Enterprise Privacy Policy & Data Protection

1. Enterprise Commitment to Data Sovereignty & Privacy

Aeris Communications India Private Limited (CIN: U74999UP2016FTC101866) and its global affiliates (“Aeris”, “we”, “us”, or “our”) are committed to maintaining the highest standards of data confidentiality, telemetry integrity, and subscriber privacy. As a global leader in cellular IoT connectivity, connected vehicle telematics, and smart utility infrastructure, we design our platforms with security and privacy by design.

This Privacy Policy outlines how Aeris collects, processes, protects, and governs enterprise customer data, device telemetry, and personal identifier information in strict compliance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the EU General Data Protection Regulation (GDPR), ISO/IEC 27001:2022 standards, and applicable Department of Telecommunications (DoT) directives.

2. Telecommunications Traffic & Zero-Inspection Guarantee

Customer data traffic transmitted across Aeris Fusion IoT eSIMs, private APNs (Access Point Names), IPsec VPNs, and dedicated MPLS interconnects is treated strictly as confidential sovereign payload. Aeris upholds a rigorous Zero-Payload-Inspection policy:

• Aeris does not store, inspect, decrypt, or monetize application-layer payload data transmitted by connected client devices.
• Customer device communications flow through dedicated packet gateways directly to the customer’s designated enterprise cloud endpoints (AWS, Microsoft Azure, Google Cloud, or on-premise private datacenters).
• All signaling control planes and management sessions are encrypted using TLS 1.3 and AES-256 protocols.

3. Telemetry & Operational Data We Process

To deliver real-time connectivity management, automated eSIM profile switching, and contractual 99.999% network availability, our Global Network Operations Center (NOC) processes operational metadata, including:

• SIM & Cellular Identifiers: IMSI (International Mobile Subscriber Identity), ICCID (Integrated Circuit Card ID), MSISDN, and device IMEI.
• Radio Network Telemetry: Cell ID, signal strength (RSSI, RSRP, RSRQ), network generation (2G, 4G LTE, NB-IoT, Cat-M1, 5G), roaming partner network, and session duration.
• Data Consumption Metrics: Uplink/downlink byte counts, session timestamps, and billing interval aggregation for pooled data quota management.
• Telematics & AIS-140 Diagnostics: Where provisioned under specific enterprise fleet contracts, GNSS coordinates, vehicle speed, and emergency distress state data are processed strictly in conformance with MoRTH AIS-140 emergency response directives.

4. Data Localization & Indian Sovereign Hosting

In adherence to statutory Indian telecommunications mandates and data protection principles, all operational databases, CDRs (Call Detail Records), and telematics tracking logs for Indian operations are retained in MeitY-empanelled, Tier-IV datacenters located within the sovereign borders of India. Cross-border telemetry transfer is conducted strictly in compliance with Section 16 of the DPDP Act 2023 and cross-border BCRs (Binding Corporate Rules).

5. Information Security Controls

Aeris enforces multi-layered technical and organizational controls to safeguard infrastructure against unauthorized access, compromise, or data loss:

• Hardware Security: GSMA SAS-UP (Security Accreditation Scheme for Subscription Management) certified eSIM architectures.
• Network Isolation: Private IP addressing, isolated VRFs (Virtual Routing and Forwarding), and DDoS mitigation at the core packet gateway.
• Access Governance: Zero Trust Architecture, strict Role-Based Access Control (RBAC), and multi-factor authentication (MFA) across all administrative consoles.
• Audits: Annual third-party penetration testing, SOC 2 Type II examinations, and ISO 27001 surveillance audits.

6. Data Subject Rights & Enterprise Governance

Under the DPDP Act 2023 and GDPR, enterprise administrators and designated contact persons hold the right to:

• Request access to administrative contact records and authorized user credentials.
• Request correction, updating, or anonymization of inaccurate administrative profiles.
• Request erasure of obsolete account records upon contract termination, subject to mandatory telecommunications log retention statutes (typically 2 years under DoT licensing).

7. Grievance Redressal & Data Protection Officer

For inquiries regarding this Privacy Policy, data governance practices, or to exercise statutory privacy rights, please contact our designated Grievance Officer: