North Route Drivers Privacy Notice

North Route Systems Ltd provides the service. We are registered in Scotland, company number SC893550, at 65 Glensax Road, Peebles, Scottish Borders, EH45 9AP, United Kingdom. Contact Jay@northroutesystems.com about privacy or your information.

Your transport operator is normally the controller for driver, duty, safety, compliance, timesheet, message and location records: it decides why they are used and who in its organisation needs access. North Route Systems processes these records on the operator's documented instructions. We are separately responsible as controller for our own account administration, security, support and legal records.

Information comes from you, your device, your operator's authorised users and records generated as you use the service.

• Account and profile: your name, work contact details, sign-in credentials, account and linked driver identifiers, company, depot, access status and an optional profile photo. These identify your account and connect you to the correct operator and work.
• Duties and vehicles: allocated jobs, routes, customer or passenger instructions, vehicle details, acceptance, progress and completion times. These support the work assigned to you.
• Qualifications and compliance: licence categories, checks and expiry dates; CPC checks, hours and renewal dates; tachograph-card checks and renewal dates; and medical-check requirements, evidence status and renewal dates supplied by Operations. The app displays document names, categories and expiry details. Associated documents may be held by your operator in the connected Operations service. Medical information can be health data and needs additional protection.
• Walkarounds and defects: answers, mileage, timings, declarations, defect descriptions, selected photographs and review or release decisions. These create safety records and let Operations manage reported problems.
• Timesheets: recorded driving, other work, breaks and availability, notes, submissions, changes and review decisions. These support working-time records and your operator's review.
• Messages: messages to and from your company's Operations team, related work references and delivery or read status. These support operational communication.
• Location: precise coordinates, capture time and duty, vehicle and driver identifiers while foreground duty sharing is active. Permission and tracking status can also be recorded, including when access is refused. Operations uses this for live coordination and support.
• Service and device information: account and installation identifiers, notification tokens and permission status, synchronisation and security records, and information you send when asking for support. These keep the app working, deliver alerts and help investigate problems. Hosting services also handle connection and request information when your device contacts them.

This app does not use your information for third-party advertising or tracking you across other companies' apps and websites.

Your operator determines and explains its lawful basis for operational records in its own privacy information, including location monitoring and any health information. Device permission alone is not that legal basis.

For North Route Systems' own account administration, security and support, we rely on our legitimate interests in operating a reliable business service, protecting accounts and resolving requests. We use contract where processing is necessary for a contract with the individual concerned, and legal obligation where the law requires us to keep or disclose information. These reflect the purposes and bases in our service privacy terms.

The app applies safety and access rules, including checks before departure. Contact Operations to review an incorrect record or a blocked workflow. Operators must not use location or automated app information as the sole basis for disciplinary, employment, safety or legal decisions.

Location: sharing operates during an active duty while the app is open and in the foreground. This release does not collect background or closed-app location. Sharing ends when the duty is no longer active or you sign out. You can change permission in device settings; if sharing is unavailable, tell Operations so it can use another way to coordinate with you.

Photos and camera: used when you choose a profile photo or submit photographic evidence. You can replace or remove your profile photo in your account. Removing that photo does not remove photographs already submitted as separate safety evidence.

Calendar: used when you choose to add a duty. The app checks for a writable calendar and adds the duty reference, title, times, pickup location and vehicle reference. Your calendar provider may sync that entry to other devices or accounts. Existing calendar events are not uploaded to North Route by this feature.

Notifications: optional operational alerts use Expo and your device's notification service, including Apple on iOS. These services process notification tokens and delivery information. You can disable notifications in device settings.

If you open a destination in an external maps app, the destination is passed to that service under its own privacy terms.

Authorised users at your operator can access records within their company and assigned permissions. Driver messages are restricted to that driver's allocated company Operations team. Individual compliance and personal document access follow company and driver permissions.

North Route Systems and its providers handle information needed to host, secure, support and deliver the service. Providers include Supabase for the database, authentication and storage; Netlify for hosted web pages; and Expo and the device notification provider for enabled push notifications. Information may also be disclosed to advisers, regulators, courts or authorities where necessary and lawful.

The production Supabase database is hosted in Ireland. Providers can also process service information outside the UK, including in the United States; database location does not mean every support or notification operation stays in that country. Our data-processing terms require applicable adequacy arrangements or approved contractual safeguards for restricted transfers. Contact us for the provider locations and safeguards relevant to your information, or a copy of the applicable safeguards.

Retention depends on the purpose and record. Your operator's instructions and applicable safety, employment, accounting and legal requirements determine how long operational records are needed. Matters such as an unresolved defect, incident, dispute or legal hold can require a record to be kept. Contact Operations for the retention rules applying to your records.

Operational records are archived first. Archiving removes a record from active work; it does not delete its history. Signed safety evidence and its audit links are preserved. Closing an account or signing out does not automatically erase records held by the operator. Deletion and any remaining backup copies are handled under the agreed retention and return or deletion arrangements.

North Route Systems keeps its own account, support and security records for the relevant service relationship, request or investigation and any applicable legal-record requirement. We assess continuing need against those purposes rather than applying one period to every type of record.

The app keeps recent work and queued submissions on your device for poor-signal use. Signing out clears the readable active workspace. Pending signed offline-departure evidence can remain encrypted and tied to its original account until it can be reconciled; another signed-in driver cannot use it. Other pending records may be isolated when the account changes. An account-specific installation identifier can remain in protected device storage across sign-out. Contact Operations before deleting the app if a safety submission is waiting to upload.

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your information. Rights are subject to the applicable legal conditions; a request to delete information may not cover records that must be retained.

You can object to processing based on legitimate interests, including relevant monitoring. Contact your operator about its processing or North Route Systems about ours. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier use.

Ask your operator about operational records, or email Jay@northroutesystems.com. We can help direct a request to the organisation responsible. We may need to verify your identity. You can also complain to the Information Commissioner's Office.

We will update this notice when the service or its use of information changes. The date above identifies this version.