CarryKo Logo

Privacy Policy

Last updated: October 2, 2026 | Compliant with the Digital Personal Data Protection Act, 2023 (DPDPA)

1. Introduction & Legal Framework

CarryKo Logistics Private Limited ("CarryKo", "Company", "we", "us", or "our") is committed to handling digital personal data responsibly. This Privacy Policy details our data practices in full compliance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, and associated rules.

Under the DPDPA, CarryKo acts as a Data Fiduciary regarding personal data collected from customers and transport partners ("Data Principals") across our website, web platform, and mobile application (collectively, the "Platform").

2. Personal Data We Collect

2.1 Information Directly Provided by You

  • Customer Account & Booking Data: Full name, phone number, email address, pick-up and drop-off addresses, recipient details, and consignment descriptions.
  • Partner / Driver Data: Full name, verified mobile number, Aadhaar/driving licence details, vehicle registration (RC), vehicle permit, pollution and insurance certificates, bank account details for settlement payouts, and fleet business information.
  • Transaction & Payment Data: Transaction references, amount paid, and invoice details. Note that credit/debit card and net banking details are processed directly by our PCI-DSS-compliant payment gateway partner (Razorpay); CarryKo does not store your raw banking instruments.

2.2 Automatically Collected Data

  • Hardware & System Data: Device model, operating system, unique device identifiers, network state, and browser version.
  • Network Data: IP address, crash analytics, and timestamped API interactions.
  • Cookies: Session and authentication tokens necessary to maintain logged-in states securely.

2.3 Real-Time Location Data

With your explicit device-level authorization, CarryKo collects real-time geographic location coordinates (GPS) from drivers during active trips to provide live tracking, calculate precise route mileage, and ensure shipment safety. Customers provide point location details exclusively for pickup and delivery routing.

3. Lawful Grounds and Specific Purposes of Processing

Under Section 4 and Section 6 of the DPDPA, CarryKo processes personal data solely for specific, lawful purposes based on your explicit affirmative consent or legitimate uses:

  • Matching freight requirements with nearby verified transport partners.
  • Verifying partner identities and credentials against regulatory transport standards.
  • Generating GST invoices, electronic consignment notes, and transaction audits.
  • Issuing operational alerts, driver status updates, and OTPs via WhatsApp and SMS.
  • Resolving customer support disputes and handling safety claims during transit.
  • Complying with statutory reporting requirements enforced by Indian law enforcement.

4. Data Sharing & Data Processors

CarryKo does not sell, rent, or trade your personal data. We share only minimal required data with vetted Data Processors bound by strict confidentiality and security agreements:

  • Transport Drivers / Fleet Partners: Booking contact details and route points to complete goods delivery.
  • Payment Aggregator: Razorpay Software Private Limited for secure payment settlement.
  • Cloud & Infrastructure Services: Supabase and verified cloud hosts for encrypted data storage and API execution.
  • Statutory & Law Enforcement Authorities: When formally requisitioned under applicable Indian statutory provisions.

5. Cross-Border Data Transfers

Your personal data is predominantly hosted and processed on secure servers located within India. Any cross-border transmission to technical infrastructure providers is conducted in strict compliance with central government regulations issued under the DPDPA.

6. Data Retention & Erasure

We retain personal data strictly for the period necessary to satisfy the specific purpose of collection, or as mandated by applicable Indian financial, taxation, and carriage laws (typically 3 to 8 years for transport invoices and financial records). Once the retention threshold expires or upon a valid deletion request, your data is securely erased or irreversibly anonymized.

7. Data Principal Rights under DPDPA

Under Chapter III of the Digital Personal Data Protection Act, 2023, you have the following rights:

  • Right to Access Information: Request a summary of the personal data being processed and the identities of data fiduciaries or processors with whom it was shared.
  • Right to Correction & Erasure: Request the correction of inaccurate data, completion of incomplete entries, or erasure of personal data that is no longer required.
  • Right of Grievance Redressal: Avail yourself of a prompt, structured complaints mechanism provided by CarryKo.
  • Right to Nominate: Nominate an individual who shall, in the event of death or incapacity, exercise your data rights on your behalf.
  • Right to Withdraw Consent: Withdraw previously given consent at any time. Withdrawal does not affect the lawfulness of processing undertaken prior to the withdrawal.

8. Security Safeguards

In accordance with Section 8(5) of the DPDPA, CarryKo implements reasonable technical and organizational safeguards to prevent personal data breaches. Measures include TLS 1.3 encryption in transit, AES-256 database encryption at rest, strict role-based access management, and regular security audits.

9. Protection of Children

CarryKo does not knowingly collect personal data from individuals under 18 years of age. If we identify that personal data of a minor has been gathered without verifiable parental authorization, we will take steps to purge that data immediately.

10. Grievance Redressal Officer & DPB Escalation

In compliance with Section 8(10) of the DPDP Act, CarryKo has designated a Grievance Redressal Officer to resolve privacy queries within 30 days:

If you are not satisfied with the resolution provided by our Grievance Officer, you have the statutory right under the DPDPA to register an official complaint before the Data Protection Board of India (DPBI).