Last updated 12 Nov 2026
Privacy policy
What personal data PRACHSO processes about fleet owners, office staff and drivers, why, for how long, and the rights you have under the Digital Personal Data Protection Act, 2023.
Who we are and what this covers
This policy explains how PRACHSO PRIVATE LIMITED (CIN U71100MH2026PTC470078), the operator of prachso.xyz, with its registered office at 3rd Floor, Lentin Chamber, Dalal Street, Kala Ghoda, Fort, Mumbai, Maharashtra 400001, India, referred to here as "PRACHSO", "we" or "us", processes personal data when you visit prachso.xyz, request a demo or fleet scan, use the PRACHSO application, or receive a reminder from us on WhatsApp.
PRACHSO is compliance-tracking software for goods-vehicle fleets in India. Our customers are transport companies, shippers and logistics businesses. They add their vehicles, drivers and office staff to PRACHSO, and we read registration and licence records through authorised channels so that the right person is reminded before a document lapses.
We process personal data in two roles. For our own website, sales and billing we decide why and how data is processed, so we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act). For the vehicle, driver and staff records a customer loads into its PRACHSO account, the customer decides why that data is processed and we act on its instructions as a Data Processor. The Data processing agreement sets out that second role in detail.
Personal data we process
| Whose data | What we hold | Where it comes from |
|---|---|---|
| Website visitors and enquirers | Name, work email, mobile number, company, role, fleet size, states of operation, the message you send us | You, through a form on this website |
| Fleet Scan users | Mobile number (verified by OTP), up to 25 vehicle numbers, the scan result | You, and the authorised registry channels listed below |
| Account holders and office users | Name, email, mobile number, branch, role, login history, actions taken in the app | Your employer, or you when you sign up |
| Vehicle owners | Owner name as shown on the registration record, vehicle number, registration, fitness, permit, insurance, PUC and tax validity, hypothecation and blacklist status | Authorised registry channels, and documents your fleet uploads |
| Drivers | Name, mobile number, preferred language, driving licence number, licence validity, vehicle classes, hazardous-goods endorsement, challans attributed to the driver | Your fleet, authorised registry channels, and DigiLocker where the driver consents |
We do not ask for or store Aadhaar numbers, bank account details, card numbers or biometric data. Payments are handled by a payment provider, and we receive only the payment status and a reference.
Where registry data comes from
Vehicle and licence records are read one record at a time through authorised channels only: the Unified Logistics Interface Platform (ULIP), the Parivahan, VAHAN and SARATHI services available to registered users, DigiLocker with the document holder's consent, and licensed data partners. We do not scrape any government portal, and we do not buy or build bulk copies of registry data. Every fetch is logged with the account, the record requested and the time.
PRACHSO is not VAHAN, SARATHI, Parivahan or any government service. We read records so our customers can track them. We do not issue, renew or alter any government document.
Why we process it
| Purpose | Ground under the DPDP Act |
|---|---|
| Answering an enquiry, booking a demo, running a fleet scan you asked for | Your consent, given when you submit the form |
| Providing the PRACHSO service to a customer: fetching records, building the expiry calendar, sending reminders, recording challans | Processed on the customer's instructions; the customer relies on its own consent or legitimate use |
| Sending WhatsApp reminders to a driver or staff member | Consent recorded through the WhatsApp opt-in, as the WhatsApp Business Platform requires |
| Reading a driver's documents from DigiLocker | The driver's consent, given in DigiLocker for each request |
| Billing, tax records and responding to lawful requests | Compliance with law, a legitimate use under section 7 of the DPDP Act |
| Keeping the service secure: access logs, fraud and abuse prevention | Legitimate use, and the reasonable security safeguards section 8 of the DPDP Act requires |
We do not sell personal data. We do not use vehicle numbers, licence numbers, names or mobile numbers for advertising, and none of them are sent to analytics tools. Analytics receive only event names and coarse properties such as fleet size band or state.
Consent and how to withdraw it
Where we rely on consent, the request tells you what data is involved and why. You can withdraw consent at any time, as easily as you gave it: reply STOP to any WhatsApp message from PRACHSO, use the unsubscribe link in any email, or write to grievance@prachso.xyz. Withdrawal does not affect processing done before it. If a driver withdraws WhatsApp consent, the fleet's office users still see that driver's expiry dates in the app, and reminders for that driver go to the office instead.
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and come into force in phases. We are aligning our notices, consent records and breach procedures with each phase as it commences. Where a phase has not yet commenced, we follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Who we share it with
- Your own fleet account. Office users see the data their role allows. Branch staff see only their branch. A driver sees only their own Roadside Pack.
- Subprocessors that host the service, deliver WhatsApp and email messages, and process payments. The current list is on the Subprocessors page.
- Agents your fleet appoints. If your office hands a renewal to an RTO consultant or insurance broker through PRACHSO, the documents needed for that renewal are shared with that person at your office's instruction.
- Authorities, when Indian law requires it and only to the extent required. We tell the customer first unless the law forbids it.
Where it is stored
Customer data, including registry records, documents and challans, is stored on servers located in India. Messages sent through WhatsApp pass through Meta's WhatsApp Business Platform, which may process message content outside India for delivery. We do not transfer personal data to any country the Central Government has restricted under section 16 of the DPDP Act.
How long we keep it
| Data | Retention |
|---|---|
| Fleet Scan results for non-customers | Deleted 30 days after the scan |
| Enquiries that do not become customers | Deleted 12 months after the last contact |
| Customer account data | For the life of the subscription, then 60 days for export, then deleted |
| Archived vehicles (sold or scrapped) inside an active account | Kept with history while the account is active, as the customer chooses |
| Invoices and payment records | 8 years, as Indian tax law requires |
| Security and access logs | 12 months |
Your rights
Under the DPDP Act you have the right to:
- get a summary of the personal data we process about you and the processing activities;
- have inaccurate or incomplete data corrected, completed or updated;
- have data erased when it is no longer needed for the purpose, unless the law requires us to keep it;
- nominate another person to exercise your rights if you die or become incapable;
- have a grievance addressed by us, and then approach the Data Protection Board of India if you are not satisfied.
If your data is in a fleet's account (for example you are a driver), we pass your request to that fleet, because it decides how the data is used, and we help it respond. Registry data such as a licence validity date reflects the government record; if it is wrong, the correction has to be made at the RTO, and we re-read the record once it is.
Security
Data is encrypted in transit and at rest. Access inside a fleet account is role-based. Every change, upload, reminder and registry fetch is logged with user and time. Our Security page describes the controls. If a personal data breach occurs, we inform affected customers without undue delay and notify the Data Protection Board of India as the DPDP Act requires.
Children
PRACHSO is a business service for transport operators and is not directed at anyone under 18. We do not knowingly process a child's personal data. Every driver whose licence is tracked holds a driving licence and is therefore an adult.
Changes and contact
We update this policy when our processing changes and change the date at the top. Material changes are announced to account holders by email at least 15 days before they take effect. Questions and complaints go to our Grievance officer at grievance@prachso.xyz.