Data Processing Addendum

This addendum is part of the TrackParcel Terms of Use. For the personal data your business adds to TrackParcel for Business, your business is the Data Fiduciary and TrackParcel is its Data Processor, under section 8(2) of the Digital Personal Data Protection Act, 2023. The Service data clause sets out the one exception: TrackParcel's own use of courier results and de-identified, aggregated statistics.

Tracking your shipments; in-app alerts to your team; webhooks to your own systems; imports of Excel and CSV files, and exports.

The contact fields, tracking numbers, courier events, order IDs, labels, tags and notes of your business's customers.

Apart from the use the Service data clause sets out, we process this data only on your business's instructions: its product settings, imports and API calls. A shipment moves to another workspace only on the written instruction of the source workspace's Owner, recorded in a support ticket, and its contact fields are erased on the move unless both Owners confirm otherwise.

By accepting this addendum, your business agrees that TrackParcel may use the courier results for its tracking numbers, and its shipment data in de-identified, aggregated form, for TrackParcel's own purposes: to operate, cache, secure and improve the service. For that use TrackParcel acts as a Data Fiduciary in its own right, not as your Data Processor. The names, phone numbers, email addresses and address lines your business adds for its customers are never used for it.

This covers answering public lookups of the same tracking number from our cache of courier results, carrier-health monitoring, and two statistics pooled across all workspaces: delivery times by courier and lane, for delivery estimates, and each courier's daily delivery figures, for the “Network median” in analytics. A delivery's origin on a lane comes only from the courier's booking details, and its destination from them or, failing that, the state or PIN code of its delivery address; a delivery whose booking details give no origin is on no lane. A pooled figure is shown only when it meets the minimums our privacy notice sets out, no other workspace sees your tracking numbers, your customers or your individual shipments through these statistics, and none of them names your business.

These are TrackParcel's own data and are kept after the workspace closes. The privacy notice describes them in full, including what pooling can't protect.

Your business has given its customers notice and holds a lawful basis for the data it adds. It adds no children's data and no sensitive personal data in notes.

Our staff and admins are bound by confidentiality. Every admin access is logged: opening a workspace's page is recorded, customers' contact fields and notes stay masked until an admin reveals one, and each reveal is recorded with its reason. Viewing the app as your business sees it needs your business's consent.

TLS on every connection; encryption at rest by our database provider; AES-256-GCM for webhook signing secrets and admin two-step secrets; server-only data access with database row-level security as a backstop; admin roles with two-step sign-in; two-step sign-in before sensitive workspace actions; append-only audit logs; nightly encrypted backups.

The services we use are listed at trackparcel.in/subprocessors. We tell Owners in the app 30 days before we add one. A business that objects may close its workspace and receive a pro-rata refund of prepaid fees.

We help your business meet its own duties: exports, corrections and erasure of personal fields within 30 days, and help with its own breach notices. In an import file we keep, an erasure empties only the columns the import matched to customer fields, on the sheet it read, as the retention table of our privacy notice says.

If a breach affects your business's data, we notify the workspace's Owners and Admins without undue delay, and within 24 hours of confirming it, through an in-app notice and banner and in writing from our team.

When a workspace closes, its customers' personal fields are erased, which is how we meet your business's duty to have its processor erase personal data once the purpose ends. Tracking numbers, courier events, statuses and order IDs are kept, as the Terms say openly. In the import files we keep, the columns each import matched to customer name, phone, email, address, label and note are emptied, on the sheet it read; columns it didn't match and the file's other sheets are kept as uploaded, as the retention table of our privacy notice says.

Erased fields can survive in encrypted backups until those expire (at most 12 months), and a restore re-applies every erasure before the app reconnects.

The countries where data is processed are listed for each sub-processor at trackparcel.in/subprocessors.

We answer an annual security questionnaire. Under an Enterprise contract, a business may also carry out a reasonable audit on 30 days' notice.

As in the Terms of Use, Part B.