Privacy Policy

This policy is issued by PARISKQ IOT Solutions Private Limited having its registered office at 19, 1st Floor, Ranoji Rao Road, Basavanagudi, Bengaluru 560004, India (PARISKQ). For the personal data described in this policy, PARISKQ decides the purpose and means of processing and is therefore the "Data Fiduciary" under the DPDP Act.

This policy applies to personal data we collect through:

• our website www.pariskq.in (including enquiry forms, newsletter sign-ups and cookies);
• job applications and recruitment communications; and
• our mobile applications Matra, Sahaya, GoodsMover.

Enterprise customers. Where a business customer uses a PARISKQ platform (for example fleet, logistics or workplace-safety solutions) and decides why and how the personal data of its drivers, employees or end users is processed, PARISKQ acts as a "Data Processor" for that customer. In that case the customer's privacy notice applies, and requests about that data should first be sent to the customer. We process such data only on the customer's documented instructions and under a written contract.

Definitions. "Personal data" means any data about an individual who is identifiable by or in relation to that data. "Data Principal" ("you") is the individual to whom the personal data relates. "Board" means the Data Protection Board of India.

We collect only the personal data that is necessary for the specific purposes listed below. We will not use it for a different purpose unless we first obtain fresh consent from you or another lawful ground applies.

2.1 Website, enquiries and careers

2.2 Mobile applications

Our apps request device permissions only where a feature needs them. You can decline or withdraw any permission in your device settings; the related feature may then stop working, but the app's other features will continue where possible.

What we do not do. We do not access your contacts, SMS, call log, photos or location unless you have granted the permission and the feature needs it. We do not use personal data collected through our apps for targeted advertising. We do not sell personal data to any other third parties.

Combining data. We combine information from other sources only where it is needed for the purposes in this policy (for example, publicly available business contact information to reply to an enquiry) and we will tell you if we do.

• Free, specific, informed and clear. We ask for your consent through a clear affirmative action, such as ticking an unticked box or tapping "Allow", after showing you a separate notice that lists the personal data and the purpose. Browsing the website, or using it, is not treated as consent to processing of personal data.
• Not bundled. Consent for marketing, optional analytics or any optional app permission is requested separately and is never a condition for getting a response to an enquiry or using core features.
• Withdrawing consent. You may withdraw consent at any time, as easily as you gave it, by writing to enquiry@pariskq.in. Once you withdraw, we (and our Data Processors) will stop processing and will erase the personal data unless the law requires us to retain it. Withdrawal does not affect processing done before it. The consequences of withdrawal will be explained to you at that time.
• Consent Managers. Once Consent Managers are registered with the Board, you may give, manage and withdraw consent through a Consent Manager of your choice, and we will honour requests made that way.
• Language. You may ask for this policy and any consent notice in English or in any language listed in the Eighth Schedule to the Constitution of India.
• Records. We keep a record of the notice shown, the consent given and when.

Other lawful grounds. We may also process personal data without consent for the "certain legitimate uses" recognised in Section 7 of the DPDP Act. At PARISKQ these are mainly: (a) where you voluntarily give us your data for a specified purpose and have not told us you do not consent to its use; (b) for employment purposes and to safeguard the employer from loss or liability; (c) to comply with a law, court order or legal process; and (d) to respond to a medical emergency or threat to life or public safety.

We use personal data only for the purposes in Section 2, that is to:

• respond to enquiries and requests, and provide the products and services you or your organisation have asked for;
• create and run app accounts and deliver app features;
• assess job applications;
• send marketing communications where you have opted in;
• maintain security, prevent fraud, and troubleshoot and improve our website and apps; and
• comply with legal obligations and establish or defend legal claims.

Any other purpose will be notified to you, and your fresh consent obtained where required, before the use begins.

Our website uses essential cookies (needed for the site to work) and, if you accept them, analytics and occasionally marketing cookies. When you first visit, a cookie banner will let you accept or reject non-essential cookies with equal prominence and change your choice later by writing to enquiry@pariskq.in. You can also block cookies in your browser; some parts of the site may then not work as intended.

We do not sell personal data. We share it only as follows:

• Data Processors who act on our instructions, such as cloud hosting, email and communications platforms, analytics, CRM and recruitment tools. We have written contracts with them requiring appropriate security safeguards and use of the data only for our stated purposes.
• Drivers and service providers assigned to your request, limited to the details needed to complete it.
• Authorities and courts where we are required by law, or to prevent or investigate fraud, security incidents or threats to anyone's safety.
• Successors, in a merger, restructuring or sale of the business or assets, provided the recipient takes on obligations at least as protective as this policy and the law is followed.
• Aggregated or anonymised information that cannot identify you may be used and shared for statistics and analysis.

Transfers outside India. Personal data may be processed outside India only in countries or territories that the Central Government has not restricted under Section 16 of the DPDP Act, and we will comply with any additional requirements the Government specifies.

We keep personal data only for as long as needed for the purpose it was collected for, or as long as the law requires, and then erase it or anonymise it. Typical periods:

We maintain reasonable security safeguards to prevent personal data breaches, including:

• encryption, masking or tokenisation of personal data where appropriate, in transit and at rest;
• role-based access controls, with access limited to staff who need it;
• logging, monitoring and review of access to detect and investigate unauthorised activity, with logs kept for at least one year;
• data backups and measures to keep processing running if systems are compromised;
• security terms in every contract with a Data Processor; and

Personal data breaches. If a personal data breach affects you, we will inform you within 72 hours, through your account or registered email/phone, describing what happened, when, the likely consequences, what we are doing about it, safety steps you can take and a contact person who can answer your questions. We will also report the breach to the Data Protection Board of India in the manner and time the DPDP Rules require.

Under the DPDP Act you have the following rights, which you can use by writing to us at the address in Section 11 or through enquiry@pariskq.in. We may need to verify your identity before acting, and we will respond within 15 days and no later than the period the DPDP Rules allow.

• Access: to get a summary of the personal data we hold about you, the processing we carry out, and the identities of all other Data Fiduciaries and Data Processors with whom we have shared it, together with a description of the data shared.
• Correction, completion and updating: to have inaccurate or misleading data corrected, incomplete data completed and data updated.
• Erasure: to have your personal data erased where you withdraw consent or the purpose is served, unless we must keep it by law.
• Withdraw consent: at any time, as described in Section 3.
• Grievance redressal: to have any complaint about our handling of your data or exercise of your rights addressed. We will resolve grievances within 90 days, the period set by the DPDP Rules.
• Nominate: to nominate another individual to exercise your rights if you die or become unable to do so.
• Accuracy obligation: All data used for decisions affecting the individual (or shared with another Fiduciary) will be kept complete, accurate, and consistent with Section 8(3).

Complaint to the Data Protection Board. If you are not satisfied with our response to your grievance, you may complain to the Data Protection Board of India at https://www.dpb.gov.in

Your responsibilities. Please give us accurate information, do not impersonate anyone, do not suppress material information when giving details for official documents, and do not file false or frivolous grievances or complaints. The DPDP Act provides for penalties for breach of these duties.

Our website and apps are intended for business users and adults. We do not knowingly collect personal data from anyone under 18 years of age without verifiable consent of a parent or lawful guardian, and we do not track or monitor the behaviour of children or direct targeted advertising at them. If you believe a child has given us personal data without such consent, please contact through enquiry@pariskq.in and we will delete it.

For questions, requests to exercise your rights, consent withdrawal or grievances:

Grievance Officer / Data Protection Contact: C V Kumar, Director

Email: enquiry@pariskq.in

Postal address: 19, 1st Floor, Ranoji Rao Road, Basavanagudi, Bengaluru 560004, India. Phone: 9880118388

We may update this policy from time to time to reflect changes in law, technology or our practices. The "last updated" date above will change, and for material changes (such as a new purpose or a new category of data) we will notify you through website banner and obtain fresh consent where the law requires. Earlier versions are available on request.

This policy is governed by the laws of India, including the DPDP Act and the DPDP Rules. Courts at Bengaluru have jurisdiction, subject to your statutory rights to approach the Data Protection Board and other competent authorities.