Privacy Policy

1. Scope

This policy applies to the Sardhardham VMS mobile application available on Apple iOS and Google Android. It does not apply to the admin web portal used by the organisation's internal staff, which is governed by separate internal data-handling procedures.

2. Information We Collect

2.1 Information You / Your Administrator Provide

• Full name
• Mobile phone number
• Aadhaar card number (collected and masked; only last 4 digits shown in-app)
• Driving licence number, class, and expiry date
• Date of birth and address
• Emergency contact name, phone number, and relationship
• Profile photograph (uploaded by your administrator)

2.2 Information Collected Automatically

• GPS location — collected during active trips to track routes and assist fleet management
• Device identifiers — for push notification delivery only
• App usage logs (screens visited, actions) — for troubleshooting
• Trip data: start/end times, distance, status, and assigned vehicle details

2.3 Information We Do Not Collect

• Passwords or PINs (authentication uses a one-time token issued by your admin)
• Financial or payment information
• Health or biometric data
• Contacts, photos, or media on your device (beyond profile pic upload)
• Browsing history or information from other apps

3. How We Use Your Information

4. Location Data

The App requests access to your precise GPS location. Location is collected:

• Only when you are actively logged in and a trip is in progress
• For the purpose of route logging, real-time fleet visibility for your admin, and generating trip distance reports
• Location data is stored in Firebase (Google) and retained for 12 months after a trip is completed

We do not sell or share your location data with third-party advertisers. You may contact your administrator to have location records deleted.

5. Sharing Your Information

We share your personal data only in the following circumstances:

• Authorised administrators of your organisation — to manage fleet operations, review performance, and maintain compliance records
• Google Firebase (Realtime Database & Cloud Messaging) — our backend infrastructure provider; data is processed under Google's Data Processing Terms
• Legal authorities — when required by Indian law, court order, or government regulation
• Successors — in the event of a merger, acquisition, or restructure of the organisation, with notice given to affected users

We do not sell, rent, or trade your personal information to any third party.

6. Data Retention

• Active account data — retained for the duration of your engagement with the organisation
• Trip records — retained for 12 months after trip completion, then archived or deleted
• Notification logs — retained for 3 months
• Account data after deletion request — removed within 30 days, except where retention is required by law

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (India) and applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Grievance redressal — raise a complaint with our Data Protection Officer
• Nominate — nominate another person to exercise rights on your behalf in case of death or incapacity

To exercise any of these rights, contact us and we will respond within 30 days. If you are unsatisfied, you may escalate to the Data Protection Board of India.

8. Data Security

We implement the following safeguards:

• All data is stored in Google Firebase with encryption at rest and in transit (TLS)
• Access to driver records is restricted to authorised administrators only
• Authentication uses short-lived tokens instead of passwords to reduce credential risk
• Firebase security rules prevent cross-driver data access

No method of transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by law.

9. Third-Party Services

The App uses the following third-party services:

• Google Firebase Realtime Database — data storage and synchronisation (firebase.google.com/support/privacy)
• Google Firebase Cloud Messaging — push notifications
• Expo (React Native) — mobile app framework; does not collect personal data independently

These services have their own privacy policies. We are not responsible for their practices.

10. Children's Privacy

The App is intended for use by adult drivers employed or authorised by the organisation. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor's data has been submitted, please contact us immediately and we will delete it.

11. International Data Transfers

Your data is stored on Google Firebase servers, which may be located outside India. Google maintains Standard Contractual Clauses and other safeguards to ensure adequate protection for international data transfers in compliance with applicable privacy law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top. Significant changes will be communicated via an in-app notification. Continued use of the App after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, requests, or complaints regarding this Privacy Policy:

• Email: contact@sardhardham.org
• Address: AT-Sardhar , Bhavnagar Highway, Dist: Rajkot, Gujarat 360 025 (INDIA)
• Website: sardhardham.org/contact

Our Data Protection Officer will acknowledge your request within 72 hours and provide a substantive response within 30 days.