Privacy Policy

This Privacy Policy explains what information BYWAY collects about you, why we collect it, who we share it with, how long we keep it and what you can ask us to do about it. It is an electronic record under the Information Technology Act, 2000 and is published in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who we are

BYWAY Networks Private Limited, a company incorporated in India under the Companies Act, 2013 (CIN U72900GJ2019PTC110163) ("BYWAY", "we", "us" or "our"), is a logistics company with its principal place of business at 917, North Plaza, Visat–Gandhinagar Road, Motera, Ahmedabad, Gujarat 380005, India.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), BYWAY is the Data Fiduciary in respect of the personal data described in this Policy. Where we handle personal data on the written instructions of a business customer — for example, the consignee details a client gives us so that we can deliver their shipments — that client is the Data Fiduciary and we act as a Data Processor for them.

2. What this policy covers

This Policy applies to our website at https://www.byway.tech/, to any mobile or web application we operate, and to the information we collect in the course of providing our services.

Our services ("Services") are multimodal container transport, e-commerce logistics across first mile, mid mile and last mile, build-to-suit warehousing, enterprise full-load transportation, quick commerce and dark store operations, and any related transportation, warehousing or distribution service we agree to provide.

This Policy applies to everyone whose personal data we handle, including:

visitors to our website;
representatives of our customers, consignors and consignees;
recipients of shipments we deliver;
applicants for employment with us; and
drivers, delivery executives, transporters and other partners who provide services through us ("Driver Partners").

This Policy forms part of, and must be read together with, our Terms and Conditions.

3. Definitions

"Personal data" means any data about an individual who is identifiable by or in relation to such data.
"Sensitive personal data or information" has the meaning given to it in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
"Processing" means any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure and erasure.
"You" and "your" refer to the individual whose personal data is being processed.

4. Information we collect

4.1 Information you give us

Identity and contact details: name, job title, company name, email address, postal address, mobile and landline numbers.
Booking details: pickup and drop addresses, consignee name and contact number, description, weight, dimensions and declared value of goods, and any special handling instructions.
Billing details: GSTIN, PAN where legally required, billing address, invoice and payment records.
Correspondence: the content of enquiries, complaints, claims and support conversations, including call recordings where you are told in advance that a call is recorded.
Recruitment information: the details and resume you submit through the careers form on our website.

4.2 Information we collect automatically

Device and technical data: IP address, browser type and version, operating system, device identifiers, referring pages and the pages you view on our website.
Usage data: dates and times of access, features used and actions taken.
Cookies and similar technologies, as described in section 11.

4.3 Information about Driver Partners

Where you register with us as a Driver Partner, we additionally collect:

government identification and know-your-customer documents;
driving licence, vehicle registration certificate, insurance, permit, fitness and pollution-under-control certificates;
bank account details for the purpose of making payments to you;
a profile photograph;
location data while you are on an assigned trip, as described in section 4.4; and
the results of background and identity verification checks, which may include driving history and, where permitted by law, criminal record and right-to-work checks. These checks may be carried out on our behalf by an authorised verification agency.

4.4 Location data

We collect location data from a Driver Partner's device from the time a pickup or delivery is assigned until that trip is completed, and while our application is running in the foreground. We use this to allocate work, to give customers accurate status and estimated times, to generate proof of delivery, to support safety and to detect fraud.

We do not collect continuous location data from a Driver Partner's device outside an assigned trip. Where a customer has not enabled location sharing on their own device, we may still associate the Driver Partner's trip location with that customer's order so that we can produce a receipt and answer support queries.

4.5 Information we do not want

Please do not send us sensitive personal information that we have not asked for. We do not require, and ask you not to provide, information about your health, religion, caste, sexual orientation, political opinions or biometric data. If you send us such information unsolicited, we will delete it.

5. How we use your information

We use personal data only for the purposes set out below.

5.1 To provide the Services

To accept, price, plan, allocate and execute a booking.
To collect, transport, store and deliver consignments, and to manage reattempts and returns.
To generate goods receipts, consignment notes, e-way bill particulars, invoices and proof of delivery.
To keep you informed of the status of a shipment by SMS, push notification, WhatsApp, email or telephone.
To process payments, refunds and claims.
To provide customer support and to resolve disputes.

5.2 To run and improve our business

Internal record keeping, accounting, auditing and management reporting.
Analysing operational performance to improve routing, utilisation and service levels.
Training our staff and Driver Partners, including through reviewed call recordings.
Assessing applications for employment.

5.3 To meet legal obligations

Complying with the Goods and Services Tax laws, the Motor Vehicles Act, 1988, the Carriage by Road Act, 2007 and rules made under them, and other applicable law.
Responding to lawful requests from courts, tax authorities, law enforcement and other government agencies.
Preventing, detecting and investigating fraud, theft, misdeclaration of goods and misuse of the Services.

5.4 Marketing

We may send you information about our services, offers and operational updates by email, SMS or telephone where you have given consent or where you are an existing customer and the message relates to services similar to those you have already taken.

You can opt out at any time. Every marketing email carries an unsubscribe link, and you may also write to jay@byway.tech or telephone +91 97275 50000. Opting out of marketing does not stop operational messages about a shipment you have booked. You may separately register your preferences under the Telecom Commercial Communications Customer Preference Regulations, 2018.

6. The basis on which we process your data

We process personal data on one or more of the following bases:

Your consent, which you may withdraw at any time under section 9.
Certain legitimate uses permitted by section 7 of the DPDP Act, including where you have voluntarily provided your data for a specified purpose, and for compliance with law or a judgment.
Performance of the contract between you and us for the provision of the Services.
Compliance with a legal obligation to which we are subject.

Where we rely on your consent, we will ask for it before or at the time of collecting your personal data, and we will tell you what data we are collecting, the purpose for which it will be processed, how you may exercise your rights and how you may complain to the Data Protection Board of India. Your consent will be limited to what is necessary for the stated purpose.

You are not obliged to give us any personal data. If you choose not to provide information that we need in order to carry out a booking or to onboard you as a Driver Partner, we may be unable to provide the Services.

We do not sell, rent or trade your personal data. We share it only as set out below, and only to the extent necessary.

8.1 Within the delivery chain

With the Driver Partner assigned to your shipment, who receives the consignee's name, contact number and address in order to make the delivery.
With the consignor or consignee, as applicable, to whom we may disclose the Driver Partner's name, contact number and photograph so that a handover can take place safely.
With transporters, rail and shipping operators, container terminals, warehouse operators and other carriers engaged to move your consignment.

8.2 Service providers

Technology providers who host our systems, send our messages and support our applications.
Payment gateways, payment aggregators and banks, to process payments and refunds.
Verification agencies, for Driver Partner background checks.
Professional advisers, including auditors, accountants, insurers and lawyers.

Every service provider is engaged under a written contract that requires them to process personal data only on our instructions, to keep it confidential and to protect it with appropriate security measures.

8.3 Legal and regulatory disclosure

We may disclose personal data where we are required to do so by law, by a court order, or by a lawful request from a government or enforcement agency; where it is necessary to establish, exercise or defend a legal claim; or where we reasonably believe disclosure is necessary to prevent fraud, to protect the safety of any person, or to enforce our Terms and Conditions.

8.4 Business transfer

If our business, or any part of it, is merged, acquired or reorganised, personal data may be transferred to the acquiring entity as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

You may withdraw your consent at any time by writing to our Grievance Officer at the address in section 16. Withdrawal is as easy as giving consent.

Withdrawal takes effect prospectively. It does not affect the lawfulness of anything we did before you withdrew, and it does not require us to delete data we are obliged to retain under section 10. Where the data withdrawn is necessary to provide a Service, we may be unable to continue providing that Service to you.

10. How long we keep your information

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires, whichever is longer.

Booking, consignment note and delivery records: eight years from the end of the relevant financial year, to meet tax and commercial record-keeping requirements.
Invoices, GST records and accounting data: as required under the Goods and Services Tax laws and the Companies Act, 2013.
Driver Partner onboarding and verification records: for the duration of the engagement and three years afterwards.
Recruitment applications: twelve months from the date of application, unless you ask us to delete them sooner or you join us.
Website analytics and cookie data: as set out in section 11.
Call recordings: ninety days, unless retained longer for a specific dispute.

When a retention period ends, we erase the personal data or irreversibly anonymise it.

11. Cookies and similar technologies

A cookie is a small file placed on your device that lets a website recognise your browser and remember certain information.

We use:

Strictly necessary cookies, which are required for the site to function and cannot be switched off.
Analytics cookies, which help us understand which pages are used so that we can improve the site. We use this information in aggregate and for statistical purposes only.

Most browsers accept cookies automatically. You can set your browser to refuse cookies or to alert you when a cookie is being set. Refusing cookies may prevent parts of our website from working properly. A cookie gives us no access to your device and no information about you beyond what you choose to share.

12. Security

We maintain reasonable security practices and procedures within the meaning of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, proportionate to the nature of the data we hold. These include access controls on a need-to-know basis, encryption of data in transit, secured servers, contractual obligations on our service providers, logging and monitoring, and periodic review of our controls.

No method of transmission or storage is completely secure. While we take the protection of your data seriously, we cannot guarantee absolute security, and you are responsible for keeping any credentials we issue to you confidential.

13. Personal data breach

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected individual in the manner and within the timelines prescribed under the DPDP Act and the rules made under it. Our notice will describe the nature of the breach, its likely consequences, the measures we have taken and the steps you can take to protect yourself.

14. Your rights

Subject to the DPDP Act, you have the right to:

be informed about the personal data we process about you and the identities of those with whom we have shared it;
have your data corrected where it is inaccurate or misleading, completed where it is incomplete, and updated where it is out of date;
have your data erased where it is no longer needed for the purpose for which it was collected and we are not required by law to keep it;
nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
complain to us and, if you are not satisfied, to the Data Protection Board of India.

To exercise any of these rights, write to our Grievance Officer using the details in section 16. We will respond within the period prescribed by law, and in any event within thirty days. We may ask you for information to verify your identity before we act on a request.

You are responsible for the accuracy of the information you give us, and for not impersonating another person or making a false or frivolous request.

15. Other matters

15.1 Children

Our Services are not directed at children. We do not knowingly process the personal data of a child under eighteen years of age, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we become aware that we hold a child's personal data without verifiable parental consent, we will delete it.

15.2 Transfers outside India

We store personal data on servers located in India. If we transfer personal data to a service provider outside India, we will do so only to a country not restricted by the Central Government under the DPDP Act, and under a written contract requiring protection equivalent to that described in this Policy.

15.3 Links to other websites

Our website may link to other websites, including in the form of advertisements or client links. Once you leave our site we have no control over the other website and are not responsible for its content or its privacy practices. We encourage you to read the privacy statement of any site you visit.

15.4 Changes to this policy

We may update this Policy from time to time. The current version is effective from the date shown at the top of this page. Where a change is significant, we will tell you by email or by a notice on our website before it takes effect. Please check this page periodically.

16. Grievance Officer and contact

In accordance with the Information Technology Act, 2000 and the rules made under it, and section 13 of the DPDP Act, the contact details of our Grievance Officer are:

Legal Team, BYWAY Networks Private Limited

917, North Plaza, Visat–Gandhinagar Road, Motera, Ahmedabad, Gujarat 380005, India

Email: jay@byway.tech

Hours: Monday to Friday, 10:00 to 18:00 IST

We will acknowledge a grievance within forty-eight hours of receiving it and resolve it within thirty days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

For any other question about our Services, please email jay@byway.tech.

17. Prohibited activities

As required by Rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you must not host, display, upload, modify, publish, transmit, store, update or share any information on or through our platform that:

belongs to another person and to which you do not have any right;
is defamatory, obscene, pornographic, paedophilic, invasive of another's privacy including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating to or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force;
is harmful to a child;
infringes any patent, trademark, copyright or other proprietary right;
violates any law for the time being in force;
deceives or misleads the addressee about the origin of the message, or knowingly and intentionally communicates any information which is patently false or misleading in nature but may reasonably be perceived as a fact;
impersonates another person;
threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence, or prevents investigation of any offence, or is insulting to any other nation;
contains a software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource; or
is patently false and untrue, and is written or published in any form with the intent to mislead or harass a person, entity or agency for financial gain or to cause injury to any person.

If you do not comply with these rules, this Policy or our Terms and Conditions, we may remove the non-compliant information, terminate or suspend your access to our platform, or both, and we may report the matter to the appropriate authorities.

What we collect.And why.