Who this notice is for
This notice is for drivers and fleet staff whose data appears in OctaFleet, and for the customer organisations that operate it.
The fleet operator that subscribes to OctaFleet is the data controller. It decides what data is collected, whose data is collected and how long it is kept. OctaScale Technologies Private Limited acts only as a data processor. OctaScale processes platform data only on the controller's documented instructions.
Drivers should direct access and other data requests to their employer first.
Data the platform processes
- Vehicle telemetry: GPS position, speed, heading, odometer, ignition on or off, and device power connection or disconnection.
- Driving-behaviour events: harsh acceleration, harsh braking, cornering, sudden impact and speed violations, with severity and timestamp.
- Driver identity: name, employee or licence identifier, and assigned vehicle.
- Trip records: start and end time and location, route, distance and duration.
- Account data: user name, work email, role, login timestamps and IP address.
- Device data: tracker serial, IMEI, firmware version and health status.
Purpose of processing
OctaScale processes platform data to deliver the service the customer subscribed to. This includes live tracking, trip history, alerting, reporting, device health monitoring and support.
OctaScale does not use customer telematics data to train models. It does not sell this data or use it for OctaScale's own analytics or marketing.
Legal basis
The customer is responsible for identifying and meeting its obligations under India's Digital Personal Data Protection Act, 2023 and, where it operates in the European Union, the GDPR.
For GDPR purposes, the controller's legal basis is normally its legitimate interest in fleet safety and asset protection, subject to the controller's own balancing test. Employee monitoring carries additional requirements in several jurisdictions. The customer is responsible for assessing those requirements and notifying its drivers.
Data location and sub-processors
Platform data is hosted in Amazon Web Services' Asia Pacific (Mumbai) region, ap-south-1, in India.
| Provider | Purpose | Data location |
|---|
| Amazon Web Services (AWS) | Application hosting, database and file storage | India (ap-south-1, Mumbai) |
| Google Maps Platform | Map tiles, geocoding and route display | United States |
Google Maps involve transfer of personal data outside India, limited to what is necessary for map rendering and error diagnosis. OctaScale gives customers advance notice before adding or changing a sub-processor.
Retention
Data is retained while the subscription is active because the service depends on historical trip and event history.
Customers can delete individual records, vehicles or drivers at any time from within the platform.
On termination, data is deleted from production systems within 60 days. Encrypted backups age out within a further 35 days.
Customers may request earlier deletion or a full export before termination.
A more detailed per-category retention schedule will be published as the product matures. Customers with specific retention requirements can agree them contractually.
Security
Platform safeguards include TLS in transit, encryption at rest, role-based access control, least-privilege internal access and audit logging of administrative actions. The platform is hosted within AWS Mumbai. Formal certification is not yet in place.
Rights and requests
Drivers should contact their employer, which is the controller. Customer organisations can contact OctaScale for support with access, correction, erasure and export requests. OctaScale answers customer requests within 30 days.
Contact
Questions, complaints and data requests can be sent to:
OctaScale Technologies Private Limited
Prayagraj, Uttar Pradesh, India
privacy@octafleet.io
