TruckTrace privacy policy

1. Who we are

TruckTrace is an Android app published by Tarlabs., the company that runs CargoPay (cargopay.eu). Drivers install it when the carrier they drive for uses CargoPay to show a delivery's progress on a map. This policy covers the app and the positions it sends. Our general privacy policy covers the rest of CargoPay.

Your carrier, the company that gave you the driver token, decides to track its truck and is responsible for your location data (the "controller" under the GDPR). Tarlabs. runs the app and stores the positions on the carrier's behalf and on its instructions (the "processor"). Tarlabs. is responsible only for the data it keeps to run its own servers, such as the request monitoring in section 2.

Contact: info@tarlabs.es

2. What the app collects

The app does not collect your name, phone number, contacts, photos, files or messages, the battery level, the names of nearby Wi-Fi networks, or any advertising ID. It contains no advertising and no analytics. Your carrier may have entered your name when it created your token, in its own CargoPay account; the app never sends it.

3. Location in the background

Before it collects any location, the app shows what it sends and asks for your agreement. After that it asks for Android's location permission, including "Allow all the time".

While sharing is on, TruckTrace sends the phone's position in the background, even when the app is closed or not in use: about every 10 minutes while the truck is moving and about every 15 minutes while it is parked. Android shows a notification while it runs.

You can pause sharing at any time with the button on the app's main screen or from the notification. While sharing is paused the app takes no new positions. Positions taken without mobile signal stay on the phone and are sent when signal returns, including ones taken just before a pause; CargoPay discards any that are more than 15 minutes old when they arrive.

4. How the position is found

Android works out the position. In the version on Google Play, Android's location service from Google Play services does this, using GPS, Wi-Fi and mobile networks. Google's handling of that data is described in Google's privacy policy.

The "High-accuracy location" switch in the app's phone settings, on by default, makes the app use GPS whenever it can. Turning it off saves battery, but positions taken while driving can then be 1 km or more off. The app does not turn positions into street addresses.

5. Why the positions are used, and when they are recorded

• So that the carrier that gave you the token, and the people it shares the trace with, can follow the delivery on a map
• So that the carrier can see when the truck last reported its position

CargoPay records positions only while your carrier has an active trace for your truck. A position that arrives when there is none, or that was taken before the trace started, is discarded on arrival.

Positions are not used for advertising, are not sold, and are not used for any other purpose.

6. Who can see the positions

• Your carrier: its users in its CargoPay account see the truck's plate and the positions with the details recorded with them
• Anyone your carrier gives the trace link to, usually its customer: while the trace is active, the link shows the truck's plate, the positions with their time and accuracy, and the shipment's origin, destination and reference when one is attached. It shows no speed and no driver name.
• Tarlabs., when needed to run and support the service, and the providers that host it for us
• Honeycomb, which runs our request monitoring: for each request it receives the time, the page requested, the app's name and version and the shortened IP address, never the position or the token, and keeps them for 30 days
• Authorities, when the law requires it

7. How long it is kept

• Positions: deleted 30 days after the trace ends, either because the carrier revoked it or because its end date passed
• The trace itself (the truck's plate, its dates and when sharing was first accepted) stays in the carrier's CargoPay account as the record of the service it paid for
• On the phone: the token and the app's settings stay until you uninstall the app or clear its data. If Android backup is on, Android can copy them, token included, to your Google account's backup and restore them on a new phone.

8. Security

The app sends positions only over an encrypted (HTTPS) connection to cargopay.eu. Anyone who has your driver token can send positions for your truck, so do not share it; if you think someone else has it, tell your carrier.

9. Your choices and rights

Your carrier decides on which legal basis it tracks its truck and should have told you. Before it starts, the app shows you what it sends, and you can pause sharing at any time or uninstall the app; positions already recorded stay until they are deleted as described in section 7.

Under the GDPR you can ask for a copy of your data, its correction or deletion, a restriction of its use or its transfer to you, and you can object to its use. Send these requests to your carrier. If you write to us at info@tarlabs.es instead, include the truck's plate and your carrier's name: we pass the request on to your carrier and help it answer. For our own request monitoring we answer you directly, within one month. You can also complain to your country's data protection authority, or to Spain's (Agencia Española de Protección de Datos, aepd.es).

10. Age

TruckTrace is for professional drivers and is not meant for anyone under 18.

11. Changes to this policy

If the app changes what it collects, we update this page and the date below.