Autocare Driver Privacy Policy

1. Who is responsible for your data

CONNECTBASE SRL, IDNO/tax code 1023600007753, with headquarters in MD-2089, Republic of Moldova, Chișinău municipality, Ciorescu village, Ștefan cel Mare street, no. 9, provides the Autocare platform and the Autocare Driver app. CONNECTBASE SRL is the controller for platform administration, access security and the relationship with service users.

The carrier for which you work assigns your access and trips and uses the data for organizing transport and the activity of drivers. It is responsible for the purposes and legal bases of the processing it establishes in this relationship, including the rules for monitoring activity. This policy does not replace the information that the carrier must provide to you.

You can contact us at [email protected] or +373 60 003 377. If the request concerns the carrier's own records, we will direct you to it.

2. To whom this policy applies

This policy applies to drivers who use Autocare Driver and to data about passengers or reservations accessed through the app. The driver account and access right are administered by the carrier; the app does not by itself create an employment relationship and is not intended for use by children.

Passenger data are made available to you for the trip and your duties. Use them only for organizing transport, the contact necessary for the journey, boarding and collections, in compliance with the carrier's instructions.

3. What data we use and where it comes from

Category	Data and sources
Account and authentication	Name, phone number, company, driver identifier, access status and data needed to verify the password. Account data come from the carrier and from your logins.
Trips and activity	Route, date and times, vehicle, driver assignment, trip start and end, operations performed and their time. They come from the carrier, reservations and your actions.
Passengers and reservations	Name, available contact details of the person making the reservation, boarding and drop-off points, seats, reservation status, boarding and payment status. They are provided through the platform for trip administration.
Collections	Reservation, amount, currency, the driver recording the collection and its changes. The function records collections; it does not ask for the card number or card security code in Driver.
Precise location	Coordinates of the phone used in the trip, the time of measurement and, when available, accuracy, speed and direction of movement. The data are associated with the trip and the driver.
Camera and QR codes	The image read by the camera for recognition of the code on the ticket, the identifier derived from the code and the result of verification or boarding.
Device, notifications and preferences	Mobile platform, the identifier needed to deliver notifications, language, theme and app settings. Access to the phone contacts is not required to use the contacts displayed in reservations.
Security and support	Data about requests to the service, IP address, logins, errors, as well as the information you send when asking for help. They are used to protect access and investigate issues.

4. What we use the data for

• For authentication and access only to the information and operations allowed for your account.
• For displaying trips, operational communication with passengers, boarding verification and record of collections.
• So that the dispatcher can track the trip and authorized users of the passenger service can see the position of the bus related to their journey.
• For updating information, including through notifications and synchronization of operations performed without internet.
• For resolving incidents, correcting errors, preventing unauthorized access, fulfilling legal obligations and defending rights.

The applicable legal bases are, as the case may be, performance of the service and of the relevant contractual relations, legal obligations and legitimate interests regarding the safe organization of transport and the security of the platform, assessed in relation to people's rights. For processing that requires consent, it must be obtained separately and may be withdrawn.

The permission granted to the phone does not by itself establish the legal basis for monitoring at the workplace. The carrier must explain to you the need for location, the persons who have access and the rules applicable to your activity. If information necessary for access or for performing an operation is not provided, the respective function may be unavailable.

5. How location works

Location collection is linked to a trip started in the app. With the corresponding permission, the phone may continue to transmit the position in the background, including with the screen locked or when you use another app. Accuracy and continuity depend on the phone settings, signal and operating system restrictions.

Pressing "End trip" stops the collection for that trip. The mere fact that you close the screen, put the app in the background or reach the destination does not amount to ending the trip. If you leave it running, location may continue.

You may refuse or modify location access in the phone settings. Without this permission, the position of the bus cannot be updated accordingly; contact the dispatcher if location is necessary for your trip. Stopping the permission does not automatically delete data already sent.

When there is no internet, the collected points may be temporarily stored on the phone and transmitted after reconnection. Therefore, data from the time of the trip may reach the service after it ends. This delayed transmission does not represent the collection of a new position after the trip has ended.

6. Camera, notifications and external apps

Camera is used to read the QR code on the ticket. Recognition takes place on the device; the scanning function does not save photos or video recordings and does not send the camera images to Autocare. For verification and boarding, an identifier derived from the code is used together with the operation data. The scanner does not request sound recording. You may refuse camera access and use the manual operations available in the passenger list.

Notifications use, depending on the platform, Firebase Cloud Messaging and Apple Push Notification service. These services process the identifiers and technical data needed for delivery. You may change the permission to display notifications in the phone settings. This choice is distinct from the processing of the data needed for the account and from updating information when you open the app.

If you choose to call a passenger or to open a map or messaging app, the number or destination needed for the action is transmitted to that app. Apple Maps, Google Maps, Waze and communication services operate according to their own policies and permissions.

7. Who may receive data

• The carrier and its authorized staff, for trip planning, location, reservations, collections and incident resolution.
• Authorized users of the passenger tracking function, for the bus position and the available route of their journey, according to the access associated with the reservation. This function does not give them the full passenger list or the driver's collections.
• Technical providers of hosting, databases, security, diagnostics and support, to the extent necessary for providing the service.
• Notification and communication providers, including Google/Firebase and Apple, for the functions described above.
• Authorities and authorized consultants, when communication is required by law or necessary to resolve a dispute or defend a right.

Access is linked to the purpose of the service and to the recipient's responsibilities. For providers that process data on our behalf, corresponding obligations regarding confidentiality, security and use of the data only for the entrusted service are required.

Carriers and technical providers may process data in the Republic of Moldova and in other countries. An international transfer must comply with the conditions of the applicable law, including the necessary safeguards. You may request at [email protected] information about the recipients, countries and safeguards relevant to your data.

8. Retention and deletion of data

The duration depends on the category of data, the status of the trip, legal obligations and the need to resolve certain incidents or disputes. Information no longer needed for the purpose for which it was retained must be deleted or anonymized.

• The account and access: for the duration of the authorization and, after access ends, only to the extent necessary for security records, legal obligations and the resolution of requests.
• Location: temporarily, for trip tracking and verification of operational incidents. The criteria for deletion are the age of the points, the time the trip ended and the absence of recent updates for a trip left open. Data retained as evidence in an incident are limited to what is necessary to resolve it.
• Reservations, boardings and collections: as long as they are necessary for execution and verification of transport, settlements, financial-accounting obligations and applicable time limits for defending rights. Deletion of the driver's access does not automatically delete these records.
• Technical data and support requests: for investigating the problem, service security and the relevant legal time limits, taking into account the nature of the incident.
• Backups: until the applicable retention cycle expires. Deletion from the current system does not mean immediate removal from all backups.

On the phone information necessary for access, preferences and offline work is stored, including passenger lists, unsynced operations and GPS positions. Upon explicit logout, the app removes the local data related to the driver. If the session expires, some unsent operations may remain for continuation of the work by the same driver after authentication; changing the driver does not transfer those data to the new user.

Uninstalling or logging out does not constitute a request to delete the data from the server. For such a request, use the contact in the next section.

9. Your rights and how to exercise them

Under the conditions of the applicable legislation, you may request access to the data, rectification, deletion, restriction of processing and portability. You may object to processing based on legitimate interest and may withdraw consent when the processing is based on it, without affecting the lawfulness of the prior use.

Send the request to [email protected] and specify what you want us to verify. We may request the information necessary for identification and to avoid access by another person to your data. Do not send the password in the message.

We respond within the time limits provided by law; where the one-month term applies, we inform you within that interval also about any extension permitted by law. If certain data must be kept for a legal obligation or for defending a right, we explain the reason and the limits of the retention.

For deactivation of work access you may also contact the carrier. A deletion request is assessed separately from deactivation and is not conditioned on the carrier's consent for the exercise of a right granted by law; each controller is responsible for the records it controls.

You may lodge a complaint with the National Center for Personal Data Protection or, where applicable, with the competent supervisory authority in your state. You may also exercise your right to address the competent court.

10. Protecting data

Access to the service is through authentication, and the available functions are limited by the account, company and trip assignment. We use technical and organizational measures appropriate to the risks, including communications protection and access control. No measure eliminates every risk.

Protect the phone and the password, avoid leaving the app accessible to other people and notify the carrier if the device is lost or access appears compromised. Before handing a phone over to another driver, complete the necessary operations and log out.

11. Changes and versions

The policy may be updated if the functions, processing or legal requirements change. The version and date of the document allow identification of the applicable text. For important changes we provide the necessary notice, and if a new purpose requires separate consent, it must be requested before the respective processing.