Privacy Policy

1. Who we are

S S Logistics ("SSL", "we", "us", "our") is a partnership firm providing road transportation, rake handling, clearing & forwarding and warehousing services, with its registered office at 11/5/1, Cossipore Road, Cossipore, Kolkata – 700002, West Bengal, India.

For the personal data described in this policy, SSL is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the body corporate responsible under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules").

2. Scope

This policy applies to personal data we process through:

• Website — www.sslogistics.org, including enquiries you send us through it.
• SSL Operating Portal — portal.sslogistics.org, our internal system used by employees, drivers, site teams, vendors and authorised partners.
• WhatsApp messages — messages sent to or received from SSL's WhatsApp Business number(s), including login one-time passwords (OTPs) and business notifications.
• Phone calls and emails related to the above.

It does not cover third-party websites or apps that we link to (for example LinkedIn, Facebook or WhatsApp itself), which have their own privacy policies.

3. Personal data we collect

Sensitive data. Financial information (bank account, UPI and payment details) and identity documents are collected only where needed for payments, onboarding or legal compliance, and are accessible only to authorised staff. We do not knowingly collect health, biometric or other special categories of data, and we never ask for card numbers, passwords or PINs over WhatsApp, phone or email.

4. How we use personal data

• To respond to enquiries and provide freight quotes.
• To create and manage portal accounts, verify your identity and send login OTPs.
• To plan, run and track transport, rake, warehouse and C&F operations, including GPS tracking of vehicles for safety, delivery and billing.
• To process vendor bills, make payments and send payment confirmations.
• To send transactional and service messages (see Section 6).
• To maintain accounts, invoices and tax records, and to meet legal, GST, audit and regulatory obligations.
• To keep our systems secure, prevent fraud and investigate misuse.

We do not sell personal data, and we do not use it for third-party advertising.

5. Legal basis and consent

We process personal data on one or more of these grounds under the DPDP Act:

• Consent — for example when you send us an enquiry, opt in to WhatsApp messages, or give us your details to create an account.
• Legitimate uses — including purposes of employment, compliance with law, court orders or government requirements, and data you have voluntarily provided for a specified purpose.

Where we rely on consent, you can withdraw it at any time by writing to the Grievance Officer (Section 15). Withdrawal does not affect processing already done, and some services (such as portal login or payments) may stop working without the related data.

6. WhatsApp messaging

6.1 Messages we send

• Authentication — one-time passwords (OTPs) to log in to the SSL Operating Portal with your mobile number.
• Transactional / utility — operational updates such as trip, truck assignment, payment request, payment confirmation (amount, reference / UTR, date) and approval notifications.
• Consignment updates — where a customer asks for it, dispatch, in-transit and delivery updates to the customer's authorised contacts.
• Replies — responses to messages you send us, including freight enquiries started from our website's "Chat on WhatsApp" button.

We do not send promotional or marketing messages on WhatsApp unless you have separately agreed to receive them.

6.2 Opt-in

We message you on WhatsApp only when you have given us your WhatsApp number and agreed to receive messages from SSL — for example by registering your mobile number on the SSL Operating Portal, by your employer or SSL administrator adding your number with your agreement, or by messaging us first.

Your WhatsApp consent is separate from any other consent you give us and is never assumed from a pre-ticked box. We keep a record of when and how you opted in, so we can show it if you ask.

6.3 Opt-out

You can stop non-essential WhatsApp messages at any time by replying STOP, by blocking our number in WhatsApp, or by emailing info@sslogistics.org. If you opt out of WhatsApp OTPs, please contact us so we can give you another way to log in.

6.4 Data involved

To deliver messages, your WhatsApp phone number and profile name, the message content and delivery / read status are processed by SSL and by Meta. We use your number only for the messages described above, not for any other purpose without your consent. OTPs expire within minutes and are not reused.

We keep message content to the minimum needed. Payment messages to our internal accounts team may include the payee's UPI ID or bank details needed to make that payment and links to bill or QR images that expire within 7 days. We never send passwords, card numbers, PINs or full identity documents over WhatsApp, and we will never ask you for them there.

6.5 Your requests

You can ask for a copy of the WhatsApp messages we have exchanged with you, or ask us to delete your number and chat history where we are not required to keep them by law. We will complete such requests within 30 days and confirm to you when done.

6.6 Meta's role

Meta processes WhatsApp Business Platform messages on our behalf as a service provider, under the WhatsApp Business Terms of Service and the WhatsApp Business Data Processing Terms. Messages are encrypted in transit. Your use of WhatsApp itself is governed by the WhatsApp Privacy Policy.

6.7 Messages you start from a link

Some links on our website and portal (for example "Chat on WhatsApp" or "Send to HO Accounts on WhatsApp") open WhatsApp on your own device with a pre-filled message. Nothing is sent until you tap send in WhatsApp, and the message then goes to the number shown.

7. Sharing and service providers

We share personal data only as needed for the purposes above, with:

• Service providers (Data Processors) who host or run our systems under contract: Meta / WhatsApp (messaging), Supabase (portal database and hosting), GitHub (website and portal hosting), Zoho Books (accounting), Google Workspace (email and documents) and our vehicle GPS tracking provider.
• Customers — trip, vehicle and driver details needed to deliver, track and bill a consignment.
• Banks and payment providers — to make payments to you.
• Group entities — our associate firm L S Associates, where it operates trucks or sites with us.
• Authorities and advisers — government bodies, tax authorities, courts, auditors and legal advisers, where required by law or to protect our rights.
• Business transfers — a successor entity in case of a merger, acquisition, restructuring or sale of our business, which will remain bound by this policy for data it receives.

Service providers may use the data only to provide their service to us and must protect it with reasonable security safeguards.

8. Storage and cross-border transfers

Some of our service providers (including Meta, Supabase, GitHub and Google) may store or process data on servers outside India. Any such transfer is made in line with the DPDP Act and any restrictions notified by the Government of India, and the providers are bound by contract to protect the data.

9. Retention

• Enquiries — up to 2 years after our last contact, unless they lead to a business relationship.
• Portal accounts — while the account is active, and up to 1 year after it is closed for audit and security.
• Accounting, tax, payment and trip records — for the period required by law (generally at least 8 years under GST and income-tax rules).
• WhatsApp message records — enquiry chats with the enquiry (above); operational and payment messages with the related trip or payment record; OTPs are not stored after they expire.
• Vehicle GPS data — as long as needed for trip, billing and dispute purposes.

When data is no longer needed, we delete it or make it anonymous, unless the law requires us to keep it.

10. Security

We follow reasonable security practices, including encrypted (HTTPS) connections, role-based access so staff see only what their job needs, logging of who created, edited and approved records, maker–checker approvals for sensitive changes, and secure authentication. No system is completely secure; if a personal data breach occurs that affects you, we will inform you and the Data Protection Board of India as required by law.

11. Your rights

Subject to applicable law, you have the right to:

• Access — ask for a summary of your personal data we hold and how it is used.
• Correction and completion — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete data we no longer need, unless we must keep it by law.
• Withdraw consent — for processing based on your consent.
• Grievance redressal — raise a complaint with our Grievance Officer, and, if you are not satisfied, with the Data Protection Board of India.
• Nominate — nominate another person to exercise your rights in case of death or incapacity.

To make a request, write to the Grievance Officer. We may need to verify your identity before acting on it.

12. Cookies and tracking

Our public website does not use advertising or analytics cookies. It loads fonts from Google Fonts, so Google may receive your IP address when the page loads. The SSL Operating Portal uses essential browser storage only, to keep you securely logged in.

13. Children

Our services are meant for businesses and adults. We do not knowingly collect personal data of anyone under 18. If you believe we have, please contact us and we will delete it.

14. Changes to this policy

We may update this policy as our services or the law change. The updated version will be posted on this page with a new "Last updated" date. For significant changes, we will also inform portal users.

15. Grievance Officer and contact