Privacy Policy

This Privacy Policy is issued by Exxomatic IoT Systems & Software Solutions Pvt Ltd (“Exxomatic”, “Company”, “we”, “us”, or “our”), a private limited company incorporated under the laws of India, having its primary engineering innovation centres in HITEC City & Miyapur, Hyderabad, Telangana, and testing laboratories in Baner - Hinjawadi, Pune, Maharashtra.

Under the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and relevant international data privacy laws (including Regulation (EU) 2016/679 – General Data Protection Regulation – GDPR where applicable), Exxomatic acts as a Data Fiduciary regarding enterprise client account data, and as a Data Processor with respect to fleet telemetry, driver operational logs, and machine metrics processed on behalf of our enterprise subscribers.

We classify the information processed through our connected mobility infrastructure into three clear categories:

Exxomatic systems interface directly with internal electronic control units (ECUs) across commercial diesel, hybrid, and electric vehicles via high-speed CAN networks. We implement strict data segregation protocols:

• Read-Only Passive Ingestion: By default, ExxoEdge™ firmware operates in non-intrusive listen mode to guarantee vehicle engine management safety and warranty compliance.
• Edge Filtering & De-identification: High-frequency 50Hz raw CAN signals are parsed and converted to standardized SI units at the edge. Raw bus message arbitration IDs that do not correlate to diagnostic requirements are discarded prior to uplink transmission.
• Driver Identifier Decoupling: Telematics streams are indexed against unique Vehicle Identification Numbers (VIN) or Device IDs. Driver identity mappings are maintained in separate, role-restricted customer relational databases with zero cross-tenant contamination.

Under Section 4 and Section 7 of the Indian DPDP Act, 2023, and Article 6 of the GDPR, we process data under the following legitimate grounds:

• Contractual Performance: Ingestion and computational analysis necessary to deliver the NavEdge 2.0 fleet platform, automated dispatching, driver scorecards, and maintenance predictions agreed in Master Services Agreements.
• Statutory Mandates: Processing required under Indian Ministry of Road Transport and Highways (MoRTH) standards (AIS-140) for public passenger and hazardous goods vehicles.
• Legitimate Commercial Interests: Monitoring API traffic to prevent distributed denial-of-service (DDoS) attacks, detecting unauthorized SIM card extraction from ExxoEdge units, and optimizing telemetry transmission bandwidth.
• Explicit Consent: Where enterprise fleet operators configure optional employee biometric or RFID driver authorization modules, explicit employee consent records are maintained by the respective enterprise subscriber.

ExxoEdge™ hardware units certified under Automotive Industry Standard AIS-140 contain dedicated dual-IP firmware pipelines designed for compliance with state and national tracking mandates:

Exxomatic does not sell, lease, or monetize telematics data or customer contacts to third-party marketing brokers, insurers, or data brokers under any circumstances.

The Customer is the sole owner of all raw telematics, route histories, and machine logs generated by their assets. Exxomatic claims no proprietary or intellectual property rights over customer fleet operational data.

Our customers possess uninterrupted rights to:

• Full Export: Retrieve all raw CAN bus logs, GPS coordinates, and battery health reports via our RESTful APIs or scheduled Parquet/CSV s3 bulk dumps.
• Purge upon Termination: Request complete deletion of tenant database partitions within thirty (30) calendar days of contract completion.
• Aggregated Benchmarking: Exxomatic may utilize completely anonymized, aggregated statistical indices (e.g. average battery degradation curves across ambient temperatures) strictly for system optimization, ensuring no corporate entity or driver can ever be identified.

Data is housed in Tier-IV enterprise cloud data centres physically located within the sovereign borders of India (Mumbai and Hyderabad regions) with zero unauthorized extraterritorial routing:

• High-Frequency Telemetry: Raw second-by-second CAN bus streams are retained in hot query storage for 90 days, after which they automatically transition to cold compressed object storage for up to 365 days.
• SOS & Emergency Incident Packets: Records generated during an emergency panic switch trigger or high-g collision event are preserved for a minimum of 3 years to assist statutory accident investigations.
• Account Records: Corporate invoicing, tax records, and admin logs are retained for seven (7) years to comply with the Indian Companies Act and Goods and Services Tax (GST) audit mandates.

Security is embedded across every layer of the Exxomatic hardware and cloud architecture:

Our infrastructure undergoes regular independent vulnerability assessment and penetration testing (VAPT) and is maintained under ISO 27001 information security practices.

The Exxomatic web portals utilize essential and functional cookies strictly required for security, tenant session authentication, and load balancing. We do not deploy third-party advertising tracking cookies or social media pixel trackers.

Users can configure their browser settings to decline cookies; however, disabling essential session tokens will prevent authenticated access to the NavEdge 2.0 command center.

To provide scalable, 99.98% resilient edge processing, Exxomatic engages vetted enterprise sub-processors under rigorous Data Protection Agreements (DPAs):

• Cloud Infrastructure Providers: AWS India (Mumbai/Hyderabad) & Microsoft Azure (Central India) – High-throughput ingestion, Kubernetes clusters, and encrypted storage.
• M2M Telecom Carriers: Airtel IoT, Vodafone Idea Business, and Tata Communications – Dedicated secure APN pipelines for SIM connectivity.
• Map Tile & Reverse Geocoding Services: Enterprise MapMyIndia (Mappls) and OpenStreetMap servers deployed on private dedicated compute nodes.

Under the DPDP Act 2023 and applicable privacy statutes, data subjects and corporate administrators possess verifiable rights:

• Right to Summary of Personal Data: Right to obtain a clear summary of personal data being processed and third parties with whom data has been shared.
• Right to Correction & Erasure: Right to rectify inaccurate corporate contact profiles or delete obsolete user privileges.
• Right of Grievance Redressal: Right to register grievances with our Data Protection Officer with guaranteed resolution within 15 working days.
• Right to Nominate: Right to designate an authorized individual to exercise privacy rights in the event of death or incapacity.

For questions regarding this policy, requests to exercise your data rights, or escalation of compliance matters, contact our designated Grievance Redressal Officer & DPO: