Data processing agreement

Parties and scope

This agreement forms part of the Terms of service between the Customer and PRACHSO PRIVATE LIMITED (CIN U71100MH2026PTC470078), the operator of prachso.xyz, with its registered office at 3rd Floor, Lentin Chamber, Dalal Street, Kala Ghoda, Fort, Mumbai, Maharashtra 400001, India. It applies to personal data the Customer loads into PRACHSO or asks PRACHSO to fetch ("Customer Personal Data"). For that data the Customer is the Data Fiduciary and PRACHSO is the Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023.

Details of processing

PRACHSO's obligations

1. Process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this agreement and the Customer's configuration of the service.
2. Fetch registry records only for vehicles and licences the Customer has added, one record at a time, through authorised channels, and log every fetch.
3. Make sure everyone with access to Customer Personal Data is bound by confidentiality.
4. Apply reasonable security safeguards, including encryption in transit and at rest, role-based access, logging of every change, upload and reminder, and restricted production access for PRACHSO staff.
5. Use only the subprocessors listed on the Subprocessors page, bind each to data protection terms no less protective than these, and give 30 days' notice by email before adding or replacing one. The Customer may object on reasonable data protection grounds, and if we cannot address the objection, the Customer may end the affected service and receive a refund of prepaid fees for it.
6. Help the Customer respond to requests from data principals for access, correction, erasure and grievance redressal, and pass on any such request received directly within 2 working days.
7. Notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 24 hours of becoming aware of it, with the information the Customer needs to inform the Data Protection Board of India and affected data principals.
8. On the end of the subscription, make Customer Personal Data available for export for 60 days and then delete it, except where Indian law requires a copy to be kept.
9. Make available the information reasonably needed to show compliance with this agreement, and answer a written security questionnaire once a year at no charge.

The Customer's obligations

• Have a lawful basis for the data it loads and give data principals the notice the DPDP Act requires.
• Collect drivers' and staff members' WhatsApp opt-in before reminders are sent, using the opt-in flow in the product.
• Add only vehicles it owns, operates or has been presented for loading, and only drivers it engages.
• Keep its user list current and assign roles that match each user's job.

Consent records

PRACHSO records the date, channel and wording of each WhatsApp opt-in and each DigiLocker consent, and makes those records available to the Customer. When a driver withdraws consent by replying STOP, reminders to that driver stop at once and the Customer is shown the change.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with phased commencement. Where a Rule that changes these obligations commences, PRACHSO will update this agreement and tell Customers by email.

Signed copies

This agreement applies automatically to every account. Customers that need a countersigned copy for their own records or a principal's audit can request one at security@prachso.xyz.