Privacy Policy
Last updated: September 2026
This Privacy Policy explains how Thoyz Transit Private Limited (“Thoyz”, “we”, “our” or “us”), registered office Row House No. 24, Ridhi-Sidhi Park, Viman Nagar, Pune 411014, Maharashtra, India, collects, uses, shares and protects personal data. It applies to this website and to the personal data we handle while providing our services. We follow the principles of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
1. The data we handle
- Enquiry data: the name, company, email, phone number and message you send us through the contact form.
- Passenger data: where a client engages us, the names, pickup addresses and contact details needed to plan and operate routes.
- Location data: live and historical trip location associated with a route and, where applicable, an individual passenger.
- Operational records: trip logs, timestamps and metering used for safety, reporting and billing.
- Website data: basic technical information collected when you visit the website, such as browser type and pages viewed, used to keep the site working and to understand usage.
2. How we use it
We use the data we hold to plan and operate the transport service, to run our safety controls, to produce reporting, and to raise and reconcile invoices. We use enquiry data only to respond to you. We do not sell personal data, and we do not use it for advertising or for any purpose unconnected with providing the service.
3. Our role, and the legal basis
Where a client employer engages us, we process passenger and location data as a data processor acting on that employer's instructions. The employer is the data controller and is responsible for the consent basis with its own employees. For enquiry data you send us directly, we act as the controller and rely on your consent and our legitimate interest in responding to you.
4. Employee location data
Location data deserves specific care, because it is sensitive and because we handle it on behalf of employers. We use it only to plan and operate routes, to run the women's-safety protocol, which includes sending a trip's live location to a named contact the client designates, and to produce the operational and billing records. Access inside Thoyz is limited to the operations and safety staff who need it for those purposes, and it is not shared for any unrelated use.
5. Who we share it with
We share personal data with:
- The client employer who engaged the service.
- The vetted vendors and drivers who operate the routes, limited to what they need to do so.
- Our service providers who help us run the platform, under confidentiality obligations.
- A lawful authority, only where we are legally required to disclose.
We do not otherwise share personal data with third parties.
6. Cookies and analytics
The website may use a small number of cookies and privacy-respecting analytics to keep the site working and to understand how it is used. We do not use them to build advertising profiles. You can control cookies through your browser settings.
7. How we protect it
We apply reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls that limit who inside Thoyz can see sensitive data. No system is perfectly secure, but security is treated as an operating discipline rather than an afterthought.
8. How long we keep it
We keep personal data only as long as needed for the purpose it was collected, and for the period required to meet legal, tax and contractual obligations, after which it is deleted or anonymised. Specific retention periods per data category are confirmed in the client contract.
9. Your rights
Under the DPDP Act, you have the right to access your personal data, to have it corrected or erased, to withdraw consent where processing is based on it, and to raise a grievance. Where we act as a processor for an employer, we will pass your request to that employer or assist them in responding to it. To exercise a right, contact us using the details below.
10. Children
Our services and this website are intended for businesses and adults. We do not knowingly collect personal data of children through this website.
11. Changes to this policy
We may update this policy from time to time. The current version is always the one published on this page, with its “last updated” date.
12. Grievance officer and contact
To exercise a right or raise a grievance, please reach us through the contact page. The name and direct contact details of our grievance officer, as required under the DPDP Act, will be published here before the service goes live.