Privacy Policy

1. ABOUT THIS POLICY

This policy explains what personal information Deltreq Technologies Private Limited, operating under the brand name "Deltreq", collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

Deltreq builds software for road transport operations. Our customers are companies that move goods and companies that carry them. Most of the information in our systems is business information about shipments, vehicles and payments. Some of it is personal information about the people who use our software and about the drivers and staff our customers employ. This policy deals with the personal information.

Please read it alongside the agreement between Deltreq and your employer or your organisation, which governs how that organisation uses our software.

2. WHO WE ARE AND HOW TO CONTACT US

Deltreq Technologies Private Limited AHS-026, Jamsed Home, 366, Barundai-2, Barundai, Barundai, Jajpur Road, Jajapur- 755025, Orissa U62013OD2026PTC054409

General privacy enquiries: [email protected] Website: https://deltreq.com

Privacy Enquiries and Requests

For questions or concerns regarding this Privacy Policy, or to request access, correction, or deletion of your personal information, you can contact us at [email protected].

Please include sufficient details in your request so that we can understand and process your enquiry appropriately.

3. WHAT THIS POLICY COVERS

This policy covers:

a. The Deltreq website at deltreq.com, including the contact form.

b. The Deltreq operator portal, used by shipper and consignor organisations to plan and dispatch freight.

c. The Deltreq carrier portal, used by transport companies to run indents, lorry receipts, trips, fleets, drivers, vendors and finance.

d. The Deltreq mobile application for Android, published as com.deltreq.app. The app has two sign-in types, described in section 4.

e. Deltreq's backend services, including the service that receives vehicle and driver location data.

The mobile app does not contain every part of the Deltreq platform. It carries a subset of the carrier portal for transporters, and a separate workspace for drivers. Planning, warehousing and the wider operator features are not in the app.

4. WHOSE INFORMATION WE HANDLE

Portal and app users. People given an account by their organisation. In the mobile app these are Transporter users, who sign in with a username and password.

Drivers. Drivers sign in to the mobile app with their mobile number and a one-time password. A driver's record is created and maintained by the transport company that employs them, not by the driver.

Employees and counterparties recorded by our customers. Our customers enter details of their own drivers, staff, clients and vendors into our software. We hold this information on their behalf.

People who contact us. Anyone who fills in the contact form on our website.

People who open a shared link. Some trip documents and a live tracking page can be opened through a link, without an account. Section 16 explains this.

5. INFORMATION WE COLLECT

You may request access to, correction of, or deletion of your personal information at any time by contacting us.5.1 Account and profile information

For a Transporter user we hold the username, name, email address, phone number, role, permissions, and the GST number and subscription details of the organisation. You can change your name, email address, phone number and username yourself in the app or the portal.

For a driver we hold the mobile number used to sign in. Everything else shown on a driver's profile comes from the record their employer maintains.

There is no public sign-up. Accounts are created by Deltreq or by an administrator at your organisation.

5.2 Information about drivers and staff entered by our customers

When a transport company sets up a driver or a staff member in our software, the record can include:

- name, mobile number and photograph - date of birth - residential address - blood group - emergency contact name, mobile number and relationship - driving licence number, class, issuing authority and expiry - Aadhaar number and PAN - bank account number, IFSC code, bank name and beneficiary name - salary amount and pay cycle, joining date and employment status

Aadhaar and PAN are shown masked unless the person viewing them has been given permission to see them in full.

The transport company decides what to enter and is responsible for having a lawful basis to do so. Deltreq processes this information on that company's instructions.

5.3 Organisation KYC

To activate an account we ask an organisation for a PAN card, a GST registration certificate, a transport licence, bank account proof and a cancelled cheque. Deltreq staff review these.

5.4 Location information

Location is collected from drivers only. It is not collected from Transporter users, from portal users or from website visitors.

How it starts. A driver turns on trip tracking themselves, in the app, under Settings, Trip tracking. The app asks Android for location permission at that point. Nothing is collected before the driver turns it on.

When it runs. The app collects location while it is running on the phone. It does not collect location when the app has been closed or removed from recent apps.

How it stops. The driver turns it off in the same place. Tracking stays on across restarts of the app until it is switched off, so a driver who has finished work should switch it off.

What is collected. Each position record contains latitude, longitude, the time of the reading, the accuracy in metres, and, where the phone reports them, speed and direction of travel. The app also records whether the phone reported the position as a simulated one. Records are queued on the phone when there is no signal and sent when signal returns.

Sent with each batch. The app's own device identifier, the battery level, whether the phone is charging, and whether the connection is mobile data or Wi-Fi. We use these to decide how often to take a reading, so that tracking does not flatten a driver's battery, and to work out whether a handset's manufacturer settings are stopping the app from reporting.

We do not collect altitude, and we do not convert positions into street addresses on the phone.

What is kept. Position data is stored against an active trip. When a driver has no live trip assigned to them, positions that reach our servers are discarded rather than stored.

Location is also recorded, as a single reading, at the moment a driver confirms arrival, moves a trip to its next stage, reports a breakdown or uploads a proof of delivery. This is optional and the action still works if no position is available.

5.5 Photographs, documents and files

Drivers photograph proof of delivery and, where required, challans. Transporter users upload documents such as PAN cards, GST certificates, licences, registration certificates, cancelled cheques, payment proofs and expense receipts. The app can take a photograph with the camera, use an existing photograph, or attach a PDF.

Photographs are resized on the phone before they are uploaded. Files are sent directly to our storage provider and the record they belong to keeps a reference to them.

5.6 Trip, shipment and operational information

Indents, lorry receipts, trips, stops, vehicles, consignments, invoices, payments and expenses, along with notes that users type, such as a breakdown description or a note on a proof of delivery.

5.7 Device and technical information

- An identifier the app generates for itself on first use. It is not taken from the phone's hardware and it is replaced if the app is reinstalled. - The phone's manufacturer, operating system version and platform. - Battery, charging state and connection type, while tracking is running. - A notification registration token issued by Google Firebase Cloud Messaging, so that we can send you trip and account alerts.

We do not read your advertising identifier, your IMEI, your contacts, your text messages, your call records, your calendar or your microphone. The app does not contain any advertising or analytics software.

5.8 Website information

The contact form collects your name, email address, phone number, company name and your message. We keep the submission and we email it to our team. We also send you an acknowledgement.

The website measures page loading speed in the visitor's browser. That measurement is not linked to you and is not stored.

We do not use advertising cookies, tracking pixels or third party analytics on our website.

6. PERMISSIONS THE MOBILE APP ASKS FOR

Location. Asked for when a driver turns on trip tracking, and used to show a driver their own position on the trip map. Transporter users are never asked. The app works without it, with tracking and the map dot unavailable.

Notifications. Asked for so that we can send trip and account alerts. The app works without it.

Camera and photos. Used when you choose to take or attach a photograph. Android handles these through the system camera and photo picker, so the app never gains standing access to your photo library.

The app declares permissions relating to background location in its Android manifest. Tracking today runs only while the app is running, as described in section 5.4. If we change this, we will update this policy, ask for the additional permission, and tell you in the app before it takes effect.

7. HOW WE USE INFORMATION

- To let you sign in and to keep your account secure. - To run the service: creating indents, issuing lorry receipts, dispatching trips, recording deliveries, raising invoices and tracking payments. - To show the parties to a shipment where a vehicle is and how a trip is progressing. - To record proof of delivery and to resolve disputes about a consignment. - To meet statutory and contractual record keeping obligations, including those under transport, tax and e-way bill rules. - To verify an organisation at onboarding through KYC. - To send operational alerts about trips, bids, documents and payments. - To keep the service reliable, including deciding how often a phone should report its position and diagnosing why a handset has stopped reporting. - To detect and prevent misuse, including positions reported from a simulated location source. - To answer support requests and enquiries. - To improve the product.

8. OUR BASIS FOR PROCESSING

We process personal information because it is necessary to provide the service our customer has contracted us for, because we are required to by law, or because you have consented.

Driver location is processed on the basis of the driver's consent, given by switching trip tracking on, together with the transport company's need to know where its consignments are. A driver can withdraw that consent at any time by switching tracking off. Doing so does not affect anything that was collected before.

Where Deltreq holds information on behalf of a customer organisation, that organisation decides why and how it is used, and we act on its instructions.

9. WHO WE SHARE INFORMATION WITH

9.1 The other parties to a shipment

The Deltreq platform exists to connect a company that ships goods with the company that carries them. Information about a trip, including the vehicle's position, the driver's name and mobile number, the trip's progress and the proof of delivery, is visible to both organisations involved in that trip.

A driver who is running work for two organisations at the same time will have their position visible to both, in relation to their own consignment.

9.2 Service providers

We use the following providers. They act on our instructions and are not permitted to use your information for their own purposes.

MSG91, operated by Walkover Web Solutions. Sends and verifies the one-time password used for driver sign-in. Receives the driver's mobile number and the code entered.

Amazon Web Services. Stores photographs, documents and files. Our primary storage region is ap-south-1, MUMBAI.

Google, through Firebase Cloud Messaging. Delivers push notifications. Receives a registration identifier for your app installation.

OpenStreetMap Foundation. Supplies the map backgrounds. When a map is shown, your device requests map tiles directly, which tells the tile server your IP address and the area of the map on your screen.

Resend. Sends the emails generated by our website contact form.

Excloud. Hosts our application servers and backend services.

Amazon Web Services (AWS EC2). Hosts application infrastructure and server workloads. Our primary region is ap-south-1, MUMBAI.

MongoDB Atlas. Hosts and stores our application database. Our primary database region is AWS ap-south-1, MUMBAI.

9.3 Legal disclosure

We may disclose information where we are required to by law, by a court, or by a government authority, or where it is necessary to establish, exercise or defend a legal claim.

9.4 Business transfers

If Deltreq is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction. We will tell you before your information becomes subject to a different privacy policy.

9.5 We do not sell personal information

We do not sell personal information, and we do not share it with advertisers or data brokers. The Deltreq mobile app contains no advertising software.

10. WHERE INFORMATION IS STORED

Information is stored in our databases, application servers and cloud object storage operated by the providers named in section 9.2.

Our primary application and database storage regions are located in India, including AWS ap-south-1 (Mumbai). MongoDB Atlas uses AWS ap-south-1 (Mumbai) as our primary database region.

Some service providers may process limited information outside India as part of providing their services, including authentication, messaging, push notifications, mapping, email delivery, security, or infrastructure services. Where applicable, such processing is subject to the provider's applicable privacy terms, contractual safeguards, and other measures required by applicable law.

The specific data handled by each provider is described in section 9.2.

11. HOW LONG WE KEEP INFORMATION

We keep information for as long as it is needed for the purpose for which it was collected and for as long as required by applicable law.

The specific retention periods we apply are:

Detailed position history on our tracking service: 30 days. Vehicle position trails associated with a trip: 90 days. Trip records held by the tracking service: 24 months. Raw data received from a tracking hardware provider: 7 days. In-app notifications: 30 days. Notification registration identifiers: removed after 12 months of inactivity. One-time passwords: 10 minutes. GST verification results: 90 days. Vehicle verification results: 60 days. Audit records of changes made in the system: 7 years.

Account records, driver and staff records, trip and consignment records, invoices, proofs of delivery, and uploaded documents are retained for as long as the relevant customer account remains active and, after closure, for as long as necessary to comply with applicable tax, transport, accounting, company, contractual, dispute-resolution, and other legal obligations.

Where no specific retention period is stated above, we retain information only for as long as reasonably necessary for the applicable purpose or as required by law. When information is no longer required, we securely delete it, anonymise it, or otherwise dispose of it in accordance with our data-retention practices.

A position record temporarily queued on a driver's phone because there was no network connection is deleted from the phone after it has been successfully received and processed by our servers.

12. SECURITY

Measures we apply:

- All traffic between the app, the portals and our servers uses HTTPS. - Sign-in tokens on an Android device are held in the operating system's encrypted keystore rather than in ordinary app storage. - App data is excluded from Android device backups. - One-time passwords are stored only as a cryptographic hash, expire in ten minutes, are limited to three attempts and are rate limited. - Access is controlled by role and by organisation. A user from one organisation cannot see another organisation's records. - Aadhaar and PAN are masked unless the viewer has been given permission to see them in full. - Uploaded files are written to a location chosen by our servers, not by the device, and are read back through short-lived links. - A driver's tracking session is tied to one handset. Starting tracking on a new phone ends it on the old one. - We keep audit records of changes made in the system.

No method of transmitting or storing information is completely secure. We cannot guarantee absolute security, and we ask you to keep your sign-in details to yourself and to tell us promptly if you think an account has been misused.

We make no claim to hold any security certification.

13. YOUR RIGHTS

Subject to the law that applies to you, you can ask us to:

- confirm what personal information we hold about you and give you a copy - correct information that is wrong or incomplete - delete information, where we are not required to keep it - stop or limit a particular use - withdraw a consent you have given

To make a request, write to [email protected] , We may ask you to confirm your identity before we act. We aim to respond within 7 working days.

If your information was entered into our software by a company you work for or work with, that company controls it. We will pass your request to them and help them answer it.

You can nominate another person to exercise these rights for you if you are unable to do so yourself.

If you are not satisfied with our response, you may complain to the relevant data protection authority.

14. ACCOUNT AND DATA DELETION

Deltreq accounts are issued by an organisation and are not created directly by individual users. There is therefore no self-service sign-up or self-service account closure.

To request account closure or deletion of personal information, contact us at [email protected]. Please include the account name, registered mobile number, or other information that allows us to identify the relevant account, and clearly describe the information you want deleted.

We will review the request and confirm which information can be deleted and which information we are required or permitted to retain.

What we may delete on request includes profile information, contact details, uploaded photographs and documents that are not required to be retained as statutory or business records, and stored location history that is no longer subject to a retention requirement.

We may retain information where required by applicable tax, transport, accounting, company, contractual, or other legal obligations, where it is necessary to establish, exercise, or defend a legal claim or resolve a dispute, or where it is required for legitimate audit and security purposes. Where information must be retained, we limit it to what is reasonably necessary and restrict access to authorised personnel.

A driver can stop location collection by switching off trip tracking in the app. Stopping location collection does not delete previously collected information that is subject to applicable retention requirements.

Signing out of the app removes the active sign-in session from that device. It does not delete the account or records stored on our servers.

Account and data deletion requests can be submitted without installing or using the Deltreq mobile application.

15. CHILDREN

Deltreq software is for business use. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

16. SHARED LINKS

Some information can be opened through a link, without signing in:

- a trip slip, which shows the details of a consignment - a live tracking page, which shows where a vehicle is on a trip - a single-trip driver page, which lets a driver update a trip and upload a proof of delivery without an account

These links are long, unguessable, tied to one trip and time limited, and they can be revoked. Anyone who is sent one can open it while it is valid, so please share them only with people who need them.

17. CHANGES TO THIS POLICY

We may update this policy. The date at the top shows when it was last changed. If a change materially affects how we use your information, we will give notice in the app or the portal, or by email, before it takes effect.

ANNEX A. SUMMARY FOR THE GOOGLE PLAY LISTING

This annex summarises what the Deltreq app (com.deltreq.app) collects. It is consistent with the Data Safety declaration on our Google Play listing.

Collected and linked to you:

Location: approximate and precise location, from drivers only, after the driver switches trip tracking on. Used to run the service. Optional.

Personal information: name, email address, phone number, address and user identifiers. Used to run the service and manage the account.

Personal information, other: driving licence, Aadhaar, PAN, GST number, date of birth, blood group and emergency contact, where an employer records them for a driver or a staff member.

Financial information: bank account details and salary, where an employer records them for a driver or a staff member.

Photographs and files: proof of delivery photographs, document photographs and attached PDFs.

User content: notes typed into trip and expense records.

Device information: an app generated device identifier, a push notification registration identifier, the phone's manufacturer and operating system version, and, while tracking is on, battery and connection information.

Shared with third parties:

Phone number, to MSG91, for sending and checking the sign-in code. Push notification registration identifier, to Google, for delivering alerts.

Not collected:

Contacts, text messages, call logs, calendar entries, audio, video, health and fitness activity, browsing history, advertising identifiers, app usage analytics and crash reports.

Data handling:

Information is encrypted in transit. You can request that your data be deleted. See section 14.