Privacy Policy – ViaNexis Driver

1. Introduction and scope

This notice covers the processing activities connected with installing, registering for, and using the ViaNexis Driver App day to day — including document handling for shipments, messaging, e-signature capture, and diagnostic data generated automatically by the device. It applies to drivers, as well as to any other person who uses the Driver App or its connected company-facing surfaces (for example a dispatcher or company administrator), to the extent their data appears within the app.

This notice does not cover the carrier company's own internal HR or payroll systems, nor any processing that happens between the carrier company and its customers outside the app. Where a carrier company processes driver data outside the Driver App (for example, paper-based personnel records), that processing is governed by the carrier company's own privacy policy.

2. Controller details

The ViaNexis service is operated by Atilla Turul, a sole proprietor registered in Hungary. The identification details below describe the operator's capacity as controller for account-, platform-, and security-level processing carried out in connection with the app.

• Operator / data controller: Atilla Turul, sole proprietor
• Registered seat: 5093 Vezseny, Földvári utca 22., Hungary
• Hungarian tax number: 79264161-1-36
• EU VAT number: HU79264161
• Registration number: EV 61994454
• Privacy contact: privacy@vianexis.eu / gdpr@vianexis.eu
• Legal contact: legal@vianexis.eu

3. The roles of ViaNexis and the carrier company

The roles of ViaNexis and the carrier company are not uniform across every data flow. They depend on the purpose of the processing, the contractual model, and who determines the purposes and means. The separation below is informative and may vary by the specific relationship.

ViaNexis may act as an independent controller for, among other things, account authentication, platform security, access management, its own support and privacy-request handling, and system-operation logs — where ViaNexis determines the purposes and means.

The carrier company may act as an independent controller for, among other things, transport assignments, work organisation, customer and consignee data, company document requirements, and employment-related processing — where the company determines the purposes and means.

ViaNexis may act as a processor for shipment data handled on the carrier company's instructions, company documents, and dispatcher or administrative workflows. If you are unsure whom to contact, you may contact either party and we will help route the request.

4. Data subjects

The processing described in this notice primarily concerns drivers using the Driver App, who may be employees of the carrier company or independent contractors/subcontractors under a contractual relationship with it. It may also concern carrier company staff (dispatchers, fleet managers, administrators) who use the company-facing surface to assign shipments, upload documents, or exchange messages with drivers.

• Drivers (as employees or contractors)
• Company administrators, dispatchers, and fleet managers
• Third parties whose data appears on an uploaded document (e.g. a consignee's signature, or a sender's/recipient's contact details on a CMR)
• People who contact customer support

5. Categories of data we process

The main data categories processed through the Driver App are listed below. The exact scope varies by feature, and some categories (such as location data) are only generated if the relevant permission has been granted.

• Account data: full name, email address, phone number; authentication data: passwords are stored using a one-way salted hash; the original password is not stored; company code or company identifier; language preference
• Shipment-related data: shipment identifier, route/stop details, status updates, timestamps
• Location data: GPS coordinates, if the user grants permission, and only while an opened location-dependent feature is in use (see Section 8)
• Documents and media: photographs, videos, scanned or photographed transport documents, damage-assessment images — when the feature is used
• E-signature and evidence data: the signature capture itself and associated timestamp; location data if the user records it during that feature
• Messages: the content of in-app messages exchanged between a driver and a dispatcher or company contact
• Push notification identifier (token) and the installation/device identifier used for push-device registration, platform label, locale and timezone settings
• Security and operational log events: for example login and access events to the extent needed for service security
• The content of customer-support and privacy-request communications

6. Sources of data

Most of the data comes directly from you: information provided at registration, documents and photos you upload, messages you write, and signatures you capture. Some data is entered or generated by the carrier company's administrator or dispatcher on the company-facing surface (for example, assigning a shipment or creating a driver profile).

Other data is generated automatically by the device and the app itself (for example, diagnostic data, or location data where permitted). Finally, some data originates from third parties — for instance, when a consignee's signature appears on a transport document, or when a customer's contact details are included on an uploaded document.

7. Purposes and legal bases

We process data for the purposes and on the legal bases listed below. A given piece of data can serve more than one purpose. A phone system permission (for example location access) may be a technical prerequisite; it does not by itself replace a GDPR legal basis.

• Account and authentication: account creation, sign-in, password/PIN handling, access provisioning — performance of a contract (GDPR Art. 6(1)(b)), and legitimate interest to the extent needed for platform security (GDPR Art. 6(1)(f))
• Platform security: abuse prevention, detection of unauthorized access, session/token handling, system-operation logs — legitimate interest (GDPR Art. 6(1)(f))
• Carrier-company shipment workflow: assignments, statuses and company workflows — typically performance of the contract/relationship between the driver and the carrier company; where ViaNexis acts on the company's instructions, processing under the company's controller instructions. The concrete legal basis may depend on the company contract and roles
• Operational document handling: transport documents, uploaded photos/videos and related records as part of the shipment workflow — under the company/contractual model; whether ViaNexis or the carrier company is the controller depends on the specific data flow
• Optional location-dependent feature: displaying own position or recording a trip-related location — processing for the feature's contractual or legitimate-interest purpose; mobile OS permission is a technical prerequisite and is not by itself GDPR consent, and can be withdrawn in device settings
• Operational push notifications: delivering shipment-related push notifications — performance of a contract / legitimate interest for operating the service, together with system notification permission (OS permission does not replace the GDPR legal basis)
• Support: handling customer-support requests — legitimate interest (GDPR Art. 6(1)(f))
• Privacy requests: receiving and handling privacy and account-deletion requests — compliance with a legal obligation and/or legitimate interest (GDPR Art. 6(1)(c)/(f))
• Legal claims: establishing, exercising or defending legal claims — legitimate interest and, where applicable, legal obligation
• Legal obligations: retaining records required by law — compliance with a legal obligation (GDPR Art. 6(1)(c)), where applicable

8. Location data

The current app version does not request continuous background location access. Location data may be processed only while the user is actively using a location-dependent feature, for example to display their own position or record the location of a trip-related event.

The Driver App processes location data only with the mobile operating system's permission (Android: ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION; no ACCESS_BACKGROUND_LOCATION in the current manifest). The app is not used for covert employee monitoring, and the current release does not claim continuous route tracking or automatic background arrival/departure detection.

You can revoke this permission at any time in your phone's system settings. Revoking it carries no penalty, but location-dependent features may then work in a limited way or not at all. Where location is recorded during a feature, the carrier company may access it only to the extent its permissions allow and as needed for shipment coordination.

9. Camera, photos, videos, and files

The app may request camera access to capture documents, cargo damage, load condition, or other shipment-related situations. Instead of using the camera, you can also choose an existing photo or file already stored on your phone. Captured photos, videos, and files are associated with the relevant shipment and the carrier company's related workflow (e.g. claims handling, customer support), and are retained in line with the principles described in Section 18.

10. Transport documents and personal documents

The Driver App allows you to upload photographed or scanned copies of transport documents (e.g. CMR consignment notes, delivery notes, customs documents) and certain personal documents (e.g. driving licence, ADR certificate). These documents often contain the personal data of third parties (sender, consignee, recipient), which we process as an inherent part of the transport workflow.

It is your responsibility as a driver to upload only documents you are entitled to handle and that genuinely relate to the shipment in question. This obligation does not affect the applicable data-protection responsibilities of ViaNexis or the transport company. Access to uploaded documents is restricted by permission level: a carrier company can only see documents tied to its own shipments.

11. E-signatures and evidence

The Driver App lets you capture an electronic signature (a touchscreen signature drawing) to confirm shipment events such as pickup or delivery. Alongside the signature, we may also record supporting data such as the timestamp and — where permitted and recorded during that feature — location data, because together these can serve as evidence in the event of a dispute.

The evidential value and legal effect of a recorded signature depend on the type of document, the circumstances of capture, and the applicable law. ViaNexis does not guarantee that a recorded signature qualifies as a qualified electronic signature in every country or procedure, or that it is by itself fully conclusive evidence. See Section 16 of the Terms of Use for more detail: https://vianexis.eu/en/terms#electronic-signatures-and-evidence

12. Messages and translation

The Driver App includes a built-in messaging feature between a driver and a dispatcher or company contact. Machine translation is treated as active processing only where it is actually enabled in the relevant environment; this distributed release does not claim an active external translation vendor. Where available, it is a convenience feature — it does not replace certified translation and can be inaccurate. For critical content, human confirmation is recommended.

Message content may be logged and retained in connection with the relevant shipment, in accordance with the principles in Section 18, including for the purpose of clarifying disputes.

13. Device, security, and diagnostic data

In the current app version, push-device registration may process an app-generated installation/device identifier, a platform label, locale and timezone settings, and a push token. For service security we may log login and access-related events.

Based on the current code audit, we do not claim that the distributed Driver App uses a separate analytics SDK, Crashlytics, or automatic crash-reporting service, and we do not claim routine standalone collection of device manufacturer, OS version, or network connection type. If a later release introduces such processing, this section will be updated before that release.

14. Push notifications

To deliver push notifications, the app may use Firebase Cloud Messaging (FCM) and store a push token tied to your device/installation. This allows notifications about important shipment-related events such as a new assignment, a document request, or an incoming message. Push notifications can be turned off in your phone's system settings. See Section 16 for information about providers involved in delivery.

15. Automated checks and artificial intelligence

The Driver App may include automated assistive features (for example on-device text recognition or translation preparation). These features are advisory only and do not make legal decisions without human involvement.

Not every such feature is active in every environment in the current release. Where machine translation or document assistance is available, it does not replace certified translation or legal, customs, or ADR compliance decisions. Final responsibility rests with the driver and the carrier company.

16. Processors and other recipients

Recipients needed to operate the service may process data. Code-verified active categories may include in particular: the backend/hosting operator, database and file-storage services, push delivery (FCM and, where applicable, APNs), and the carrier company with which you have a driver relationship.

Email delivery, map-tile providers, cloud AI/OCR, or external monitoring are treated as active processors only where actually enabled in the relevant environment; planned or staging-only providers are not listed as active processors. Whether Article 28 GDPR contracts exist must be verified per provider and environment; this page does not claim a blanket Article 28 contract with every provider.

The current environment-specific list is available on request at privacy@vianexis.eu.

17. International transfers

Where push notifications are delivered via FCM, personal data (for example a push token and related device-registration data) may be transferred outside the EEA, including to the United States, through Google's push infrastructure. Hosting, storage, or email-delivery regions depend on the actual operational configuration.

Detailed information about the specific safeguard used for a given provider (for example an adequacy decision or another mechanism under GDPR Chapter V) is available on request at privacy@vianexis.eu. This page does not state SCCs or an adequacy decision as a verified fact without supporting provider documentation.

18. Retention

We retain data by category for as long as needed for the relevant purpose. We publish a concrete period in days or years only where an approved internal rule or legal obligation confirms it. Where no such decision exists yet, we apply event-based principles:

• Account data: for the life of the account, then until deletion/anonymisation is completed
• Session/token: until the token is revoked or becomes invalid
• Push token: until the token is revoked, replaced, or the account/device registration ends
• Shipment data: until the end of the legal and company retention period tied to the shipment
• Documents: for as long as required for the shipment and the company's legal/accounting obligations
• Signatures: for the retention period of the related shipment/record
• Location data: for the limited time needed for the specific feature/event purpose
• Messages: for as long as needed for the shipment and support/dispute handling
• Technical/operational logs: for the limited time needed for security and operations
• Security audit logs: for the limited time needed for accountability and security
• Support logs: until the request/case is closed and for as long as needed for accountability
• Privacy request / account deletion request: until the request is closed and for as long as needed for accountability

19. Account and data deletion

Signing out, uninstalling the app, unlinking from a company, and suspending an account are not the same as permanent account and data deletion. Permanent deletion is a separate request.

Request deletion of your account and associated data: https://vianexis.eu/en/driver-app/account-deletion

The system records the request as an operational case record; the request itself does not trigger immediate automatic full data deletion. After identification, deletable account data may be deleted or anonymised; data may remain where required by law, security, fraud prevention, audit, contract, or legal claims. Operative use of retained data is restricted. The requester receives further information at the contact address provided. The neutral acknowledgement does not disclose whether an account exists for the submitted details.

20. Your rights as a data subject

Under the GDPR you have the rights listed below in connection with the processing of your personal data. You may send requests to privacy@vianexis.eu or gdpr@vianexis.eu. We will respond without undue delay and, as a rule, within one month of receipt. Taking into account the complexity and number of requests, that period may be extended by a further two months; we will inform you of any such extension and the reasons for the delay within the first month.

• Right of access: you can ask whether we process data about you, and if so, what data
• Right to rectification: you can ask us to correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): in certain cases, you can ask us to delete your data
• Right to restriction of processing: in certain situations, you can ask us to temporarily limit processing
• Right to object: where processing relies on legitimate interest, you can object to it
• Right to data portability: you can ask to receive data processed on the basis of consent or contract in a structured, machine-readable format
• Right to withdraw consent: you can withdraw consent-based processing (e.g. location, push notifications) at any time, without needing to give a reason

21. Complaints and remedies

If you believe our processing of your data breaches applicable law, we encourage you to contact us first at privacy@vianexis.eu or gdpr@vianexis.eu so we can address the issue as quickly as possible. You may also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or with the supervisory authority in your own EU member state of residence, workplace, or the place of the alleged infringement.

• NAIH — Hungarian National Authority for Data Protection and Freedom of Information
• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Website: naih.hu

22. Security

Based on the code audit, we apply verified technical and organizational measures to protect personal data. These include, among others: TLS-encrypted transmission between the app and backend systems; storage of passwords as bcrypt salted hashes (the original password is not stored); role- and tenant-based access control; security and accountability audit logging; session/token revocation; and limited support access on a need-to-know basis.

We do not claim end-to-end encryption, nor that all data is protected by at-rest encryption, and no system can be considered unbreachable. If you suspect a data breach, report it to security@vianexis.eu.

23. Minors

The Driver App and its features are designed exclusively for adult drivers holding a valid driving licence or relevant professional qualification, and for the company users who manage them. The app is not directed at minors, and we do not knowingly collect personal data from minors. If we become aware that we have processed a minor's personal data through the service without a lawful basis, we will take the necessary steps to delete the data or restrict its processing, taking into account applicable legal retention obligations.

24. Changes to this notice

We may update this notice from time to time — for example, due to changes in law, the introduction of a new feature, or a change in our providers. The version number, effective date, and last-updated date shown at the top of this page always let you check whether you're reading the most current version. For material changes, we will provide notice through an in-app notification or by email. We recommend reviewing this notice periodically.

25. Contact

If you have questions, requests, or concerns about how we handle your data, you can reach us using the contact details below.