Notice for drivers and contacts

TOVR is used by transport companies. Some of the people whose data goes through it are not our users and never agreed to anything with us: • Drivers, whose employer connected a telematics system to TOVR. • Carrier and shipper contacts, whose details reached us from a freight exchange, from a customer's address book, or from an email thread. Art. 14 GDPR says we owe you this notice anyway, and it is written for you rather than for a lawyer. If you are a TOVR user, the Privacy Policy is the one you want.

For most of this data, your employer or the company that contacted you is the CONTROLLER — they decide what is collected and why — and we are their PROCESSOR. In that case they are the first place to ask, and we will help them answer you. For some of it — security logging, and improving how the platform matches freight — we are the controller in our own right. Either way you can write to us and we will route it: [email protected]. The company behind TOVR is „АНДИМАКС“ ООД ("Andimax" Ltd.), UIC 203076382, Bulgaria, Sofia 1113, Izgrev district, Iztok, 1 Samokov St., fl. 8, ap. 37. Full details are on the Imprint page.

If you are a driver: • Your name, and your driving licence number where the telematics system supplies it. • The vehicle you are assigned to, and where that vehicle has been. • Tachograph data: driving time, working time, availability and rest periods. • Eco-driving scores: harsh braking, idling, fuel consumption and similar behavioural metrics, where your employer's system produces them. If you are a carrier or shipper contact: • Your name, company, role, phone number and email address. • The emails, chat messages and calls exchanged with you through the platform, and transcripts of calls. • An AI-generated profile of you as a business contact: how quickly you reply, how you negotiate, how reliably a load you accepted was completed. This is stored in what we call contact intelligence, and section 6 explains what it is used for.

• From a telematics provider your employer connected: Frotcom, Mapon, Wialon, OBS, Volvo or ZF Transics. • From a freight exchange where a listing carried your contact details: TIMOCOM, LKW Walter, Trans.eu / Teleroute, Lardi-Trans, Cargopedia, Saloodo, CargoRadar or Transporeon. • From a TOVR customer who entered or imported your details. • From an email thread, where a user connected their mailbox and a message mentioning you was read to extract freight information. • From public company registers, for verification. The complete list of providers is on the Sub-processors page.

Driver records — Art. 6(1)(f) GDPR, legitimate interest, and Art. 6(1)(c) where your employer has a legal obligation under Regulation 561/2006 on driving times and Regulation 165/2014 on tachographs. The interest is planning transport that is legal to drive: a chain that would breach your rest period is a chain that must not be offered. Contact details and communications — Art. 6(1)(f). The interest is arranging transport with the company you work for. You gave your contact details to a freight exchange or to a business partner for exactly this purpose. Contact profiling — Art. 6(1)(f). See section 6. Security, abuse prevention and audit logging — Art. 6(1)(f). We never rely on your consent for any of this, because we would have no honest way to obtain it from you — which is precisely why Art. 21 gives you an objection right instead. See section 9.

We do build a profile of you as a business contact, and we would rather describe it than bury it. What it contains: derived scores for responsiveness, negotiating behaviour and reliability, plus AI-written summaries of past interactions. It is built from communications that went through the platform and from the outcomes of loads. What it does: it ORDERS a list. When a dispatcher looks for a carrier for a load, contacts likely to answer and likely to accept appear higher. It also feeds the draft of a message a dispatcher may send you. What it does not do: it does not decide anything. A human dispatcher chooses who is contacted, what is offered and who wins the load. Our position is therefore that this is not a decision based solely on automated processing producing legal effects concerning you or similarly significantly affecting you, and Art. 22(1) does not apply. We accept the consequence of taking that position: if we ever automate the award or the rejection end-to-end, that changes, and the safeguards in Art. 22(3) — human intervention, the right to express your point of view, the right to contest — apply. If you think a decision about you was in fact taken without a human, tell us at [email protected] and we will look and tell you what we find. You can object to the profiling on its own, without objecting to anything else — see section 9.

• The TOVR customer whose dispatchers you deal with, and nobody else's — tenant isolation is enforced on every query. • Our processors, listed on the Sub-processors page. Relevant to you in particular: our hosting provider in Germany, and Anthropic in the United States, whose model reads message contents and produces the profiling summaries. • Public authorities, only where we are legally required. We do not sell your data and we do not run advertising.

• Vehicle position history: 90 days, then aggregated so it no longer identifies a vehicle or a driver. • Driver records including tachograph hours: 12 months, unless your employer's own legal retention obligation requires longer — in that case it is their record and their period, not ours. • Contact details: while the business relationship is live, then 24 months. • Emails, chat messages and call transcripts: 24 months. Call audio: 30 days. • Contact intelligence profiles: 24 months from the last interaction, then deleted. Where we are your employer's processor, they can ask us to delete sooner and we will.

You can OBJECT. Art. 21(1) GDPR gives you the right to object, on grounds relating to your particular situation, to everything above that we base on legitimate interest — including the profiling on its own. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests. If you object to being contacted for direct marketing, we stop unconditionally, with no balancing. You also have the right to: • know what we hold about you and get a copy (Art. 15); • have it corrected if it is wrong (Art. 16) — this matters for eco-driving scores and profiles, which are derived rather than observed and can be wrong; • have it deleted (Art. 17); • have processing restricted while a dispute is resolved (Art. 18); • receive it in a machine-readable format (Art. 20). There is no charge, and you do not need an account. Write to [email protected] with enough detail for us to find you — the phone number or email address we would have reached you on, or the company you drive for. We answer within one month. We may ask you to confirm your identity. That is not an obstacle course: it is because sending your driving record to whoever asked for it would be a worse failure than a slow answer.

Tell us first if you can — [email protected] — because we can usually fix it faster than anyone else. You may also complain to a supervisory authority. Ours is Комисия за защита на личните данни (CPDP), Sofia, https://www.cpdp.bg/. You may equally complain to the authority in the EU country where you live or work.