Data Processing Addendum (Cab & Ride Operators)

1. Roles

The Operator is the Data Fiduciary of its riders' and drivers' personal data. Ironbay Innovations Pvt Ltd (“10mins”) is a Data Processor and processes the data only to provide the software, on the Operator's documented instructions, which are the operator's use of the product.

2. What is processed

• Riders: name, phone, email, trip history, pickup/drop and live location during trips, payment references, ratings, complaints, saved documents (licence, selfie) for rentals.
• Drivers: name, phone, photo, vehicle and licence details, identity and compliance documents, live location while online, earnings and settlement records.
• Safety: SOS events, incident reports.

3. 10mins' commitments

• Process only for providing the service; no sale of data, no use for advertising.
• Staff with access are bound by confidentiality. Access to tenant data is limited to what support or the law needs.
• Appropriate security: encryption in transit, access control, logging, separation between tenants.
• Sub-processors are listed at /subprocessors; 10mins will update the list before adding or replacing one, and is responsible for them.
• Help the Operator answer a data principal's request (export and delete tools are in the admin panel and the apps).
• Tell the Operator without undue delay after becoming aware of a personal-data breach so that it can notify the Data Protection Board and affected people.
• On the Operator leaving, return or delete the data after export, except what the law requires to keep.

4. Operator's commitments

• Have a lawful basis and notice for collecting each category of data, including location.
• Set and follow a retention schedule. The default location retention is 90 days.
• Respond to requests and to the Data Protection Board.

5. Transfers

Data is stored on cloud servers that may be outside India; 10mins uses providers that apply appropriate safeguards and will not transfer to a country the Government has restricted.