Transpoco Driver App - Privacy Policy

1. Introduction

This Privacy Policy explains how E-pire Limited, trading as Transpoco (“Transpoco”, “we”, “us”), handles personal data when you use the Transpoco Driver App (the “App”). The App is used by drivers to carry out daily vehicle walkaround checks and to view their own driving-style score.

The App is used by drivers. A person who logs in to the App is referred to in this policy as a “user”. In most cases the user is also the main person the data is about (the “data subject”) — you log in and complete checks and view your own score. Some information you enter may relate to other people; where it does, they are also data subjects.

This policy tells you what information is collected through the App, why, who is responsible for it, how long it is kept, and the rights available over it.

This policy should be read together with our Terms & Conditions and, for business customers, our Data Processing Agreement (DPA). Where cameras are used, our Cameras & GDPR Guidelines also apply. All are available in our Knowledge Base. If there is any conflict between this policy and the DPA in respect of data processed for a business customer, the DPA prevails.

2. Who is responsible for your data

The App is used in two ways, and who is legally responsible for your personal data depends on which applies to you.

A. Business Use — you use the App as a driver for your employer or another organisation

In almost all cases you use the App because your employer (or another organisation you drive for) is a Transpoco customer. That organisation is the data controller of the personal data processed in the App: it decides that you use the App, designs the walkaround checklists you complete, and decides whether driving-style scoring and cameras are used. Transpoco acts as a data processor, processing personal data on the organisation’s documented instructions under the Data Processing Agreement that forms part of our contract with them.

Your organisation’s own privacy notice governs this processing. Requests about your data (access, correction, deletion) should normally be directed to your account administrator; you can always contact us and we will refer your request to your organisation without undue delay.

B. Individual Use — you use the App as an individual customer

The Driver App is designed to be used by drivers on behalf of an organisation, and is not marketed for individual (B2C) use. It is, however, technically possible for an individual customer to be set up as a driver in the Move platform and to use the App. If you use the App in that way — having contracted with Transpoco in your own name rather than through an organisation — Transpoco is the data controller of your personal data collected through the App, you are typically both the user and the data subject, and you exercise your data protection rights directly with us. References in this policy to “your contract with us” mean the agreement you accept with Transpoco when you sign up for or order the App and related services.

3. Personal data we collect

Login and authentication: your account is created and managed on the Transpoco Move platform, not in the App. When you log in, the App sends the email address and password you enter to our servers to verify them against your existing account; if they match, you are signed in. The App does not create accounts or collect your credentials — it uses them only to authenticate you.
Walkaround check content: when you complete a walkaround check, the App processes your driver identity, the time of the check, and the answers you provide. The questions are configured by your organisation in the Move platform and may be customised, so a check may ask for information beyond the vehicle itself.
Walkaround location (device GPS or entered manually): a walkaround checklist may include a location question. When you answer it, you can provide the location in one of two ways: by letting the App read your device’s GPS location at that moment (which it converts to a street address), or by typing the address yourself. If you use device GPS, this is controlled by your device’s location permission. The location you provide is saved with your answers and submitted with the check. Whether the checklist asks for location at all is configured by your organisation in the Move platform.
Driving-style score: the App shows you your own driving-style score. These scores are derived from telematics data recorded by your vehicle and, where your organisation uses in-vehicle cameras and has enabled scoring, from event data derived from camera footage. The App displays your score to you as figures; it does not show or store camera footage. Any camera footage is handled separately and is subject to our Cameras & GDPR Guidelines.
Device, usage and diagnostic data: the App collects technical information about your device and how the App is used — such as device type, operating system version, app version, and usage events — through our analytics provider, and diagnostic information (crash logs and error reports) through our crash-reporting provider. We use this to keep the App working reliably and to improve it.
Access details: we do not keep permanent device logs linked to your account, but we register your last access details so we can investigate issues you report.
Offline use and local storage: the App lets you complete walkaround checks without an internet connection. Your answers — including any location and any information entered in response to your organisation’s questions — are stored on your device until a connection is available, at which point the check is submitted to our servers. Until then, the data remains locally on your device and is protected by your device’s own security (such as your screen lock). Once a check is submitted, it is removed from the App’s local storage in the normal course of use.
Service providers (sub-processors): we use third-party providers for hosting, infrastructure, maintenance, backup, payment processing, app usage analytics and crash reporting. These providers process data on our behalf under contract. The current, named list of our sub-processors is published in our Knowledge Base and is kept up to date; please refer to it for the specific providers we use at any given time.
Your organisation (Business Use): if you use the App through an organisation, your account administrator and other authorised users (such as fleet managers) can access the checks you submit and your driving-style scores, and the administrator controls how your account is accessed, retained or deleted.
Legal requirements: we may disclose information where reasonably necessary to comply with applicable law, regulation, legal process or governmental request; to enforce our agreements; to protect the security or integrity of our services; or to protect Transpoco, our customers or the public from harm or illegal activity. Where the law allows, we will inform the affected customer before such disclosure.
Aggregated or anonymised data: Transpoco may create anonymised, aggregated data products (for example, anonymised traffic data) in which no individual vehicle, driver or company can be identified. Anonymised data is not personal data.
the destination country benefits from a European Commission adequacy decision;
Standard Contractual Clauses approved by the European Commission are in place, giving your data the same protection it has in Europe; and/or
supplementary technical and organisational measures are implemented where appropriate.
access the personal data we hold about you and receive a copy;
have inaccurate personal data corrected and incomplete data completed;
have your personal data erased in certain circumstances;
restrict the processing of your personal data in certain circumstances;
receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability);
object to processing based on legitimate interests, including driving-style scoring; and
withdraw consent at any time where processing is based on consent (for example, device location for a walkaround location question, which you can control through your device settings), without affecting the lawfulness of processing before withdrawal.

4. Sensitive information in customised checks

Because your organisation can customise the questions in a walkaround checklist, the answers you enter may include personal data about you or others, and in some cases could include special-category data (for example, information relating to health). The decision to ask such questions, and the responsibility for having a valid legal basis and, where required, explicit consent for any special-category data, rests with your organisation as the data controller — not with Transpoco. Transpoco processes whatever the checklist collects on the organisation’s documented instructions. If you are concerned about a question you are being asked to answer, please raise it with your employer or account administrator.

5. Why we use your data and our legal bases

We use personal data collected through the App to provide, operate, secure, support and improve the service. The table below sets out each purpose and the legal basis that applies, depending on how you use the App.

Purpose	Personal data used	Legal basis — Business Use (Transpoco as processor)	Legal basis — Individual Use (Transpoco as controller)
Authenticating your login (accounts are created on the Move platform)	Email address and password you enter, verified against your existing account	Processed on the documented instructions of your employer (the controller), whose basis is typically performance of the employment contract and/or legitimate interests	Performance of our contract with you (Art. 6(1)(b))
Completing and submitting vehicle walkaround checks	Your driver identity, timestamps, the answers you enter, and any fields your account administrator has added to the checklist	Processed on the controller’s instructions; the controller may also rely on its legal obligations (e.g. roadworthiness rules)	Performance of our contract with you; compliance with legal obligations where checks are legally required (Art. 6(1)(b), 6(1)(c))
Recording the location of a walkaround check (where the checklist includes a location question)	Either the device GPS coordinates captured when you answer the location question (converted to a street address), or an address you type yourself	Processed on the controller’s instructions; the controller decides whether the checklist asks for location	Where you use device GPS, your consent given via your device’s location permission (which you can withdraw in device settings); where you type the address, performance of our contract with you (Art. 6(1)(a), 6(1)(b))
Showing your driving-style score	Driving-style scores derived from telematics data and, where your organisation uses cameras and has enabled scoring, from camera-derived event data	Processed on the controller’s instructions; the controller’s basis is typically its legitimate interests in driver safety, subject to the safeguards in our camera guidance	Our legitimate interests in providing you with your own driving-style feedback (Art. 6(1)(f))
Security, troubleshooting and support	Last access details, crash logs and error reports, support correspondence	Processed on the controller’s instructions and as permitted by our Data Processing Agreement	Our legitimate interests in keeping the service secure and resolving issues (Art. 6(1)(f))
Service improvement and analytics	Device, usage and diagnostic data; aggregated, anonymised and de-identified data as described in our Data Processing Agreement	Aggregation/anonymisation performed as described in our Data Processing Agreement	Our legitimate interests in improving the service (Art. 6(1)(f)); anonymised data is no longer personal data

Our complete record of processing activities (RoPA) is available in our Knowledge Base. We do not use your personal data to train AI models without explicit consent; any use of data for AI/ML improvement is limited to aggregated, anonymised and de-identified data, as described in our Data Processing Agreement.

6. How we share information

We do not sell your personal data or Content. We share personal data only as described below:

7. International transfers

Data collected through the App is hosted with an ISO 27001 compliant hosting company based in the EU. Some of our service providers may be located in countries outside the European Economic Area that do not have equivalent data protection laws. Where we transfer personal data to such providers, we ensure at least one of the following safeguards applies:

8. How long we keep your data

We retain your account information for as long as your account is active. When an account is cancelled or deactivated, your account and data are deleted within 30 days, and any data on backups is deleted within a further 30 days, except where we must retain data to comply with legal obligations, resolve disputes or enforce our agreements.

If you use the App through an organisation (Business Use), your account administrator controls how your account information, submitted checks and scores are retained and deleted while the contract is active. When the organisation’s contract with Transpoco ends, the organisation has 30 days to retrieve or export its data (including walkaround check records), after which the data is deleted as described above. Responsibility for retaining those records beyond that point — including for any statutory retention periods that apply to vehicle roadworthiness or safety records — rests with the organisation as controller.

9. How we protect your data

Personal data is stored on servers kept in a controlled environment with an ISO 27001 compliant hosting provider in the EU. Data transferred over the Internet as part of the App is encrypted in transit using industry-standard TLS (HTTPS). Transpoco maintains security procedures designed to protect your data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access, and our staff who access customer personal data are trained in handling it and bound by confidentiality obligations.

No security system is impenetrable, and we cannot guarantee that information transmitted over the Internet or stored on our systems will be absolutely safe from intrusion. Where the App stores unsubmitted walkaround checks on your device for offline use, that data is held locally and protected by your device’s own security controls; keeping your device secured (for example with a screen lock) helps protect it until the check is submitted. If a personal data breach occurs, we will act in accordance with our breach-response obligations, including notifying affected business customers without undue delay and in any case within 24 hours of becoming aware, as set out in our Data Processing Agreement, and notifying supervisory authorities and affected individuals where required by law.

10. Your rights

Under the GDPR and applicable data protection law you have the right to:

How to exercise your rights

Business Use: your organisation is the controller, so please direct requests — including about your walkaround answers and driving-style scores — to your account administrator in the first instance. If you contact us directly, we will refer your request to your organisation without undue delay and assist it in responding, in accordance with our Data Processing Agreement.

Individual Use: contact us using the details in section 13, or use your in-app account settings where available. We will respond to requests within one month, and we aim to provide an initial response within one week.

Requests can be made in writing (email or support ticket). If a request is made orally, we will record the time and details of the request and confirm our understanding of it with you in writing. In limited cases data may not have to be erased, for example where retention is necessary for the establishment, exercise or defence of legal claims or where another legal exemption applies.

11. Our policy towards children

The App is not directed to individuals under 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information. If you become aware that a child has provided us with personal data, please contact us.

12. Changes to this policy

We may update this policy from time to time. The “last modified” date at the top shows when it was last changed, and any amended policy is effective upon posting to this page. We will make reasonable efforts to communicate significant changes to you by email or by notification inside the App.

13. How to contact us

Transpoco — E-pire Limited, trading as Transpoco, Dublin City University Alpha Innovation Campus, Old Finglas Road, Glasnevin, Dublin 11, Ireland.

Data Protection Officer: Barry Cronin — support@transpoco.com.

14. Complaints

If you wish to complain about how we have handled your personal data, please provide our Data Protection Officer with full details of your complaint and any supporting documentation using the contact details above or by opening a support ticket. Our DPO will endeavour to provide an initial response within 10 business days and to investigate and attempt to resolve your complaint within 30 business days, or such longer period as is necessary and notified to you.

You also have the right to lodge a complaint with a supervisory authority at any time. Our lead supervisory authority is the Irish Data Protection Commission (www.dataprotection.ie); you may also complain to the supervisory authority in the EU/EEA country where you live or work.