Privacy Policy

01. Regulatory Framework & Role Clarification

This Privacy Policy is compiled in compliance with the **Digital Personal Data Protection Act, 2023 (DPDP Act)** and **Section 43A of the Information Technology Act, 2000** of India. Under these regulations, WheelsTracker (owned and operated by Leena IT Solutions) acts as a **Data Fiduciary** for the personal data provided by educational institutions (schools, universities) and parent guardians (**Data Principals**). We process location coordinates and passenger logs solely on behalf of the registered institutional client.

02. Consent Mechanism & Purpose Limitation

In accordance with Section 6 of the DPDP Act, 2023, personal data is collected only after obtaining free, specific, informed, unconditional, and unambiguous consent from the Data Principal. Parents or legal guardians provide consent during account registration on the WheelsTracker application.

**Consent Withdrawal:** You have the right to withdraw your consent to data processing at any time. Upon withdrawal of consent, we will cease processing location telemetry for your account within 48 hours, which will disable live stop updates.

03. Sensitive Personal Data & Information (SPDI)

We collect specific categories of data necessary for routing operations, categorised as SPDI under the IT Rules, 2011:

• Real-time Location Coordinates: GPS latitude, longitude, velocity, and timestamp signals collected from drivers during routing operations.
• Account Credentials: Password hashes, login tokens, school district association parameters, and registered mobile numbers.
• Parent-Student Mappings: Internal stop reference tags matching parent accounts to the school van or bus stop for proximity alerts.

04. Rights of Data Principals

As a Data Principal under the DPDP Act, you have the following legal rights regarding your personal data:

• Right of Access: Obtain a summary of the personal data currently being processed and the processing activities.
• Right to Correction & Erasure: Correct incomplete, inaccurate, or outdated data, or request absolute deletion of location records.
• Right to Grievance Redressal: File a direct complaint with our Grievance Officer regarding any data breach or unauthorized processing.
• Right to Nominate: Nominate any individual to exercise your rights under the DPDP Act in the event of death or incapacity.

05. Processing of Children's Personal Data

Under Section 9 of the DPDP Act, 2023, processing data of a child (under 18 years of age) requires verifiable consent from the parent or lawful guardian.

• We do not process children's personal data in any manner that is likely to cause a detrimental effect on the well-being of the child.
• We do not track, profile, monitor, or direct targeted advertisements to children based on their transit logs, route metrics, or geofence crossings.

06. Reasonable Security Practices & Breach Protocol

We implement strict security practices conforming to **ISO/IEC 27001** standards and IT Act Section 43A requirements. Telemetry pipelines are secured via TLS 1.3 encryption, and data-at-rest is encrypted with AES-256 protocols.

**Breach Reporting:** In the event of a personal data breach, we are legally mandated to report the incident to the **Indian Computer Emergency Response Team (CERT-In)** and notify affected Data Principals and the Data Protection Board of India in the prescribed format.

07. Data Retention & Cross-Border Transfer

All location logs and GPS history tracking datasets are kept for a maximum of 30 days to generate fuel idling and route compliance reports. Once this retention window lapses, logs are permanently purged from active servers. In accordance with DPDP Act guidelines, personal data collected from Indian citizens is processed and stored on secure servers located within the territory of India.

08. Appointment of Grievance Redressal Officer

In accordance with Section 5 of the IT Rules, 2011 and DPDP Act provisions, we have appointed a Grievance Redressal Officer. Any concerns, data access requests, or complaints should be directed to: