PRIVACY POLICY

DRAFT FOR LEGAL REVIEW BEFORE PUBLICATION

1. INTRODUCTION

Vahanfin Solutions Private Limited, operating the “Vahanse” platform and brand (“Vahanse”, “Company”, “we”, “us” or “our”), respects the privacy of individuals and businesses that interact with us and is committed to handling Personal Data responsibly, securely and transparently.

Vahanse provides technology infrastructure and services relating to vehicle compliance, vehicle information, fleet compliance management, challan management, renewal monitoring, vehicle-document workflows, APIs, enterprise integrations, white-label solutions, Compliance Gate and associated vehicle-related services.

This Privacy Policy (“Policy”) describes how we collect, receive, access, use, store, process, disclose, transfer, retain and protect Personal Data when you:

• visit [www.vahanse.com](http://www.vahanse.com);
• register for or use a Vahanse account;
• use a Vahanse dashboard, portal or application;
• use a Vahanse white-label platform;
• access Vahanse APIs or embedded services;
• interact with Vahanse Enterprise;
• use vehicle compliance or related services;
• submit vehicle or customer information;
• make payments or place service requests;
• interact with our sales, customer support, operations or partner teams;
• or otherwise interact with Vahanse.

Please read this Policy carefully.

By accessing or using Vahanse, you acknowledge that you have read this Policy.

Where consent is required under applicable law for any particular processing activity, Vahanse will seek such consent separately or through an appropriate notice or mechanism.

2. COMPANY INFORMATION

The Vahanse platform is operated by:

Vahanfin Solutions Private Limited

Corporate Office

Vahanfin Solutions Pvt. Ltd.

Nabibux House, 3rd Floor

Vakola Bridge Road, Santacruz (East)

Mumbai – 400055

Maharashtra, India

Contact

Email: contact@vahanse.com

Website

[www.vahanse.com](http://www.vahanse.com)

Additional statutory information, registered-office details, CIN, GSTIN and designated grievance/privacy contacts may be displayed on the Website or applicable legal notices after verification and approval.

3. PURPOSE OF THIS POLICY

The purpose of this Policy is to explain:

• what Personal Data Vahanse processes;
• how Personal Data is collected;
• why it is processed;
• with whom it may be shared;
• how long it may be retained;
• how we secure Personal Data;
• rights available to individuals under applicable law;
• how businesses using Vahanse should handle customer data;
• how APIs and white-label environments process data;
• and how privacy-related questions or grievances may be submitted.

4. SCOPE

This Policy applies to Personal Data processed by Vahanse in connection with:

4.1 Vahanse Website

Including:

• web forms;
• enquiries;
• demo requests;
• contact forms;
• cookies;
• analytics;
• marketing communications;
• website interactions.

4.2 Vahanse Platform

Including:

• user accounts;
• dashboards;
• companies;
• fleets;
• vehicles;
• employees;
• partners;
• customers;
• service requests;
• payments;
• orders;
• documents;
• compliance records.

4.3 Vahanse Enterprise

Including information processed for:

• fleet compliance;
• portfolio monitoring;
• branch/company hierarchy;
• role-based access;
• alerts;
• service execution;
• MIS;
• reconciliation.

4.4 Vahanse White Label

Where Vahanse infrastructure is used by another business under that business's brand or domain.

4.5 Vahanse API + Embed

Where Vahanse functionality or information is integrated into another organisation's application, ERP, fleet system, GPS platform, dealer system, insurance platform, lending platform, marketplace or other technology environment.

4.6 Compliance Gate

Where available vehicle-related information and customer-defined rules are used to generate configurable compliance indicators or workflow decisions.

5. OUR ROLE WHEN PROCESSING DATA

Depending on the service and circumstances, Vahanse may process Personal Data in different capacities.

5.1 Where Vahanse Determines the Purpose

Where Vahanse directly collects Personal Data for purposes such as:

• account registration;
• sales;
• marketing;
• billing;
• customer support;
• fraud prevention;
• security;
• service administration;
• legal compliance;

Vahanse may determine the purpose and means of such processing subject to applicable law.

5.2 Where Vahanse Processes Data for a Business Customer

For Enterprise, API, White Label or integrated customers, Vahanse may process Personal Data on instructions from the applicable business customer.

Examples may include:

• fleet-vehicle information;
• driver/contact information;
• customer records;
• vehicle documents;
• renewal information;
• service requests;
• challan-related information;
• transaction information.

In such circumstances, the applicable business customer may be responsible for determining the purpose for which Personal Data is processed and for obtaining any required permissions, notices, consents or other lawful basis.

Specific roles and responsibilities may additionally be governed by:

• Enterprise MSA;
• Data Processing Agreement;
• API Agreement;
• White-Label Agreement;
• Partner Agreement;
• Statement of Work;
• or other contractual terms.

6. INFORMATION WE MAY COLLECT

The Personal Data collected or processed will depend upon the user's relationship with Vahanse and the services used.

6.1 Identification and Contact Information

We may process:

• full name;
• business name;
• company name;
• email address;
• mobile number;
• designation;
• department;
• business address;
• communication preferences.

6.2 Account Information

We may process:

• username;
• login identifier;
• encrypted/hashed authentication information;
• user role;
• company;
• branch;
• assigned permissions;
• authentication activity;
• account preferences;
• notification preferences.

Vahanse does not intend to store passwords in readable plain-text form.

7. VEHICLE INFORMATION

Because Vahanse is a vehicle-compliance infrastructure platform, vehicle information forms an important part of our services.

Depending on the service and legally permitted source, we may process information associated with a vehicle, including:

• vehicle registration number;
• registration details;
• vehicle class;
• vehicle category;
• chassis information where permitted;
• engine-related information where permitted;
• manufacturer/model;
• registration validity;
• fitness validity;
• insurance information;
• permit information;
• national permit information;
• PUC information;
• road-tax information;
• hypothecation information;
• blacklist or compliance indicators;
• challan information;
• court or virtual-court status where available;
• ownership-related information where lawfully available;
• service history within Vahanse;
• compliance status;
• document expiry information.

Availability and accuracy of information may vary depending on the underlying data source.

8. VEHICLE OWNER AND DRIVER INFORMATION

Where required for an authorised service or supplied by an authorised customer, Vahanse may process:

• vehicle-owner name;
• driver name;
• telephone number;
• address;
• relationship with vehicle;
• company/fleet affiliation;
• identification information;
• service-related supporting documents.

Vahanse does not independently require every category of such information for every service.

Only information reasonably necessary for the relevant purpose should be submitted.

9. DOCUMENTS

Users, customers, partners or authorised representatives may upload documents in connection with services, including where applicable:

• Registration Certificate;
• Insurance Certificate;
• Fitness Certificate;
• Permit;
• National Permit;
• Pollution Under Control certificate;
• tax documentation;
• NOC;
• authorisation letter;
• invoice;
• challan;
• court document;
• payment receipt;
• vehicle-sale document;
• ownership-transfer documentation;
• KYC-related documents where required for an authorised transaction;
• other supporting documents.

Documents may contain Personal Data.

Users should only submit documents that they are legally authorised to provide.

10. CHALLAN AND COMPLIANCE INFORMATION

Vahanse may process information concerning:

• challan number;
• vehicle registration;
• issuing authority;
• offence;
• date;
• location where available;
• fine amount;
• payment status;
• court status;
• virtual-court status;
• settlement/payment information;
• receipt;
• service status;
• supporting documents.

Vahanse may also process compliance-related alerts such as:

• insurance expiry;
• fitness expiry;
• permit expiry;
• PUC expiry;
• tax due;
• RC-related status;
• challan-related status;
• document expiry.

11. TRANSACTION AND PAYMENT INFORMATION

For paid services, we may process:

• order number;
• transaction ID;
• amount;
• taxes;
• service charges;
• government fees;
• vendor/service-provider charges;
• payment status;
• refund status;
• invoice;
• receipt;
• settlement information.

Payment-card, banking or UPI credentials may be processed by authorised payment-gateway providers.

Vahanse generally does not need to store complete card credentials.

Payment processing may be subject to the privacy and security policies of the applicable payment service provider.

12. BUSINESS AND ENTERPRISE INFORMATION

For B2B and Enterprise users, we may process:

• legal entity name;
• business name;
• GST information;
• corporate address;
• authorised representatives;
• business contact details;
• fleet size;
• branch information;
• department information;
• ERP/TMS/API configuration;
• employee accounts;
• commercial arrangements;
• invoices;
• service usage;
• support information.

13. PARTNER AND VENDOR INFORMATION

For partners, vendors and service providers, we may process:

• business information;
• proprietor/director information where required;
• KYC information;
• GST/PAN and tax information;
• banking information;
• service geography;
• service categories;
• pricing;
• settlement details;
• performance information;
• SLA information;
• customer/service assignment history;
• complaints or quality-control information.

14. API INFORMATION

When customers use Vahanse APIs, we may process:

• customer account identifier;
• API credential identifier;
• source IP;
• timestamp;
• endpoint accessed;
• request metadata;
• response status;
• error logs;
• usage volume;
• webhook activity;
• rate-limit information;
• security events.

Sensitive credentials should not be transmitted to unauthorised persons.

15. TECHNICAL AND DEVICE INFORMATION

When users interact with our Website or services, we may automatically collect:

• IP address;
• browser type;
• operating system;
• device type;
• session identifiers;
• pages viewed;
• date/time;
• referring URL;
• approximate location derived from IP where applicable;
• application logs;
• security logs;
• crash/error logs;
• usage patterns.

This information may be used for:

• platform operation;
• security;
• troubleshooting;
• analytics;
• fraud prevention;
• performance improvement.

16. METHODS OF COLLECTION

Vahanse may receive Personal Data:

16.1 Directly from You

For example when you:

• register;
• request a demo;
• create an account;
• contact support;
• submit a service request;
• upload documents;
• enter into an agreement;
• make a payment.

16.2 From Your Employer or Business

Where a company registers its employees, vehicles, customers or authorised representatives.

16.3 Through Enterprise Integrations

Such as:

• APIs;
• ERP integrations;
• fleet systems;
• GPS/telematics platforms;
• dealer systems;
• insurance platforms.

16.4 Through Partners

Including authorised:

• white-label partners;
• channel partners;
• vendors;
• service providers.

16.5 Through Authorised External Sources

Where permitted, vehicle/compliance information may be obtained from:

• authorised data providers;
• third-party APIs;
• government or statutory systems;
• official/public sources;
• service partners.

16.6 Automatically

Through:

• cookies;
• analytics;
• logs;
• security tools;
• API telemetry;
• technical monitoring.

17. WHY WE PROCESS INFORMATION

We may process information to:

17.1 Provide the Platform

Including:

• create accounts;
• authenticate users;
• maintain dashboards;
• manage vehicles;
• provide APIs;
• enable white-label services.

17.2 Provide Vehicle Compliance Services

Including:

• monitor compliance;
• display available vehicle information;
• detect expiry;
• provide notifications;
• track challans;
• support renewal workflows.

17.3 Fulfil Service Requests

Including:

• verify requirements;
• allocate work;
• coordinate service providers;
• process payments;
• track progress;
• obtain supporting documents;
• provide completion evidence.

17.4 Enterprise Operations

Including:

• fleet dashboards;
• hierarchy;
• roles;
• MIS;
• reporting;
• reconciliation;
• audit history.

17.5 Communications

Including:

• transactional alerts;
• renewal reminders;
• security notices;
• service notifications;
• support messages.

17.6 Improve Services

Including:

• troubleshooting;
• analytics;
• platform improvement;
• product development;
• performance optimisation.

17.7 Security and Fraud Prevention

Including:

• authentication;
• access monitoring;
• suspicious-activity detection;
• abuse prevention;
• audit trails.

17.8 Compliance

Including:

• statutory obligations;
• tax records;
• accounting;
• lawful requests;
• dispute resolution;
• enforcement of contracts.

18. AUTOMATED PROCESSING AND COMPLIANCE DECISIONING

Certain Vahanse products may use software rules or automated logic to:

• identify expired documents;
• identify approaching expiry;
• classify compliance status;
• generate alerts;
• prioritise tasks;
• determine whether configured conditions are satisfied;
• generate a compliance score or indicator;
• trigger workflows.

For example, Vahanse Compliance Gate may evaluate available information against customer-defined rules.

Such outputs:

• depend on the availability and accuracy of underlying information;
• may require human review;
• should not automatically be treated as a final legal determination unless specifically confirmed by a competent authority.

19. HOW WE SHARE INFORMATION

Vahanse does not sell Personal Data to advertisers.

We may share information only where reasonably necessary for legitimate business, contractual or legal purposes.

19.1 Employees and Authorised Personnel

Information may be accessible to authorised:

• employees;
• operations teams;
• customer-support personnel;
• finance personnel;
• engineering/security personnel;

on a need-to-know basis.

19.2 Business Customers

Where Vahanse processes information for an enterprise, white-label or API customer, relevant information may be provided to that customer in accordance with the service arrangement.

19.3 Service Providers and Vendors

Information may be shared where necessary with authorised service providers assisting with:

• technology infrastructure;
• hosting;
• communications;
• payments;
• analytics;
• support;
• document processing;
• RTO-related services;
• challan-related services;
• vehicle-compliance services.

Only information reasonably necessary for the service should be shared.

19.4 Government Authorities and External Systems

Where necessary for an authorised transaction or required by law, information may be transmitted to or obtained from:

• government systems;
• RTOs;
• courts;
• virtual courts;
• statutory authorities;
• law-enforcement authorities;
• other competent authorities.

19.5 Payment Providers

Payment information may be shared with:

• payment gateways;
• banks;
• payment processors;
• financial institutions;

for transaction processing, settlement, fraud prevention and refunds.

19.6 Professional Advisors

Information may be disclosed where appropriate to:

• lawyers;
• auditors;
• accountants;
• consultants;

under appropriate professional/confidentiality obligations.

19.7 Corporate Transactions

If Vahanse or Vahanfin Solutions Private Limited undergoes:

• merger;
• acquisition;
• restructuring;
• investment;
• sale;
• transfer of business or assets;

relevant information may be disclosed or transferred subject to applicable law.

19.8 Legal Requirements

We may disclose Personal Data when reasonably necessary to:

• comply with applicable law;
• respond to legal process;
• comply with court or authority orders;
• protect rights or property;
• investigate fraud or security incidents;
• establish, exercise or defend legal claims.

20. INTERNATIONAL AND CROSS-BORDER PROCESSING

Some technology or service providers may process information outside the state or country in which the user is located.

Where cross-border processing occurs, Vahanse will seek to handle such processing in accordance with applicable contractual and legal requirements, including any restrictions prescribed under applicable Indian data-protection law.

21. DATA RETENTION

Vahanse seeks to retain Personal Data only for as long as reasonably necessary for:

• providing services;
• fulfilling contracts;
• maintaining account history;
• supporting transactions;
• customer support;
• audit;
• fraud prevention;
• accounting;
• taxation;
• regulatory requirements;
• litigation;
• establishing or defending legal rights.

Retention periods may vary by data type.

Examples include:

Account Data

For the duration of the account and a reasonable period thereafter as required for legal or operational purposes.

Transaction Records

May be retained for applicable statutory accounting, taxation, audit and dispute periods.

Vehicle Compliance History

May be retained where necessary to provide historical monitoring, enterprise reporting, audit trails or customer services.

Documents

Retained based on service requirements, contractual commitments and applicable law.

Security Logs

May be retained for security monitoring, investigation and audit purposes.

When Personal Data is no longer required, Vahanse may:

• securely delete it;
• anonymise it;
• aggregate it;
• or otherwise render it non-identifiable,

subject to applicable law.

22. ANONYMISED AND AGGREGATED INFORMATION

Vahanse may generate statistical, aggregated or anonymised information from platform usage or vehicle-compliance activities.

Where such information no longer identifies an individual, it may be used for:

• analytics;
• service improvement;
• operational benchmarking;
• business intelligence;
• research;
• fraud/risk analysis;
• product development.

Vahanse will seek to ensure that anonymised information is not represented as identifiable Personal Data.

23. SECURITY PRACTICES

Vahanse takes reasonable technical, organisational and administrative measures designed to protect information from:

• unauthorised access;
• misuse;
• loss;
• alteration;
• accidental disclosure;
• destruction.

Depending on the system and applicable implementation, security controls may include:

• encrypted network communications;
• authentication;
• role-based access control;
• access logging;
• password protection;
• secure credential management;
• database/access restrictions;
• backup and recovery controls;
• infrastructure monitoring;
• vulnerability management;
• security logging;
• employee access restrictions.

No internet-connected system can be guaranteed to be completely secure.

Users are responsible for protecting:

• passwords;
• OTPs;
• API keys;
• tokens;
• devices;
• account credentials.

Vahanse will never intentionally request that a user publicly disclose an account password or secret API key.

24. BUSINESS CUSTOMER RESPONSIBILITIES

Enterprise, API, White Label and other business customers are responsible for ensuring that information supplied to Vahanse is provided lawfully.

Business customers should:

• have authority to submit vehicle/customer information;
• provide legally required notices;
• obtain consent where required;
• restrict access to authorised users;
• protect API credentials;
• configure user permissions appropriately;
• avoid unnecessary collection of Personal Data;
• honour applicable rights of individuals.

Where Vahanse acts on documented instructions of a business customer, privacy enquiries concerning the underlying business/customer relationship may need to be directed to that business customer.

25. WHITE-LABEL SERVICES

Certain Vahanse services may appear under another business's branding or domain.

In a white-label relationship:

• the partner may own and manage its customer relationship;
• Vahanse may provide underlying technology and workflow infrastructure;
• the partner and Vahanse may each have different responsibilities for Personal Data.

Users should review the applicable partner's privacy notice as well as relevant Vahanse notices where provided.

26. API CUSTOMERS

Businesses integrating Vahanse APIs must:

• use information only for authorised purposes;
• maintain appropriate access controls;
• protect credentials;
• avoid unauthorised resale or disclosure of Personal Data;
• comply with applicable law;
• follow applicable Vahanse API Terms and contracts.

Vahanse may maintain API logs for:

• security;
• billing;
• support;
• abuse prevention;
• auditing.

27. MARKETING COMMUNICATIONS

Where legally permitted, Vahanse may send:

• newsletters;
• product information;
• offers;
• service updates;
• event communications;
• business-development communications.

Users may opt out of marketing communication using available unsubscribe mechanisms or by contacting:

[contact@vahanse.com](mailto:contact@vahanse.com)

Transactional, security, account or service-related communications may still be sent where necessary.

28. COOKIES AND SIMILAR TECHNOLOGIES

Vahanse may use cookies or similar technologies to:

• maintain sessions;
• authenticate users;
• remember preferences;
• improve performance;
• understand website usage;
• detect security issues;
• perform analytics.

Cookies may include:

Essential Cookies

Required to operate the Website or platform.

Functional Cookies

Used to remember settings or preferences.

Analytics Cookies

Used to understand usage and improve the Website.

Marketing Cookies

Used only where applicable and permitted.

Users may manage cookies using browser or consent settings.

Disabling certain cookies may affect platform functionality.

Please refer to the separate Vahanse Cookie Policy where available.

29. THIRD-PARTY LINKS

The Website or platform may contain links to third-party:

• government websites;
• payment gateways;
• partner platforms;
• external services.

Vahanse does not control third-party privacy practices.

Users should review the applicable third-party privacy policy before submitting Personal Data to such services.

30. PERSONAL DATA RIGHTS

Depending on applicable law and the nature of Vahanse's processing role, individuals may have rights relating to their Personal Data.

These may include rights to:

• obtain information regarding processing;
• access information;
• request correction;
• request updating;
• request completion;
• request erasure where applicable;
• withdraw consent where processing depends upon consent;
• raise grievances;
• nominate another individual where legally provided;
• exercise other rights available under applicable law.

Some requests may be restricted where information must be retained because of:

• legal requirements;
• contractual obligations;
• fraud prevention;
• accounting;
• transaction records;
• disputes;
• legal claims;
• another individual's rights;
• customer instructions where Vahanse acts as processor/service provider.

31. EXERCISING YOUR PRIVACY RIGHTS

To submit a privacy request, contact:

[contact@vahanse.com](mailto:contact@vahanse.com)

Please include sufficient details for Vahanse to understand and verify the request.

We may request reasonable information to authenticate the requester before:

• providing;
• correcting;
• deleting;
• or otherwise modifying

Personal Data.

Where the information is processed on behalf of an Enterprise, White Label or API customer, Vahanse may redirect or coordinate the request with that customer.

32. CHILDREN'S PRIVACY

Vahanse's business and vehicle-compliance services are primarily intended for adults and organisations.

Vahanse does not knowingly intend to provide accounts to children below 18 years of age unless an applicable service and lawful mechanism expressly permits such processing.

If we become aware that Personal Data of a child has been collected contrary to applicable requirements, we will take appropriate steps.

33. DATA BREACH AND SECURITY INCIDENTS

Vahanse maintains processes intended to identify, investigate and respond to data-security incidents.

Where notification is required under applicable law or contract, Vahanse will seek to notify:

• affected business customers;
• individuals;
• competent authorities;

as applicable.

Enterprise customers may have additional incident-notification provisions under their DPA, MSA or Security Annexure.

34. GOVERNMENT AND EXTERNAL DATA SOURCES

Vahanse may rely upon information obtained from external systems.

Vahanse does not control all such sources.

Accordingly:

• information may be delayed;
• data may change;
• availability may be interrupted;
• records may contain errors;
• an authority may subsequently update information.

Users should obtain official confirmation from the relevant authority where legally required.

Vahanse's display of vehicle or compliance information should not, by itself, be treated as Vahanse issuing an official government record.

35. DATA ACCURACY

Users and business customers should ensure that information supplied directly to Vahanse is:

• accurate;
• current;
• complete;
• authorised.

Where incorrect information is identified, users should update the information where functionality permits or contact Vahanse.

36. LEGAL AND REGULATORY FRAMEWORK

Vahanse intends to handle Personal Data in accordance with applicable Indian law, which may include, to the extent applicable and in force from time to time:

• the Information Technology Act, 2000;
• applicable rules framed thereunder;
• the Digital Personal Data Protection Act, 2023;
• the Digital Personal Data Protection Rules, 2025;
• and other applicable laws, regulations, directions and contractual requirements.

Where provisions have staggered commencement dates, Vahanse will seek to update its privacy framework as applicable provisions come into force.

37. GRIEVANCE REDRESSAL

For any questions, concerns or grievances regarding privacy or Personal Data, contact:

Privacy / Grievance Contact

Vahanfin Solutions Private Limited

Vahanse

Corporate Office:

Nabibux House, 3rd Floor

Vakola Bridge Road, Santacruz (East)

Mumbai – 400055

Maharashtra, India

Email: contact@vahanse.com

A specifically designated Grievance Officer name, telephone number and privacy-specific email address may be published here after formal appointment and internal approval.

Vahanse will seek to respond to privacy grievances within the period required by applicable law or contract.

38. DATA PROTECTION OFFICER

Where Vahanse is legally required to appoint a Data Protection Officer or voluntarily appoints one, the applicable person's contact information will be published on this page.

Until such appointment is formally confirmed, privacy enquiries should be directed to:

[contact@vahanse.com](mailto:contact@vahanse.com)

Vahanse should not publicly describe any person as a statutory Data Protection Officer unless the appointment and applicable legal requirement have been formally confirmed.

39. CHANGES TO THIS POLICY

Vahanse may update this Privacy Policy periodically to reflect:

• changes in law;
• regulatory guidance;
• technology;
• products;
• services;
• business operations;
• security practices.

The updated version will display its latest effective or updated date.

Material changes may additionally be notified through:

• the Website;
• email;
• dashboard notice;
• other appropriate communication.

Users should periodically review this Policy.

40. CONTACT US

For questions regarding this Privacy Policy:

Vahanfin Solutions Private Limited

Vahanse – Vehicle Compliance Infrastructure

Corporate Office

Nabibux House, 3rd Floor

Vakola Bridge Road, Santacruz (East)

Mumbai – 400055

Maharashtra, India

Email: contact@vahanse.com

Website: www.vahanse.com

IMPORTANT LEGAL NOTICE

This document should be reviewed by Vahanfin Solutions Private Limited's Indian technology/privacy counsel before publication.

In particular, counsel should confirm:

• legal entity and registered-office details;
• CIN and GSTIN;
• Grievance Officer;
• whether a statutory DPO is required;
• actual subprocessors;
• actual hosting/data locations;
• actual retention periods;
• actual cookie inventory;
• payment-gateway providers;
• third-party data providers;
• security controls;
• business/customer roles under the DPDP framework;
• current commencement status of applicable provisions of the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025.

END OF DOCUMENT