Privacy Notice

1. Who we are

ITOS Labs Private Limited (CIN: U62013DC2026PTC473882) builds and operates ITOS—India's Transport Operating System. For website enquiries and our own business administration, ITOS Labs determines why and how relevant personal data is processed.

Privacy questions, rights requests and grievances may be sent to our authorised privacy contact at connect@itoslabs.com.

2. Scope and our role

This notice applies to itoslabs.com, communications with ITOS Labs and personal data we use for sales, demonstrations, security, administration and relationship management.

When an organisation uses ITOS to process its operational data, that organisation ordinarily determines the purpose and means of processing. In that context, ITOS Labs generally acts as its service provider or Data Processor, and the customer's privacy notice, customer agreement and data-processing terms govern that data. If ITOS Labs independently determines a purpose, this notice applies to that separate processing.

3. Personal data we may collect

• Identity and business contact data: name, work email, telephone number, job title, organisation and business address.
• Enquiry and evaluation data: company, branch, fleet and workflow information; product requirements; demo notes; and the content of communications.
• Technical and usage data: IP address, device and browser information, timestamps, requested pages, referring page, approximate location derived from network data, security events and similar logs made available by our hosting or security providers.
• Relationship and transaction data: meeting history, authorised contacts, proposals, contracts, invoices, payment status and support correspondence where a business relationship develops.
• Information you choose to provide: attachments, feedback or other material sent to us. Please do not send unnecessary personal, financial, identity or other sensitive information through ordinary email.

4. Where the data comes from

We may receive personal data directly from you; from your employer, customer or another authorised business contact; automatically from your browser or device; from service providers supporting our website and communications; or from lawful public and business sources.

5. Why we process personal data

• To respond to enquiries, arrange demonstrations and assess whether ITOS fits an organisation's operations.
• To prepare proposals, negotiate and perform agreements, onboard authorised contacts, provide support and manage the business relationship.
• To operate, secure, troubleshoot and improve our website, communications and services.
• To prevent misuse, protect ITOS Labs, customers and users, and establish, exercise or defend legal claims.
• To meet accounting, tax, corporate, regulatory and other legal obligations.
• To send relevant business communications where permitted. You may ask us to stop non-essential marketing at any time.

Depending on the context and the law in force, processing may be based on your consent, your voluntary provision of data for a requested purpose, steps toward or performance of a contract, compliance with law, or another use permitted by applicable law. Where consent is relied on, it may be withdrawn without affecting processing already carried out lawfully.

6. Cookies and similar technologies

Our hosting platform may use cookies or similar technologies that are necessary for security, session handling, load management and reliable delivery of the website. ITOS Labs does not currently intend to use this public website for third-party behavioural advertising or to sell personal data.

If we introduce optional analytics, advertising or other non-essential technologies, we will update this notice and provide any notice or choice required by applicable law.

7. When we share personal data

We may share the minimum necessary data with:

• hosting, infrastructure, email, communications, security, analytics and support providers acting under appropriate contractual or confidentiality obligations;
• professional advisers, auditors, insurers, banks and payment or accounting providers where relevant;
• an acquirer, investor or successor in connection with a bona fide financing, restructuring, merger or transfer, subject to appropriate protections; and
• courts, regulators, law-enforcement bodies or other persons where disclosure is required by law or reasonably necessary to protect lawful rights and security.

We do not sell or rent personal data. We do not authorise service providers to use it for their own unrelated marketing.

8. Processing and transfers outside India

Some service providers may process data in India or other permitted locations. Where personal data is transferred outside India, we will apply contractual, technical and organisational protections appropriate to the service and comply with transfer restrictions or requirements that apply under Indian law or an applicable customer agreement.

9. Retention

We retain personal data only while it is reasonably required for the purpose for which it was collected, an active or prospective business relationship, security and audit needs, enforcement of agreements, dispute management, or a legal record-keeping obligation. Different records have different retention periods.

When retention is no longer justified, we will delete, anonymise or securely isolate the data, subject to practical backup cycles and lawful holds. Customer-controlled data is retained, returned or deleted in accordance with the applicable customer agreement and data-processing terms.

10. Security and incident response

We use reasonable technical and organisational safeguards designed for the nature of the data and the risks involved. These may include access control, role and branch restrictions, logging, contractual controls for service providers, secure development practices, backups and incident-response procedures. No online service can guarantee absolute security.

If a personal-data breach occurs, we will investigate, contain and remediate it and provide notifications to affected persons and competent authorities where and when applicable law requires.

11. Your choices and rights

Subject to applicable law and its commencement, you may have rights to:

• obtain a summary of personal data being processed and relevant processing activities;
• seek correction, completion or updating of inaccurate or incomplete data;
• request erasure where retention is no longer required by purpose, contract or law;
• withdraw consent where consent is the basis of processing;
• raise a grievance and, where applicable, approach the competent data-protection authority after using our grievance process; and
• make a nomination concerning the exercise of statutory rights where applicable.

Send requests to connect@itoslabs.com and describe the right you wish to exercise. We may request proportionate information to verify identity and authority, protect other persons and locate the relevant data. We will respond within the period required by applicable law; until then, we ordinarily aim to acknowledge a request within seven business days and conclude it within thirty days where reasonably possible.

12. Children

Our website and services are intended for business users and are not directed to individuals under 18 years of age. We do not knowingly seek personal data from children through the public website. If you believe a child has provided data to us without appropriate authorisation, contact us so we can investigate and take appropriate action.

13. Customer users and customer-controlled data

If your employer or another organisation provides your ITOS account, please direct requests about operational records in that account to the relevant organisation first. We will support our customer in responding where required by the customer agreement, data-processing terms and applicable law.

14. Third-party links

Links to third-party websites or services are provided for convenience. Their privacy practices are governed by their own notices, and ITOS Labs is not responsible for their independent processing.

15. Legal framework and updates

This notice is drafted with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 in view, including their phased commencement, and will be interpreted subject to the provisions actually in force and any other applicable law.

We may update this notice when our website, services, providers or legal obligations change. Material changes will be highlighted by updating the date on this page and, where required, by giving additional notice.

16. Contact and grievance redressal

ITOS Labs Private Limited
CIN: U62013DC2026PTC473882
Registered office: Third Floor, T-2 Shivam Plaza, Pocket B and E Market, Dilshad Garden, Delhi - 110095
Telephone: +91 99999 42989
Privacy and grievance contact: connect@itoslabs.com

This contact is the person authorised to receive privacy communications for ITOS Labs. It should not be understood as a statutory Data Protection Officer designation unless ITOS Labs is formally required to make and has made such an appointment.