

10. Third-Party Integrations

The Service may integrate with third-party services for enhanced functionality:

• Razorpay – online subscription invoice payments (Hosted Checkout)
• SMS/WhatsApp providers for notifications
• E-Invoice / E-Way Bill / GSP services and GST government portals where enabled
• Mapping / Places services for logistics location features and HRMS geo-fence attendance (where enabled)
• Email delivery providers for transactional emails (invoices, payment confirmations, OTPs, HRMS / e-way notices)

We are not responsible for third-party privacy practices. Your use of integrated third-party services is subject to their privacy policies. Please review third-party privacy policies before using integrated services.

Third-party services may collect and process data independently. We recommend reviewing their privacy policies.

11. Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Maintain session state & authentication (tenant application)
• Remember preferences & settings
• Ensure security and prevent fraud (e.g. Google reCAPTCHA on registration and contact forms)
• Optional analytics on our public marketing site (ilogitix.com) — only if you choose "Accept analytics" in the cookie banner. We may use Google Analytics (via Google Tag Manager) to understand which pages help visitors find iLogitix. We do not use advertising pixels or retargeting cookies.

Essential cookies are required for forms and login. Analytics cookies are opt-in on the marketing site. You can change your choice anytime by clearing site data for ilogitix.com in your browser, or through your browser's cookie settings. Disabling essential cookies may affect form submission or require more frequent logins in the tenant app.

We do not sell personal data. We do not use third-party advertising or cross-site retargeting cookies on ilogitix.com.

12. Data Location & Transfers

The Service application, databases, and backups are hosted with third-party cloud infrastructure providers in data centres located in India. We do not move this core platform data outside India.

• Payment card / UPI credential processing occurs with Razorpay under Razorpay's systems and compliance obligations (we do not store raw card/UPI credentials).
• Certain optional subprocessors (for example SMS/WhatsApp providers, email delivery providers, e-invoice / e-way bill GSPs, maps/places providers) may process limited data to deliver those features. Some of those providers may process data outside India as needed for that feature.
• Where cross-border processing occurs for such subprocessors, we rely on contractual and reasonable security safeguards and applicable law.

By using features that depend on third-party communications or government-connected tax services, you acknowledge that limited related data may be processed by those providers as described in this Policy and their own policies.

13. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

14. Data Processing by Module

Depending on which modules you enable, the Service processes data for logistics, GST compliance, and workforce operations:

14.1 Shipping & Delivery Data

• Consignor and consignee information (names, addresses, contact details)
• Origin and destination locations
• Shipment contents and values
• Delivery status and tracking information
• POD (Proof of Delivery) and delivery confirmations

14.2 Vehicle & Driver Data

• Vehicle registration numbers
• Driver names and contact information
• Vehicle tracking data (if GPS enabled)

14.3 E-Way Bill & GST Compliance Data

• GSTIN, invoice / consignment particulars, transporter and vehicle details used for e-way bills
• E-way bill numbers, validity, extensions, consolidated e-way bills, and sync status from GSP / portals
• Credentials you store for GSP / portal authentication

Government / GSP systems may retain copies of filings under their own rules. Accuracy and lawful use of e-way bill data remain your responsibility.

14.4 HRMS / Workforce Data

• Employee identity, employment, statutory, and bank details you maintain (Aadhaar in masked form only)
• Attendance punches and, where enabled, GPS location at check-in / check-out used for geo-fence validation
• Leave and regularization workflows
• Payroll period outputs, payslips, and tax declarations
• Employee documents and profile attachments
• Exit and full-and-final settlement records

We are not the employer. You must inform employees about monitoring (e.g. geo-fenced attendance) and process workforce data only for legitimate employment / payroll purposes. See Section 5A for full details.

14.5 Financial & Billing Data

• Tenant logistics invoice amounts and customer payment records within your operations
• Platform subscription service invoices and payment history (online via Razorpay or manual)
• GST details and tax calculations where applicable to your logistics documents / features
• Credit limits and billing accounts within the logistics product

You (Tenant) are responsible for establishing a lawful basis with consignors, consignees, drivers, employees, and other parties whose data is processed through the Service.

15. Updates to Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service features. Material changes will be notified via:

• Email to registered email address
• In-service notifications
• Updated policy posted on website with updated "Last Updated" date

Continued use of the Service after changes constitutes acceptance of the updated policy. If you disagree with changes, you must stop using the Service and terminate your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we process your data.

16. Contact Information & Grievance Officer

For privacy-related inquiries, complaints, billing/payment data questions, or to exercise your rights, contact: