Privacy Notice

Truckzly handles personal data in two different capacities, and almost everything else on this page depends on which one applies to you.

As a controller. For the people we deal with directly — someone who signs up, an administrator we invite, a person who emails us, a billing contact — we decide why and how their data is used. This notice describes that.

As a processor. For the data an operator puts into Truckzly about its own business — its drivers, its vehicles, its customers, its documents — the operator decides why and how, and we act on its instructions. That processing is governed by our Data Processing Agreement.

R&R Haulier Solutions S.R.L., a company registered in Romania under trade register number J2018000331091, with its registered office at Str. Ing. Anghel Saligny nr. 24, et. 4, cam. 406, 810015 Brăila, Romania, VAT number RO39344468, is the controller for the processing described under What we handle as controller, and why.

For any question about this notice, or to exercise a right, write to contact@truckzly.com.

Most people whose data passes through Truckzly never chose it: your employer bought the system, and it now holds your name, your driver card data, your driving and rest hours, and the position of the vehicle you are in.

Your employer decides all of it. They chose to collect it, they decide how long to keep it and who inside the company can see it, and the law makes them responsible for telling you about it and for having a lawful basis to do it. In data protection terms they are the controller and we are their processor.

What this means in practice. If you want to see your data, correct it, object to it, or have it deleted, ask your employer — they hold those decisions, and we are not permitted to act on such a request from you directly without their instruction. If you contact us anyway, we will not ignore you: we will tell you who the controller is and pass your request to them without undue delay.

What we do not do with it. We do not use your data for our own purposes. We do not sell it, we do not use it for advertising, we do not use it to train artificial intelligence models, and we do not share it between different operators. Access inside Truckzly is restricted to the operator you work for. The one exception is a delivery link that your employer chooses to create, described next.

If your employer shares a delivery link. Your employer can choose to let the customer at a delivery stop follow that delivery through a link, without an account. That is your employer's decision, as controller: ask them. What the person holding the link can see is limited:

• only that one stop, never the other stops of the trip, and never the whole route
• the stop's status, an estimated arrival window, and the vehicle's registration number (your employer can switch that off)
• the vehicle's position, only while it is on its way to that stop, delayed by about two minutes and rounded to about 100 metres. Not before loading, and not after the delivery is done
• when the vehicle has been stopped for about 30 minutes, such as a break or an overnight rest, only the area and the time it stopped, not where it is parked
• never your surname, phone number or photo, your speed, your driving history or tachograph data. Your employer can choose to add your first name

The link stops working shortly after the delivery, and your employer can end it at any time.

You can complain to a supervisory authority at any time — see Your rights.

A company that uses Truckzly can send you a link showing the progress of a delivery. The company that sent it decides what the page shows and is responsible for that information; ask them about it. We provide the page on their behalf.

What we record about your visit. When you open the link we record the time, which link it was, a shortened form of your network address (its last part removed) and your browser type. We use it to detect abuse and keep the page secure, and for nothing else. For this record we are the controller. Our lawful basis is our legitimate interest in the security of the service. We keep it for 30 days.

What we do not do. The page sets no cookies and has no analytics or advertising. The company that sent the link is told how many times it was opened and when it was last opened, and never your address.

You have the rights described under Your rights for this record. Write to contact@truckzly.com.

Account and identity data — name, work email address, the organisation you belong to, your role, sign-in credentials in hashed form, multi-factor settings, and sign-in and session records. Used to create and secure accounts and to give the right people the right access. Lawful basis: performance of the contract, and our legitimate interest in keeping accounts secure.

Billing data — billing contact and email address, the device services and subscriptions on the account, invoices, and the usage those charges are calculated from. Card details are entered into fields served by our payment provider and never reach us. Used to charge for the service and to meet accounting and tax obligations. Lawful basis: performance of the contract, and legal obligation.

Support and correspondence — what you write to us and what we write back. Used to answer you and to keep a record of what was agreed. Lawful basis: performance of the contract, and our legitimate interest in running a support function.

Security and audit records — sign-in attempts, privileged actions, and technical logs. Used to detect and investigate abuse and to keep the service secure. Lawful basis: our legitimate interest in the security of the service and our customers' data.

Whether you have to give it. Account and billing data are required to enter into and perform the contract: without them we cannot open an account, give you access or invoice you, so the service cannot be provided. Billing records are additionally required by Romanian accounting and tax law. Everything else you send us — what you write to support, for instance — is voluntary, and not sending it only limits what we can help you with.

The marketing website you are reading runs no analytics and no advertising or tracking scripts. Its contact, quote and support forms use Cloudflare Turnstile, a security check against automated spam. To run it, your IP address, browser user agent and TLS fingerprint go to Cloudflare, and it may keep a short-lived security token in your browser. We do this because we have a legitimate interest in keeping the forms free of abuse. Cloudflare acts as our processor for the check, and as a controller in its own right for improving Turnstile's bot detection.

The applications set only cookies that are strictly necessary to operate them, or that record a preference you set yourself; under the ePrivacy rules neither kind requires consent. Each one is named, with what it does and how long it lasts, in our Cookie Notice.

We do not sell personal data and we do not share it for advertising. Personal data reaches other companies in only four situations.

Service providers acting for us. We use providers for hosting and infrastructure, database and file storage, transactional email, payment processing, mapping and routing, push notification delivery, abuse prevention, and artificial intelligence inference. Each is bound by a written contract limiting it to acting on our instructions. Customers can obtain the current list, naming each provider and what it receives, by writing to contact@truckzly.com.

When an operator creates a delivery link. An operator that uses Truckzly can choose to show the progress of one delivery stop to the person holding a link, without an account. That person sees only what the operator chose to show, within the limits described under If you are a driver, employee or contact of an operator. We make it available on the operator's instruction, and do not choose who receives the link.

Where the law requires it. If we receive a binding legal request we will assess it, and disclose only what we are actually obliged to. Where we are permitted to tell you, we will.

If the business changes hands. In a merger, acquisition or sale of assets, data may transfer to the acquirer. You would be told, and this notice or its equivalent would continue to apply.

The service runs in the European Union: the database holding your records and the applications you use are hosted in the EU.

Some of the providers we use are established in the United States — in particular for transactional email, the spam check on our forms, part of the mapping stack, push notification delivery and artificial intelligence inference. Those transfers rely on the European Commission's Standard Contractual Clauses under Article 46, or, where a provider is certified under the EU–US Data Privacy Framework, on the Commission's adequacy decision for that framework under Article 45, together with additional technical and organisational measures. A copy of the clauses relied on for a particular transfer is available by writing to contact@truckzly.com.

We keep personal data for as long as it is needed for the purpose it was collected for, and then delete it.

• Account data — for as long as the account exists. After an account is closed we retain it for 30 days so that it can be exported or reactivated, then delete it.
• Billing records — for the period Romanian accounting and tax law requires, which is longer than the account itself.
• Security and audit records — 24 months.
• Records of visits to a delivery link — 30 days.
• Customer data we hold as processor — for as long as the customer instructs, subject to the periods below. Operators have their own statutory retention duties, particularly for tachograph records, and we will not delete data out from under those obligations without instruction.

Where the platform enforces a period itself, these are the periods. They run automatically, every night, whether or not anyone asks:

• Vehicle position records — 3 months.
• Vehicle engine and CAN bus records — 13 months.
• Tachograph files — each file carries its own expiry date, set when it is stored and currently about 12 months. A file can be placed on legal hold, which stops the automatic deletion for as long as a dispute or an investigation needs it kept.
• Records you archive — 30 days after archiving, then deleted.

If an operator needs vehicle positions for longer than the period above — for a dispute, an insurance claim or an inspection — they should export them before it elapses, because the deletion is automatic and cannot be reversed afterwards.

Deleted data is removed from backups as those backups age out on their normal cycle.

Access to data is restricted by organisation and by role, enforced below the application rather than only in it. Data is encrypted in transit, access to production systems is limited to the people who need it, multi-factor authentication is available and recommended, and privileged actions are written to an audit record that cannot be edited afterwards. The measures we owe our customers contractually are set out in our Data Processing Agreement.

We do not hold ISO 27001, SOC 2 or any comparable certification.

If a personal data breach occurs, we will notify the supervisory authority and affected customers as the GDPR requires. Where we act as processor, we notify the customer without undue delay so that they can meet their own obligations.

Where we are the controller, you have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we relied on it.

Write to contact@truckzly.com. We will respond within one month, and tell you if we need longer because the request is complex. There is no charge. We may need to verify who you are before acting.

Where we act as a processor for an operator — which includes almost everything about drivers — the request has to go to that operator. See If you are a driver, employee or contact of an operator.

We do not make automated decisions that produce legal or similarly significant effects about individuals.

If you are unhappy with how we have handled your data you can complain to a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP). You may also complain to the authority where you live or work.

We update this notice when what we do changes. The date at the top shows the version in force. Where a change materially affects you, we will tell account administrators by email.