Privacy notice

The controller responsible for your data in this app is your employer:

Data protection officer: [NAME AND CONTACT, if one is appointed].

This notice is for the drivers and the office staff (dispatchers and administrators) who use the dispatch app for their work. The app is used only for work: each driver sees only the truck they are assigned to, and the office sees all trucks.

• To send transport orders to the right truck and follow their progress (confirmed, loaded, delivered).
• For communication between the office and the drivers (chat, photos, files, alerts on the phone).
• As proof of delivery and for handling claims: signed CMR, photos of the goods, seals and documents.
• To keep order records for invoicing, accounting and disputes with customers.
• To keep the app secure: sign-in, blocking lost phones, and a record of changes made by the office.

• Performance of the employment contract (Article 6(1)(b) GDPR): receiving and carrying out work orders and communicating about them is part of your job.
• Legitimate interest of the company (Article 6(1)(f) GDPR): organising transport reliably, proving delivery to customers, defending legal claims and keeping the system secure. We have weighed these interests against your rights and keep the data to the minimum needed (for example, no location tracking).

We do not ask for your consent, because in an employment relationship consent is not considered freely given. That is why the app has no "I agree" screens: the legal bases above apply instead.

• Name and username.
• Phone number, if you gave it to the office.
• Which truck you are assigned to, and since when.
• Chat messages between you and the office, including a location you choose to send: a point picked on the map, or your phone's position at the moment you press “Send my current location”.
• Photos and files you send or receive, including CMR and other transport documents.
• Order status times: when an order was seen, confirmed, and when you arrived, loaded, departed, unloaded or reported a problem.
• Push device tokens: a technical address of your phone's browser so it can receive alerts, and the phone type.
• Sign-in logs: time of sign-in, IP address and browser/device type.
• A record of changes made by office staff (who created or changed orders and accounts, and when).

• No GPS or location tracking. The app only learns where your phone is when you press “Send my current location” in the chat, and then only that one position, sent as a chat message.
• The app cannot read your contacts, calls or photo gallery. It only receives the photos and files you choose to send.
• No automated decision-making or profiling (Article 22 GDPR).

• Office staff of ALLSTATE - TRANS d.o.o., only as far as they need it for their work.
• Our hosting provider in the EU, [HOSTING PROVIDER], which stores the data on our behalf under a data processing agreement (Article 28 GDPR).
• The push services of Google (Android, Chrome), Apple (iPhone, Safari) and Mozilla (Firefox), which deliver alerts to your phone. They receive only your phone's push address and a short, content-free alert such as "New order" with the truck plate — never addresses, customer names, messages or photos.
• The company's accounting archive, which receives exported order documents (PDF and CMR copies).
• Courts and authorities, only where the law requires it.

The app's data is stored in the EU. The push services may be operated by companies outside the EU (for example in the USA); only the push address and the content-free alert are sent to them, under the EU–US Data Privacy Framework or standard contractual clauses. [To be confirmed by the lawyer.]

• Chat messages, photos and files: 60 days, then they are deleted automatically.
• Documents attached to an order (CMR, photos, files): 60 days after the order is delivered or cancelled. Before they are deleted, the CMR copies are exported to the company's accounting archive, where the accounting retention rules apply.
• Deleted data can remain in the nightly database backups for up to 14 more days, until the backup is deleted.
• Order records (order numbers, addresses, status times — text only): 24 months.
• Sign-in records: while the sign-in is valid, at most 90 days.
• Push addresses: until you sign out, your account is blocked, or the phone stops accepting alerts.
• Your account (name, username, phone): while you work with us, and deleted [X MONTHS] after you leave, unless the law requires us to keep something longer.

You can ask us, free of charge, to:

• tell you which data we have about you and give you a copy (Article 15 GDPR);
• correct wrong data (Article 16);
• delete data we no longer need or may not keep (Article 17);
• restrict the use of your data, for example while a correction is checked (Article 18);
• give you the data you provided in a common electronic format (Article 20);
• stop using your data where we rely on legitimate interest, for reasons relating to your particular situation (Article 21).

Write to [E-MAIL] or ask in the office. We answer within one month.

You can also complain to the Croatian data protection authority: Agencija za zaštitu osobnih podataka (AZOP), azop.hr.

The data is needed to give you work orders and to communicate with you through the app as part of your job. Without it the office cannot dispatch orders to you through the app. If you have concerns, talk to the office: [ALTERNATIVE ARRANGEMENT].

If we change how the app uses data, we will update this notice and tell you in the app.