Privacy Policy

Who we are and what this policy covers

ATAHSKIA BUSINESS SOLUTIONS PRIVATE LIMITED (CIN U69200TS2026PTC212241) is a private limited company incorporated in India with its headquarters at HNO. 4-1-938, FLAT 602, KRISHNA APTS, TILAK ROAD, Hyderabad G.P.O., Hyderabad, Telangana, India, 500001. We build software that audits ocean detention and demurrage (D&D) invoices against 46 CFR Part 541, reconciles billed days against carrier and terminal milestones, and prepares dispute and charge complaint packets for the billed party to submit.

This policy applies to personal data we process when you visit atahskia.si, request a free retrospective D&D audit, start a trial, use the platform, attend a webinar, or correspond with our team. It does not cover the trade documents our customers upload to the platform, which we process as a processor (or service provider) under our Data Processing Addendum at /legal/dpa.

Personal data we collect

We collect only what we need to run the website, operate customer accounts and support recovery work. Most of what flows through the platform is commercial shipping data (B/L numbers, container numbers, invoice lines, free time, gate events) rather than personal data, but invoices and correspondence often carry names, email addresses and phone numbers of carrier billing contacts, customer staff and drayage dispatchers.

• Contact and account data: name, work email, job title, company, phone number, password hash, SSO identifiers and MFA enrollment status.
• Commercial data: plan, TEU band, billing contact, invoices and payment status (card data is collected and held by Stripe, not by us).
• Customer content: D&D invoices, carrier tariffs and service contract references, EDI 315 / 322 status messages, terminal availability and hold data, dispute correspondence and the personal data of contacts named inside those documents.
• Usage and device data: IP address, browser type, pages viewed, feature events, audit log entries, and timestamps.
• Communications: support tickets, call notes, webinar registrations and email replies.

How we use personal data

We use personal data to provide and secure the platform, respond to requests, bill accounts, and improve the product. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we never use a customer's invoices or trade data to train machine learning models offered to anyone else.

• Operate accounts, authenticate users and enforce role-based access.
• Run Part 541 audits, milestone reconciliation and dispute packet generation that a customer requests.
• Send transactional notices such as dispute deadline alerts, § 541.8 resolution reminders, password resets and invoices.
• Detect abuse, investigate security events and maintain audit trails.
• Send product updates and event invitations to business contacts, with an unsubscribe link in every message.
• Meet legal, tax and accounting obligations in the United States and India.

Legal bases and consent

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), we process personal data for which you have given consent or for legitimate uses recognised in Section 7, such as data you voluntarily provide for a specified purpose. You may withdraw consent at any time by writing to privacy@atahskia.si, and withdrawal does not affect processing completed before it.

Where the GDPR or UK GDPR applies, we rely on performance of a contract (operating your account), legitimate interests (securing the service, business-to-business marketing, product analytics), legal obligation (tax and accounting records) and consent (non-essential cookies, certain marketing emails).

Where data is stored and international transfers

Customer content and platform databases are hosted on Amazon Web Services in us-east-1 (N. Virginia), with failover to us-west-2 (Oregon). Engineering and support staff in Hyderabad access production systems through SSO, MFA and just-in-time role grants, and every access is logged.

Transfers of personal data out of India are made in line with the DPDP Act and any restrictions notified by the Central Government under Section 16. Transfers out of the European Economic Area, Switzerland or the United Kingdom rely on the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, supplemented by encryption and access controls.

How long we keep data

Account and customer content is retained for the term of the subscription. After termination, customers have 30 days to export their audit history, dispute packets and evidence files, after which we delete customer content from production systems within a further 30 days and from encrypted backups within 35 days of that deletion.

Billing and tax records are kept for the periods required by US and Indian law (generally up to eight years). Website analytics are kept in aggregated form for no more than 26 months. Security and audit logs are retained for 12 months.

Your rights

Depending on where you live, you can ask us to confirm what personal data we hold, give you a copy, correct or complete it, delete it, restrict or object to certain processing, or port it to another provider. Under the DPDP Act you also have the right to grievance redressal and the right to nominate another person to exercise your rights in the event of death or incapacity.

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other US states with comprehensive privacy laws may exercise the rights those laws grant, including the right to know, delete, correct and opt out of sale, sharing or targeted advertising. We do not sell or share personal data as those terms are defined, and we honour Global Privacy Control signals as an opt-out request. We will not discriminate against you for exercising any right.

• Send requests to privacy@atahskia.si or call 1800-266-2929.
• We verify your identity before acting, and respond within 30 days (45 days where a US state law allows, with notice).
• If your data sits inside a customer's account, we will route the request to that customer, who controls it.
• Authorised agents may submit requests with signed written permission.

Security

ATAHSKIA holds a SOC 2 Type II report. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, tenants are logically isolated, and production access requires SSO, MFA and approved role elevation. Our security program, penetration test summaries and subprocessor list are described at /security and /security/trust-center.

If we become aware of a personal data breach, we will notify affected customers without undue delay, notify the Data Protection Board of India and affected Data Principals as the DPDP Act requires, and meet the notification duties of applicable US state breach laws and the GDPR.

Children

The website and platform are built for businesses in ocean freight and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact privacy@atahskia.si and we will delete it.

Grievance Officer and contact

Our Grievance Officer under the DPDP Act and our privacy contact for all other jurisdictions can be reached at privacy@atahskia.si or by post at ATAHSKIA BUSINESS SOLUTIONS PRIVATE LIMITED, Attn: Grievance Officer, HNO. 4-1-938, FLAT 602, KRISHNA APTS, TILAK ROAD, Hyderabad G.P.O., Hyderabad, Telangana, India, 500001. We acknowledge grievances within 48 hours and resolve them within the period prescribed under the DPDP Rules.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, your US state attorney general, or the supervisory authority in your EU member state. We will post changes to this policy on this page with a new updated date, and notify customers by email of material changes at least 30 days before they take effect.