Transpoco Fleet Manager App - Privacy Policy

 1. Introduction

This Privacy Policy explains how E-pire Limited, trading as Transpoco (“Transpoco”, “we”, “us”), handles personal data when you use the Transpoco Fleet Manager mobile application (the “App”). The App is a management tool that lets you monitor your fleet on the move: it shows the live position of vehicles on a map, journey and route history, daily summaries and reports, and driver information such as driver names, if any.

The App is used by fleet managers. A person who logs in to the App is referred to in this policy as a “user”. The people whose personal data may appear in the App — principally the drivers whose vehicles, journeys and routes are shown — are the “data subjects”. A user may also be a driver (for example, an owner-driver), in which case the same person is both a user and a data subject.

This policy tells you what information is collected through the App, why, who is responsible for it, how long it is kept, and the rights available over it.

This policy should be read together with our Terms & Conditions and, for business customers, our Data Processing Agreement (DPA), both available in our Knowledge Base. If there is any conflict between this policy and the DPA in respect of data processed for a business customer, the DPA prevails.

2. Who is responsible for your data

The App is used in two different ways, and who is legally responsible for your personal data depends on which applies to you.

A. Business Use — you use the App through your employer or another organisation

If your account was set up because your employer (or another organisation you work with) is a Transpoco customer, that organisation is the data controller of the personal data processed in the App — both your own account data as a user and the driver data displayed to you. It decides why and how that data is used — for example, which vehicles and drivers you can see and for what fleet-management purposes.

In this scenario, Transpoco acts as a data processor: we process personal data on the documented instructions of your organisation, under the Data Processing Agreement that forms part of our contract with them. Your organisation’s own privacy notice governs this processing. If you are a user, requests about your own account data should be directed to your account administrator; if you are a driver whose data is shown in the App and you want to exercise your rights, you should also contact the organisation as controller. You can always contact us and we will refer your request to your organisation without undue delay.

B. Individual Use — you use the App as an individual customer

If you signed up for the App yourself as an individual customer (for example, as an owner-driver or sole trader contracting with Transpoco in your own name), Transpoco is the data controller of your personal data collected through the App. In this case you are typically both the user and the data subject — you log in to view your own vehicle, journey and route data. We decide what data the App collects and why, as described in this policy, and you exercise your data protection rights directly with us. References in this policy to “your contract with us” mean the agreement you accept with Transpoco when you sign up for or order the App and related services.

3. Personal data we collect

• Login and authentication: your account is created and managed on the Transpoco Move platform, not in the App. When you log in, the App sends the email address and password you enter to our servers to verify them against your existing account; if they match, you are signed in. The App does not create accounts or collect your credentials — it uses them only to authenticate you.
• Fleet and driver data displayed in the App: to provide fleet-monitoring features, the App displays personal data about drivers and vehicles, including driver names and driver lists, the live position of vehicles on a map, journeys and routes, and daily summaries and reports. This information is recorded by your telematics hardware and retrieved from Transpoco’s servers; the App displays it to you rather than collecting it from your device.
• Driver contact numbers (call/text): where a driver’s contact number is stored, the App can display it and let you start a phone call or text message to that driver. The call or text is then made through your device’s own phone or messaging app, over your mobile network — Transpoco does not place the call, send the message, or see its content. The App simply passes the number to your device.
• Device, usage and diagnostic data: the App collects technical information about your device and how the App is used — such as device type, operating system version, app version, and usage events — through our analytics provider, and diagnostic information (crash logs and error reports) through our crash-reporting provider. We use this to keep the App working reliably and to improve it.
• Access details: we do not keep permanent device logs linked to your account, but we register your last access details so we can investigate issues you report.
• Service providers (sub-processors): we use third-party providers for hosting, infrastructure, maintenance, backup, payment processing, app usage analytics and crash reporting. These providers process data on our behalf under contract. The current, named list of our sub-processors is published in our Knowledge Base and is kept up to date; please refer to it for the specific providers we use at any given time.
• Your account administrator (Business Use): if you use the App through an organisation, your account administrator can access information in and about your account, including the content you submit, and controls how your account is accessed, retained or deleted.
• Legal requirements: we may disclose information where reasonably necessary to comply with applicable law, regulation, legal process or governmental request; to enforce our agreements; to protect the security or integrity of our services; or to protect Transpoco, our customers or the public from harm or illegal activity. Where the law allows, we will inform the affected customer before such disclosure.
• Aggregated or anonymised data: Transpoco may create anonymised, aggregated data products (for example, anonymised traffic data) in which no individual vehicle, driver or company can be identified. Anonymised data is not personal data.
• the destination country benefits from a European Commission adequacy decision;
• Standard Contractual Clauses approved by the European Commission are in place, giving your data the same protection it has in Europe; and/or
• supplementary technical and organisational measures are implemented where appropriate.
• access the personal data we hold about you and receive a copy;
• have inaccurate personal data corrected and incomplete data completed;
• have your personal data erased in certain circumstances;
• restrict the processing of your personal data in certain circumstances;
• receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability);
• object to processing based on legitimate interests; and
• withdraw consent at any time where processing is based on consent (for example, optional location sharing), without affecting the lawfulness of processing before withdrawal.

4. Why we use your data and our legal bases

We use personal data collected through the App to provide, operate, secure, support and improve the service. The table below sets out each purpose and the legal basis that applies, depending on how you use the App.

Our complete record of processing activities (RoPA) is available in our Knowledge Base. We do not use your personal data to train AI models without explicit consent; any use of data for AI/ML improvement is limited to aggregated, anonymised and de-identified data, as described in our Data Processing Agreement.

5. How we share information

We do not sell your personal data or Content. We share personal data only as described below:

6. International transfers

Data collected through the App is hosted with an ISO 27001 compliant hosting company based in the EU. Some of our service providers may be located in countries outside the European Economic Area that do not have equivalent data protection laws. Where we transfer personal data to such providers, we ensure at least one of the following safeguards applies:

7. How long we keep your data

We retain your account information for as long as your account is active. When an account is cancelled or deactivated, your account and data are deleted within 30 days, and any data on backups is deleted within a further 30 days, except where we must retain data to comply with legal obligations, resolve disputes or enforce our agreements.

If you use the App through an organisation (Business Use), your account administrator controls how your account information is retained and deleted while the contract is active. When the organisation’s contract with Transpoco ends, the organisation has 30 days to retrieve or export its data (including walkaround check records), after which the data is deleted as described above. Responsibility for retaining those records beyond that point — including for any statutory retention periods that apply to vehicle roadworthiness or safety records — rests with the organisation as controller.

8. How we protect your data

Personal data is stored on servers kept in a controlled environment with an ISO 27001 compliant hosting provider in the EU. Data transferred over the Internet as part of the App is encrypted in transit using industry-standard TLS (HTTPS). Transpoco maintains security procedures designed to protect your data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access, and our staff who access customer personal data are trained in handling it and bound by confidentiality obligations.

No security system is impenetrable, and we cannot guarantee that information transmitted over the Internet or stored on our systems will be absolutely safe from intrusion. If a personal data breach occurs, we will act in accordance with our breach-response obligations, including notifying affected business customers without undue delay and in any case within 24 hours of becoming aware, as set out in our Data Processing Agreement, and notifying supervisory authorities and affected individuals where required by law.

9. Your rights

Under the GDPR and applicable data protection law you have the right to:

How to exercise your rights

Individual Use: contact us using the details in section 12, or use your in-app account settings where available. We will respond to requests within one month, and we aim to provide an initial response within one week.

Business Use: your organisation is the controller, so please direct requests to your account administrator in the first instance. If you contact us directly, we will refer your request to your organisation without undue delay and assist it in responding, in accordance with our Data Processing Agreement.

Requests can be made in writing (email or support ticket). If a request is made orally, we will record the time and details of the request and confirm our understanding of it with you in writing. In limited cases data may not have to be erased, for example where retention is necessary for the establishment, exercise or defence of legal claims or where another legal exemption applies.

10. Our policy towards children

The App is not directed to individuals under 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information. If you become aware that a child has provided us with personal data, please contact us.

11. Changes to this policy

We may update this policy from time to time. The “last modified” date at the top shows when it was last changed, and any amended policy is effective upon posting to this page. We will make reasonable efforts to communicate significant changes to you by email or by notification inside the App.

12. How to contact us

Transpoco — E-pire Limited, trading as Transpoco, Dublin City University Alpha Innovation Campus, Old Finglas Road, Glasnevin, Dublin 11, Ireland.

Data Protection Officer: Barry Cronin — support@transpoco.com.

13. Complaints

If you wish to complain about how we have handled your personal data, please provide our Data Protection Officer with full details of your complaint and any supporting documentation using the contact details above or by opening a support ticket. Our DPO will endeavour to provide an initial response within 10 business days and to investigate and attempt to resolve your complaint within 30 business days, or such longer period as is necessary and notified to you.

You also have the right to lodge a complaint with a supervisory authority at any time. Our lead supervisory authority is the Irish Data Protection Commission (www.dataprotection.ie); you may also complain to the supervisory authority in the EU/EEA country where you live or work.