The DPA between your organisation as Data Fiduciary and Tripkoz as Data Processor — scope, instructions, sub-processors, security, breach notification and deletion.
It is incorporated into the Terms & Conditions and takes effect the moment your organisation starts using Tripkoz. If your procurement process needs a countersigned copy on your own paper, write to us and we will sign one.
This Data Processing Agreement ("DPA") is entered into between the organisation subscribing to Tripkoz ("Customer", "you", the Data Fiduciary) and Tripkoz Technologies ("Tripkoz", "we", the Data Processor).
It is incorporated into, and forms part of, the Tripkoz Terms & Conditions. Where the DPA and the Terms conflict on the processing of personal data, this DPA governs.
It applies for as long as we process personal data on your behalf.
You are the Data Fiduciary in respect of Customer Data. You decide which passengers, guardians, drivers and vehicles are recorded, what is recorded about them, who in your organisation can see it, and how long you keep it in the Service.
We are the Data Processor. We process Customer Data only to provide, secure and support the Service, and only on your documented instructions.
We are the Data Fiduciary for a small, separate set of data we hold in our own right: your administrators’ account and billing details, support correspondence, and aggregated, de-identified usage statistics. That processing is described in the Privacy Policy, not here.
You are responsible for having a lawful basis for the processing you instruct — in particular, for obtaining verifiable consent from a parent or lawful guardian before a child’s personal data is recorded in the Service.
Subject matter — provision of the Tripkoz transport-management platform: live vehicle tracking, trip and boarding records, safety and maintenance records, notifications, and the associated administration.
Duration — for the term of your subscription, plus the retention period in clause 11.
Categories of Data Principal:
Categories of Personal Data:
We do not require, and ask you not to upload, financial account details, health records, biometric data or government identity numbers of passengers. The Service is not designed to hold them.
We process Customer Data only:
We do not sell Customer Data. We do not use it for advertising. We do not use it to train machine-learning models.
If we consider an instruction to breach the DPDP Act or other applicable law, we will tell you promptly and may pause that processing until it is resolved.
Access to Customer Data is limited to personnel who need it to operate or support the Service. Every such person is bound by a written confidentiality obligation that survives the end of their engagement.
Our personnel are trained on data protection and on the specific sensitivity of children’s location data. Administrative access to production data is role-restricted, logged, and reviewed.
We implement and maintain appropriate technical and organisational measures, including:
Measures are reviewed as the Service evolves. We may change a specific measure provided the overall level of protection is not reduced.
You give general authorisation for us to engage Sub-processors. Each is bound by written terms imposing data-protection obligations no less protective than this DPA, and we remain liable to you for their performance.
The current categories are:
A current list naming each Sub-processor and its processing location is available on request from privacy@tripkoz.com. We will give at least thirty (30) days’ notice before adding or replacing a Sub-processor that processes Customer Data. If you reasonably object on data-protection grounds within that period, we will work with you on an alternative; if none is workable, you may terminate the affected part of the Service and receive a refund of the unused term.
Customer Data is hosted on infrastructure in India, and may be processed in other jurisdictions where our Sub-processors operate, in accordance with section 16 of the DPDP Act and any restrictions notified by the Central Government.
Where data leaves India, we ensure a comparable level of protection through contractual commitments with the Sub-processor, encryption in transit and at rest, and access controls.
Requests from Data Principals — access, correction, erasure, grievance redressal, or nomination — are answered by you as Data Fiduciary. Most can be satisfied directly in the dashboard, which lets an administrator view, correct, export and delete the records for a passenger, guardian or driver.
Where a request reaches us instead, we will not respond to it on our own account. We will forward it to you promptly and, unless the law directs otherwise, tell the individual to contact you.
We will give you reasonable assistance, at no charge, in responding to such requests and in carrying out any consultation with the Data Protection Board that the DPDP Act requires.
We will notify you of a Personal Data Breach affecting Customer Data without undue delay, and in any event within seventy-two (72) hours of becoming aware of it.
The notification will describe, so far as known at the time: the nature of the breach, the categories and approximate number of Data Principals and records affected, the likely consequences, and the measures taken or proposed to address it. Where the full picture is not yet available, we will send what we have and update you as it develops rather than waiting.
We will cooperate with you in meeting your own notification obligations to the Data Protection Board of India and to affected Data Principals, and we will not require you to wait on our internal process before you notify.
We retain Customer Data for the term of your subscription and for thirty (30) days after it ends, so that an account can be reactivated or exported without loss.
On request during that period we will provide an export of your Customer Data in a machine-readable format. On written instruction we will delete it sooner.
After thirty days we may delete Customer Data. We retain only what the law requires us to keep — tax invoices in particular, for the statutory period — and audit records where they are needed to demonstrate compliance.
Deleted records may persist in encrypted backups until those backups expire on their normal cycle, during which they remain protected by the measures in clause 7 and are not restored into the live system except as part of a disaster recovery.
We will make available the information reasonably necessary to demonstrate compliance with this DPA, including our security documentation and, where available, third-party assessment reports.
You may audit our compliance, at your own cost, no more than once in any twelve-month period and on at least thirty (30) days’ written notice, or more often if required by a regulator or following a Personal Data Breach affecting your Customer Data. An audit must not disrupt the Service or compromise the confidentiality of another customer’s data.
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms & Conditions.
Nothing in this DPA relieves either party of an obligation imposed directly on it by the DPDP Act, and neither party may contract out of a liability the Act places on it.
Data protection questions, Sub-processor lists and countersigned copies of this DPA: privacy@tripkoz.com.
Grievances under the DPDP Act: our Grievance Officer at grievance@tripkoz.com, who acknowledges within 24 hours and aims to resolve within 15 days of receipt.
This document sits alongside the rest of our published terms. Together they form the agreement that governs your use of Tripkoz.
