Privacy Policy

1. Who we are

InfoTrack Telematics Pvt Ltd ("InfoTrack", "we", "our", "us") is a company incorporated under the Companies Act, 2013, with its registered office at Savithru, 39/1, 2nd Floor, 1st Cross, Malleshwaram, Bangalore 560 003, Karnataka, India. InfoTrack is a group company of FIG Inc., listed on the Tokyo Stock Exchange Prime Market.

We provide fleet management, GPS telematics, AI video telematics (MDVR) and related SaaS services to enterprise clients across India. This Privacy Policy explains how we collect, use, store, share and protect personal data in connection with our website (infotracktelematics.com) and our platform services.

2. Data we collect

2.1 Data you provide directly

• Contact & enquiry data: name, email, phone number, company name, fleet size, industry, collected when you submit a demo request, contact form or enquiry.
• Account data: login credentials, billing information and company details when you create a platform account.
• Job application data: CV/resume, work history, contact details and cover note when you apply for a role.

2.2 Data collected automatically

• Usage data: pages visited, features accessed, session duration, click events and error logs, collected via our analytics tools.
• Technical data: IP address, browser type, device type and operating system.
• Cookies: see Section 9 for full details.

2.3 Data from our platform services (B2B)

When our enterprise clients use the InfoTrack platform, we may process data about their drivers and fleet operators (such as GPS location, driving behaviour events and video recordings) on behalf of the client (as a data processor under the client's instructions). The client remains the data controller for driver data. Our Data Processing Agreement (DPA) governs this relationship.

3. How we use your data

• To respond to demo requests and enquiries from prospective clients.
• To provide, operate and improve our fleet intelligence platform.
• To send you product updates, feature announcements and service communications (where you have opted in or where we have a legitimate interest).
• To process job applications and conduct recruitment.
• To comply with legal obligations under Indian law, including the Digital Personal Data Protection Act, 2023 (DPDPA).
• To prevent fraud, security threats and platform abuse.
• To conduct analytics and improve our website and services.

4. Legal basis for processing

We process personal data under the following bases:

• Consent: where you have explicitly opted in to marketing communications or data collection.
• Contract: where processing is necessary to perform a contract with you or a client organisation.
• Legitimate interests: where we have a genuine business interest (e.g., fraud prevention, improving our services) that does not override your rights.
• Legal obligation: where Indian law or other applicable regulations require us to process data (e.g., tax records, AIS-140 government reporting).

5. Data sharing & disclosure

We do not sell your personal data to third parties. We share data only in the following circumstances:

• Service providers: trusted sub-processors (cloud hosting, email delivery, analytics) who process data solely on our behalf under written data processing agreements.
• Group companies: FIG Inc. group entities for internal business operations, subject to equivalent data protection standards.
• Legal requirements: when required by Indian courts, regulatory authorities (including MoRTH or CERT-In) or as required by law.
• Business transfers: in the event of a merger, acquisition or asset sale, subject to appropriate confidentiality obligations.

6. Data storage & residency

All customer and fleet data is stored within India, in AWS data centres located in the Mumbai (ap-south-1) and Hyderabad (ap-south-2) regions. InfoTrack does not transfer Indian customer data outside India without appropriate safeguards as required by the DPDPA 2023.

Certain administrative data (such as support tickets) may be processed by our service providers operating in the EU or US, subject to Standard Contractual Clauses or equivalent data transfer mechanisms.

7. Data retention

• Platform / fleet data: retained for the duration of the client contract plus 12 months, then securely deleted unless required by law.
• MDVR video footage: retained for 30 days by default (configurable by client up to 90 days), then automatically purged.
• Enquiry / lead data: retained for 24 months from last contact, then deleted or anonymised.
• Job application data: retained for 12 months after the recruitment process ends.
• Financial records: retained for 7 years as required by the Companies Act, 2013 and GST regulations.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the GDPR, you have the following rights:

• Right to access: request a copy of personal data we hold about you.
• Right to correction: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data (subject to legal retention obligations).
• Right to grievance redressal: raise a complaint with our Grievance Officer (see Section 13) or with the Data Protection Board of India.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting lawfulness of prior processing.
• Right to nominate: nominate another individual to exercise rights on your behalf in the event of death or incapacity (DPDPA, S.14).

To exercise any right, contact our Grievance Officer at info@infotracktelematics.com. We will respond within 30 days.

9. Cookies & tracking

Our website uses cookies and similar technologies to:

• Essential cookies: enable core site functionality (session management, navigation). Cannot be disabled.
• Analytics cookies: collect anonymised usage statistics (Google Analytics, with IP anonymisation enabled).
• Marketing cookies: used only with your explicit consent for retargeting ads.

You can manage cookie preferences via the cookie banner shown on your first visit, or by adjusting your browser settings. Disabling non-essential cookies does not affect site functionality.

10. Security

InfoTrack is ISO 27001 certified and SOC 2 Type II audited. We implement technical and organisational measures including:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit.
• Role-based access controls and multi-factor authentication for all staff accessing customer data.
• Annual penetration testing by accredited third-party security firms.
• 24/7 security monitoring via SIEM and anomaly detection.
• Formal incident response plan with 72-hour breach notification per DPDPA and CERT-In requirements.

11. Children's privacy

Our website and platform services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact our Grievance Officer immediately and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (where we hold your email address) and update the "Last updated" date at the top of this page. Continued use of our services after the effective date constitutes acceptance of the revised policy.

13. Contact & Grievance Officer

For any privacy-related questions, requests or complaints, contact our designated Grievance Officer as required under the DPDPA 2023: