Privacy Policy

01Who we are and what this covers

This Privacy Policy applies to the Android mobile application Kalayatan Delivery (package name: com.setuERP.DeliveryApp), published on Google Play by YR1973 (Kishor Manchare), Pune, Maharashtra, India (the "App"). The App works with the SetuERP logistics ERP, which is built and operated by YMS Associates LLP, Pune, Maharashtra, India ("YMS", "we", "us").

This policy explains how we handle personal data when you use:

• the Kalayatan Delivery mobile application published on Google Play (the "App"),
• the SetuERP web application used by transport companies and their staff,
• the SetuERP customer portal, and
• this website.

Together these are the "Services". This policy is written to meet the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules under it, and the Google Play Developer Program policies.

SetuERP is a business tool. Most data in it belongs to the transport company that has subscribed to SetuERP (the "Company"). For that data, the Company decides why and how it is processed and we process it on the Company's instructions. For your own account details and for data collected by the App from your device, we decide how it is processed and this policy applies directly.

02What we collect

Information you give us

• Mobile number: used to identify your account and to sign you in with a one-time password (OTP). The App does not ask you for your name, email address or any other personal details.

Information collected through the App when you use its features

• Location: your device's precise location, as explained in section 3, to record deliveries and show trip progress to your Company.
• Photos and scans: proof-of-delivery photos and barcode values that you capture with the camera inside the App.
• Notification token: a technical identifier for your device, used only to deliver alerts to you.
• Technical logs: app version, device model, operating system version, IP address and error or crash reports, used to keep the App working and to fix problems.

Information held in your Company's system

Delivery and consignment records, such as consignment numbers and delivery status, are stored in your Company's SetuERP account. The Company controls that data. The App does not collect it from your device.

We do not collect, through the App, your name, email address, contacts, call logs, SMS messages, files or photo library, financial account or card details, government identity numbers, biometric data or health data.

03Permissions the App asks for

Before the App asks Android for a permission, it shows a notice that explains what the permission is used for. You can decline, and you can refuse or withdraw a permission at any time in your device settings. The feature that needs it will stop working.

04How we use data

• To identify your account and sign you in with an OTP sent to your mobile number.
• To run the Company's delivery operations: runsheets, deliveries, proof of delivery and trip tracking.
• To let the Company's authorised staff see delivery status, proof of delivery and location during trips.
• To send you notifications about your assignments.
• To provide support, fix errors and improve the App.
• To meet legal obligations.

We do not use your data for advertising, we do not sell it, and we do not build profiles of you for purposes unrelated to the Services.

05Who we share data with

• The Company you work for or transact with. Operational records are visible to the Company's authorised users according to the roles the Company sets. If you are a Company's customer using the portal, the Company sees your portal activity.
• Government portals. GST numbers, invoice and consignment details are sent to the GST portal and the E-Way Bill portal to generate and validate statutory documents.
• The Company's customers' systems. Where a Company has integrated SetuERP with a customer's ERP, shipment status and documents for that customer's consignments are exchanged with that system.
• Service providers who host our servers and databases, deliver SMS, WhatsApp and push notifications, and collect crash reports. They process data only on our instructions and under contract.
• Law and safety. Where required by law, court order or a government authority, or to protect the rights, property or safety of YMS, our users or the public.
• Business transfer. If YMS or the SetuERP business is merged, acquired or sold, data may transfer to the successor, who must honour this policy.

Data is stored on servers located in India. If a service provider processes data outside India, we require contractual protections equivalent to those in this policy.

06Data you enter about other people

Users of SetuERP enter details of consignors, consignees, drivers and other people as part of transport operations. If you enter such data, you confirm that you or your Company are entitled to do so and have given any notice the law requires. We process that data for the Company under section 1 of this policy.

If your details were entered into SetuERP by a transport company, for example because you sent or received a consignment, the Company is responsible for that data. You can contact the Company directly, or contact us using section 13 and we will forward your request to the Company and assist them.

07How long we keep data

• Mobile number and account record: for as long as your account is active, and for up to 90 days after deletion to complete the removal and for security.
• Location points and POD photos: as part of the delivery record they belong to, for as long as the Company's subscription is active and afterwards for the period required by Indian tax and company law.
• Technical logs and crash reports: up to 12 months.

When a retention period ends, we delete the data or anonymise it so it no longer identifies anyone.

08Security

We protect data with encryption in transit (TLS), encryption of stored backups, hashed passwords, role-based access control inside the Services, logging of access to production systems, and regular review of who at YMS can reach personal data. No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires.

You are responsible for keeping your password and device secure and for signing out of shared devices.

09Your rights

Subject to applicable law, you may:

• ask for a copy of the personal data we hold about you,
• ask us to correct data that is inaccurate or incomplete,
• ask us to delete your personal data (see section 10),
• withdraw consent for a permission or a processing activity that relies on consent,
• nominate another person to exercise these rights on your behalf, and
• raise a grievance with our Grievance Officer, and if unresolved, with the Data Protection Board of India.

Where data is controlled by a Company, we may need to route your request to that Company. We will tell you when this is the case and respond within the time the law allows.

10Deleting your account

You can delete your SetuERP account in either of these ways:

• In the App: open Settings, then Account, then Delete account, and confirm.
• By email: write to the address in section 13 from the email or mobile number registered on the account, with the subject "Delete my SetuERP account".

When you delete your account we remove your mobile number, notification token and device identifiers within 90 days. Operational and financial records you created while working for a Company are business records of that Company and stay with the Company for the retention period in section 7. They will no longer be linked to your login.

11Children

The Services are for use by businesses and their adult staff and customers. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will remove it.

12Changes to this policy

We may update this policy when the Services or the law change. The effective date at the top shows the current version. For material changes we will notify you in the App or by email before they take effect. Continued use of the Services after that date means the updated policy applies.

13Contact and Grievance Officer

For any question, request or complaint about personal data, contact:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.