1. Who we are and what this covers

iotoms provides a distribution management platform for van sales and wholesale distribution. This policy explains how we handle personal data.

It covers the marketing website at iotoms.com, the web console at console.iotoms.com, the iotoms field application, and the support and sales conversations that go with them.

It does not cover other companies’ websites we link to. When you click through to a booking page, a messaging service or any other third-party site, that company’s own privacy policy applies to what happens there.

2. Two different situations

Our responsibilities depend on whose data it is, and the distinction matters for the rights you can exercise and who you exercise them against.

When you visit our website, or talk to us about buying the product, we decide why and how your personal data is processed. In data protection language we are the controller — the Data Fiduciary under the Digital Personal Data Protection Act, 2023 — and this policy governs.
When our customer — a distributor — runs their business in a Workspace, the data inside it about their own customers, drivers and staff belongs to them. They decide why and how it is processed; we process it on their instructions. We are the processor (the Data Processor), and their privacy policy governs, not ours.

If you are a customer, driver or store contact of a business that uses iotoms and you want to see, correct or delete your data, contact that business directly — they control it. If you reach us instead, we will pass your request to them and help them answer it, but we cannot act on their data without their instruction.

3. What we collect when you visit the website

The website is deliberately light. There are no forms on it, no newsletter sign-up, no chat widget, no advertising pixels and no analytics or marketing trackers.

Your cookie choice — stored in one cookie so the banner does not ask again. Nothing else is stored in it.
Standard server logs kept by our hosting provider, which include your IP address, browser and device type, the pages requested and the time of the request. These are used to serve the site, keep it secure, and diagnose faults.
A request to our video content delivery network when the homepage background video loads, which necessarily discloses your IP address and browser to that provider so it can send you the file.

We do not build profiles of website visitors, and we do not try to identify you from this information.

4. Cookies and similar technologies

We currently set one cookie: iotoms-consent, which records whether you chose “Accept all” or “Essential only”. It lasts 180 days and is strictly necessary to respect your choice. You can change the choice at any time through “Cookie settings” in the footer, or by clearing it in your browser.

The consent banner mentions analytics cookies. As of the date at the top of this page none are in use — no analytics product is loaded on this site. If we introduce one, it will load only after you choose “Accept all”, choosing “Essential only” will keep it switched off, and this policy will be updated before it goes live.

We do not use advertising cookies, cross-site tracking, fingerprinting or social media pixels, and we do not sell or share data for advertising.

Signing in to the console sets session cookies that are strictly necessary to keep you authenticated. These are not optional; without them the console cannot know who you are.

5. What we collect when you use the platform

When your business subscribes and we create a Workspace, we process the following.

Account and contact details for the people who administer the Workspace — name, work email, phone number and role.
Billing information — the details needed to invoice you and record payment. Card details, where cards are used, are handled by the payment provider and are not stored by us.
User accounts for the people you authorise, including drivers using the field application, and the access rights you assign them.
Usage and security logs — sign-ins, IP addresses, device and application version, and a record of significant actions taken in the Workspace. These exist so that access can be audited, faults diagnosed and misuse detected.
Support correspondence — the emails, messages and call notes exchanged when you ask us for help, including anything you choose to attach.
Workspace content, which is your Customer Data. It may contain personal data about your own customers and staff — names, store addresses, phone numbers, order and payment histories. We process this only on your instructions, as described above.

The field application collects location data only where you have enabled route or visit tracking for your own operations. That is a setting your business controls, the data belongs to your Workspace, and we do not use it for any purpose of our own.

6. Why we process personal data

We process personal data for these purposes, and no others without telling you first.

To provide the Service — creating and running your Workspace, authenticating users, syncing the field application, and delivering the features of your Plan. Legal basis: performance of a contract with you.
To bill you and keep accounting records. Legal basis: performance of a contract, and compliance with tax and accounting law.
To provide support and respond to your questions. Legal basis: performance of a contract, or our legitimate interest in helping people who contact us.
To keep the Service secure and available — detecting abuse, investigating incidents, preventing fraud. Legal basis: our legitimate interest in protecting the Service and its users, and compliance with law.
To improve the Service, using aggregated and de-identified information about how it is used. Legal basis: our legitimate interest in developing our product.
To send you service messages about outages, security, billing and changes to terms. These are not marketing and you cannot opt out of them while you hold an account. Legal basis: performance of a contract.
To send occasional product news to business contacts who have asked for it. Legal basis: consent, which you can withdraw at any time.
To comply with the law and to establish, exercise or defend legal claims. Legal basis: legal obligation, and our legitimate interest in defending ourselves.

Under the Digital Personal Data Protection Act, 2023, where we rely on your consent we ask for it clearly and you may withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect processing already carried out, and does not affect processing that rests on another lawful ground such as performing our contract with you.

7. Who we share data with

We do not sell personal data. We do not share it with third parties for their own marketing. We share it only in the following circumstances.

Service providers who help us run the platform — cloud hosting and infrastructure, content delivery, email delivery, payment processing and customer support tooling. They act on our instructions under contract, may use the data only to provide their service to us, and must protect it to a standard consistent with this policy. A current list is available on request from info@iotoms.com.
Integrations you switch on. If you connect an accounting suite, payment gateway, messaging service or other product, data flows to it because you instructed it to. What that provider then does is governed by its own terms.
Professional advisers — lawyers, accountants and auditors — bound by duties of confidence, where they need the information to advise us.
Authorities, where we are required by law, a court order or a valid legal request to disclose information. We satisfy ourselves that a request is lawful and, unless legally prohibited, we tell the affected customer before disclosing.
A buyer or successor, if the business is merged, acquired or reorganised. Personal data may transfer as part of that transaction, and it stays subject to this policy until the recipient publishes its own with at least equivalent protection and gives notice.

8. Where data is processed

We and our service providers may process personal data in India and in other countries, including through content delivery networks that serve files from the location nearest to the visitor.

Where personal data protected by the General Data Protection Regulation leaves the European Economic Area, we rely on a lawful transfer mechanism — normally the European Commission’s standard contractual clauses — together with the technical and organisational measures described below. Where the Indian government restricts transfers of personal data to a particular country under the Digital Personal Data Protection Act, 2023, we comply with that restriction.

You can ask us for details of the transfer safeguards that apply to your data by writing to info@iotoms.com.

9. How long we keep data

Workspace data — kept while your subscription is active, then for ninety (90) days after termination so you can reactivate or export it, after which it may be permanently deleted. This matches the commitment in our Terms of Service.
Account and billing records — kept for as long as tax and company law requires us to retain them, which is generally several years after the relationship ends.
Support correspondence — kept for up to three years, so we have the history behind a recurring problem.
Security and access logs — kept for up to twelve months, unless a longer period is needed to investigate a specific incident.
Website server logs — kept for a short period only, in line with our hosting provider’s standard retention.
Your cookie choice — 180 days, then the banner asks again.

When a retention period ends we delete the data or irreversibly de-identify it. Copies may persist briefly in routine backups, which are cycled out in the ordinary course and remain protected until they are.

10. How we protect data

We apply technical and organisational measures appropriate to the risk: encryption in transit, access control on a need-to-know basis with individual accounts, tenant separation between Workspaces, logging of significant actions, and regular patching of the systems we run.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach affects you, we will notify you and the relevant authority as and when the law requires, without undue delay, and tell you what happened and what we are doing about it.

If you believe you have found a security vulnerability, please report it to support@iotoms.com rather than disclosing it publicly, and give us a reasonable opportunity to fix it.

11. Your rights

Depending on where you are and which law applies, you have some or all of the following rights over your personal data.

Access — to be told whether we process your data and to obtain a copy of it, together with a summary of the processing.
Correction — to have inaccurate data corrected and incomplete data completed.
Erasure — to have data deleted where it is no longer needed for the purpose it was collected for, or where you withdraw the consent it rested on and there is no other lawful ground.
Withdrawal of consent — at any time, where processing rests on consent, and as easily as it was given.
Portability — to receive data you gave us in a structured, machine-readable format, and to have it sent to another provider where technically feasible. (GDPR)
Objection and restriction — to object to processing based on legitimate interests, and to ask us to restrict processing while a dispute about it is resolved. (GDPR)
Nomination — to nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. (Digital Personal Data Protection Act, 2023)
Grievance redressal — to complain to us about how we have handled your data, and to escalate if our answer does not satisfy you.

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

12. How to exercise your rights, and how to complain

Write to info@iotoms.com with enough detail for us to find your data and understand what you are asking for. We may need to verify your identity before acting, to be sure we are not disclosing someone’s data to the wrong person.

We answer rights requests within thirty (30) days. If a request is genuinely complex and we need longer, we will tell you inside that period, explain why, and give you a date.

Grievances about how we have handled your personal data go to the same address, marked for the attention of the Grievance Officer, and are answered within thirty (30) days.

If our answer does not resolve the matter, you can escalate. In India, to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023. In the European Economic Area or the United Kingdom, to your local supervisory authority. We would rather hear from you first and put it right.

13. Children

The Service is a business tool. It is not directed at children and we do not knowingly collect personal data from them.

Under the Digital Personal Data Protection Act, 2023 a child is anyone under 18. We do not knowingly process a child’s personal data without verifiable parental consent, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children in any circumstances.

If you believe a child’s data has reached us, write to info@iotoms.com and we will delete it.

14. Changes to this policy

We update this policy when our practices or the law change. The date at the top of the page always shows the current version.

Where a change materially affects how we handle your personal data, we will give notice by email or in the console before it takes effect, rather than relying on you to notice the new date.

15. Contact

For privacy questions, rights requests and grievances: info@iotoms.com.

For help using the Service: support@iotoms.com, or the channels at iotoms.com/support. You can also reach us on +91 75920 60120.