How we handle the personal information your company puts in SarathiLink on its behalf.
This Data Processing Agreement is part of the SarathiLink Terms of Service between AstroRasa Inc. ("we") and the Customer. For personal information in Customer Data, the Customer controls it (decides why and how it is used) and we process it only on the Customer's behalf.
We process Customer Data only to provide SarathiLink as described in the Terms and as the Customer directs through the service (for example by connecting Samsara or switching location sharing on), and as the law requires. We do not sell it or use it for our own purposes beyond running, securing and improving the service.
Only people who need it to run or support the service can access Customer Data, and they are bound to keep it confidential. Our platform staff see counts, not content, unless the Customer asks for help.
We keep technical and organizational safeguards appropriate to the information: encryption in transit and at rest; separation of each Customer's data enforced in the database; role-based access; keys to connected services stored server-side only; audit logs; tested isolation before each release.
The Customer agrees to the service providers listed in our Privacy Policy. We bind them to protect the information at least as well as this Agreement. We will give at least 30 days' notice by email before adding a provider that processes Customer Data; the Customer may object and, if we cannot resolve it, cancel without penalty.
Customer Data is hosted in Canada. Some providers may process parts of it outside Canada as described in the Privacy Policy.
We will tell the Customer without undue delay after we become aware of a breach of security safeguards involving Customer Data, with what we know, and help the Customer meet its duties to report to regulators and to notify people.
If a driver or other person asks us directly about their information, we will pass the request to the Customer and help it answer, as far as the service allows (the Customer can view, correct, export and delete records itself).
After the subscription ends, the Customer has 30 days to export its data; we then delete it within a further 60 days, except where the law requires us to keep it.
On reasonable written request, once a year, we will answer the Customer's questions about how we protect Customer Data and provide information needed to show we meet this Agreement.
This Agreement is subject to the limitation of liability in section 12 of the Terms of Service, which applies to all claims under it as far as the applicable privacy law allows.
privacy@sarathilink.com · AstroRasa Inc., 2482 Yonge St #1476, Toronto, ON, Canada