Privacy Policy

1. Roles

The controller is Moneta Digi S.R.L., Str. Popa Tănase nr. 31D, Găești, jud. Dâmbovița, 135200, România, trade register J2026001579006, VAT RO53243922, email office@digiohs.com (Art. 13(1)(a) GDPR).

For account and billing data, we are the controller. For the operational data you upload about your drivers and contacts, you are the controller and we are the processor (see DPA).

2. Data we process

Account data (name, email, company, VAT id); authentication data (hashed passwords, TOTP secrets encrypted at rest); operational data (orders, vehicles, drivers incl. tacho card, positions, compliance records); technical logs (audit trail, IP, timestamps).

3. Purposes & legal bases

Providing the Service (contract); security and fraud prevention (legitimate interest); legal compliance (legal obligation); billing (contract/obligation). Driver GPS tracking is processed on your behalf under your legal basis.

Service statistics about PLACES AND PROCESSES, never about people (legitimate interest, Art. 6(1)(f) GDPR). We measure how long operations take at a loading or unloading site, how accurate our own estimates are, and how well our address lookups perform. This is how the estimated times we show you get better. We do not build profiles of, score, rank or evaluate drivers, and no product feature produces automated assessments of a person.

3a. Your data stays yours

The statistics above are computed from your own history and shown back to you. They are not pooled with other companies: today, no measurement of yours leaves your account. If we ever offer shared per-site figures, it will be opt-in, described here before it starts, and revocable at any time.

4. Retention

We keep data for the life of the account and as required by law. Raw track points record the vehicle, its coordinates, speed and time — not the driver. They are kept at full resolution and automatically thinned to one point every 15 minutes after 12 months. A customer company can ask for a shorter retention, which is then enforced for that company only and logged in its audit trail. Tacho files are retained per legal deadlines (e.g. 13 months); driving-time, posting and working-time records are kept for the periods required by transport and labour law.

5. Sub-processors

We use vetted sub-processors (hosting in the EU, email delivery, maps/geocoding, telematics connectivity, payment processing). A current list is available on request; the DPA governs their use.

6. Security

Row-level tenant isolation in the database, encryption in transit, secrets/PII encrypted at rest, hash-chained audit logs, least-privilege access. Mobile tokens are stored in the device Keychain/Keystore.

7. Your rights

Access, rectification, erasure, restriction, portability and objection under the GDPR. Contact office@digiohs.com. You may also lodge a complaint with your data protection authority.

7a. Deleting your data

To ask for your data to be deleted, write to office@digiohs.com from the address associated with the account, or ask your employer to do it for you. We answer within one month, as required by Art. 12(3) GDPR.

The app does not create accounts: a driver account is created by the transport company that employs the driver. For everything that company uploads about its drivers, vehicles and trips, that company is the controller and we only act on its instructions — so a driver asking us directly will be pointed to their employer, and we will notify the employer of the request.

When a customer company closes its account, its operational data is deleted, except records we must keep by law (for example tachograph files and driving-time, posting and working-time records, which transport and labour law require us to retain for set periods). Backups age out on their own schedule.

8. International transfers

Data is hosted in the EU. Where a transfer outside the EEA is necessary, it is covered by appropriate safeguards (e.g. Standard Contractual Clauses).