# WORISGO TRAVEL SAFETY PLATFORM - PRIVACY POLICY

**Version:** 1.2
**Effective Date:** June 23, 2026
**Last Reviewed:** June 24, 2026
**Applicable Law:** DPDP Act 2023, DPDP Rules 2025, IT Act 2000

## 1. WHO WE ARE

WoRisGo (World Risk Governance) operates the WoRisGo Travel Safety platform — a corporate travel safety system that helps companies monitor employee wellbeing, deliver real-time safety alerts, and coordinate emergency response for employees travelling anywhere in the world.

Under India's Digital Personal Data Protection (DPDP) Act, 2023, WoRisGo is the "Data Fiduciary" — the organisation that decides why and how your personal data is processed.

## 2. WHAT DATA WE COLLECT

We collect:
- **Registration Data:** Name, email, phone number, employee ID, job title, department, country of residence, emergency contacts
- **Travel Information:** Travel plans, itineraries, destinations, dates, accommodation details
- **Location Data (GPS):** Only with your explicit consent for real-time safety monitoring
- **Technical Data:** IP address, device information, login history
- **Consent Records:** Audit trail of all consents provided

## 3. WHY WE USE YOUR DATA

- Providing travel safety services and monitoring
- Sending safety alerts and emergency notifications
- SOS emergency response and coordination
- Employer admin dashboard access (duty of care)
- Authentication and platform security
- Legal compliance and audit trail

## 4. GRANULAR CONSENT TYPES

You will be asked to provide separate consent for:

1. **Core Platform Data Processing (REQUIRED)** - Essential for using the platform
2. **GPS Location Tracking (OPTIONAL)** - For real-time safety monitoring
3. **Push Notifications (OPTIONAL)** - For receiving alerts on your device
4. **WhatsApp Alerts (OPTIONAL)** - When feature becomes available

You can decline optional consents and still use core platform features. Required consent cannot be declined without deactivating your account.

## 5. WHO WE SHARE DATA WITH

- **Your Employer's Travel Administrators:** For duty-of-care safety management
- **Service Providers:** AWS (hosting), Google Firebase (push notifications), WhatsApp/Meta (planned)
- We DO NOT sell or trade your data to third parties

## 6. DATA STORAGE & SECURITY

All data is stored on AWS servers in Mumbai, India (ap-south-1 region). We use:
- TLS 1.2+ encryption for data in transit
- AES-256 encryption for data at rest
- OTP-based secure authentication
- Role-based access controls

## 7. YOUR RIGHTS UNDER DPDP ACT 2023

You have the right to:
- **Access Your Data** - Download a copy of all your data
- **Correct Your Data** - Fix inaccurate information
- **Delete Your Data** - Request account deletion
- **Withdraw Consent** - Stop any consent-based processing at any time
- **Raise a Complaint** - Contact our Grievance Officer

## 8. CONSENT MANAGEMENT

All consents are:
- **Free** - We won't deny core services for refusing optional data collection
- **Specific** - Asked separately for each type of processing
- **Informed** - We explain what and why before you consent
- **Revocable** - You can withdraw at any time

## 9. DATA RETENTION

- User profile: Active account + 24 months
- Travel plans: 24 months after trip ends
- GPS location: Duration of trip + 24 months
- SOS records: 60 months (5 years)
- Consent records: Indefinitely (legally required)

## 10. CONTACT US

- **Privacy Questions:** privacy@worisgo.com
- **Grievance Officer:** grievance@worisgo.com
- **Data Rights Requests:** privacy@worisgo.com with subject "DATA RIGHTS REQUEST"

---

By using the WoRisGo Travel Safety platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.