UNIVOOZ & UNIVOOZ GO PRIVACY POLICY

This Privacy Policy explains how MaxTech Solutions, operating under the trading name Univooz ("Company", "MaxTech", "we", "us", or "our"), collects, uses, discloses, and protects information when you use the Univooz logistics management platform, website (collectively, the "Platform"), and the Univooz GO mobile driver application (the "Driver App").

1. Controller Identity & Role Framework (GDPR)

Legal Entity & Controller Details:

Univooz is a trading name of MaxTech Solutions (bundle ID: com.maxtechdev.univoozgo). For questions regarding this policy or data protection matters, contact us at info@maxtech.solutions.

Under the EU General Data Protection Regulation (GDPR) and applicable data protection laws, we operate in a dual capacity:

• Data Processor: When Business Clients (merchants, dispatchers, or enterprise fleet owners) upload delivery orders, recipient names, phone numbers, drop-off locations, and package details into the Platform, Univooz acts as a Data Processor. We process this information strictly on behalf of and according to the instructions of the Business Client (the Data Controller).

• Data Controller: Univooz acts as a Data Controller for:

  • Direct Business Client account credentials and contact info.

  • Driver profile data, compliance records, app credentials, earnings data, and operational telemetry generated within the Univooz GO app.

  • Technical device data, cookies, and usage analytics gathered from website visitors and Platform administrators.

2. Information We Collect & Process

A. Order & Recipient Information (Processed on behalf of Business Clients)

• Delivery Details: Recipient name, delivery address, phone number, order ID, delivery notes, and package characteristics (size, weight, handling rules).

• Proof of Delivery (POD): Electronic signatures, timestamped photos of dropped-off items, and delivery status logs.

B. Driver Data (Collected via Univooz GO App)

• Account & Profile Info: Name, email, mobile phone number, driver profile picture, vehicle type, and license plate number.

• Compliance Documents: Driving licence, insurance, vehicle, and other compliance documents uploaded by the driver. These can contain an identity document number, an expiry date, and a photograph. The driver's fleet reviews them to confirm the driver is eligible to work.

• Driver Earnings Data: Shift pay, completed-delivery counts, bonuses, and earnings history that the app shows to the driver. The platform generates this data from completed work.

• Real-Time & Background Location Data: Precise latitude, longitude, heading, speed, and location telemetry.

  Note: Location data is collected in both the foreground and background only while the driver is on duty or actively fulfilling an assigned delivery batch.

• Device Permissions & Hardware Data:

  • Camera Access: Required to scan package barcodes and capture Proof of Delivery (POD) photos.

  • Photo Library Access: Drivers can attach an image already on the device or capture a new one with the camera. The app reads only the images selected by the driver. It does not scan or index the photo library.

  • Push Notification Token & Device Details: A push notification token, together with the device name and model. We store these so dispatch alerts, network connectivity status, battery updates, and route changes reach the correct device. We delete the token when the driver signs out or when the account is deleted.

C. Platform & Business Client User Data

• Account Setup: Admin name, corporate email, billing details, company address, and tax identification numbers.

• Technical Logs: IP address, browser type, system activity, referring URLs, and session interactions.

3. Legal Bases for Processing (GDPR Art. 6)

We rely on the following legal grounds to process your personal data:

• Contractual Necessity (Art. 6(1)(b)): To perform our service agreements, dispatch orders, provide live routing to drivers, process driver earnings, and send delivery status updates to end-recipients.

• Legitimate Interests (Art. 6(1)(f)): To optimize routing algorithms, detect fraud, ensure system stability, and enhance platform security.

• Legal Obligations (Art. 6(1)(c)): To comply with tax laws, payroll mandates, commercial record-keeping requirements, and legal transport obligations.

• Consent (Art. 6(1)(a)): For background location permissions on mobile devices (granted via system settings) and optional direct marketing.

4. Driver Location Tracking Notice (Univooz GO)

To enable route dispatching, accurate ETAs for end-customers, and real-time fleet visibility, Univooz GO tracks precise geolocation.

• Active Tracking Window: Tracking begins when a driver toggles their status to "On Duty" or accepts a task, and continues in the background if the driver switches apps or locks their device while en route.

• Off-Duty Privacy: When a driver goes "Off Duty" or logs out of the app, location collection automatically stops completely. We do not record off-duty location history.

5. How We Share & Disclose Information

We do not sell, rent, or monetize your personal data. Data is shared strictly as necessary to execute deliveries:

• With Business Clients & Fleet Dispatchers: Real-time location of drivers assigned to their orders, driver compliance status, live delivery updates, and Proof of Delivery (photos/signatures).

• With Delivery Recipients: Dynamic tracking links displaying estimated time of arrival (ETA), driver first name, vehicle info, and live map position during active delivery.

• Sub-processors & Third-Party Service Providers:

  • Cloud Infrastructure: AWS / Google Cloud Platform (data hosting & database storage).

  • Mapping & Geocoding APIs: Google Maps Platform / Mapbox (for navigation & route calculation).

  • Communication Providers: Twilio (for SMS delivery status notifications and customer-driver masked phone calls).

6. International Data Transfers

If your personal data is transferred outside the European Economic Area (EEA) or UK, MaxTech ensures appropriate protection through Standard Contractual Clauses (SCCs) approved by the European Commission or EU-U.S. Data Privacy Framework (DPF) participation where applicable.

7. Data Retention & Anonymization

• Order & Delivery Telemetry: Kept for as long as directed by our Business Clients (typically 45 to 90 days for operational audit history), after which recipient PII is permanently deleted or anonymized for platform metrics.

• Driver Accounts: Maintained for the life of the active account. After account deletion completes, we remove direct identifiers and driver-uploaded media. We keep a pseudonymized work record for the statutory period that applies to payroll, tax, insurance, and dispute evidence.

• System Logs: Retained for a maximum of 30 days before automatic purge.

8. Data Protection & Security Safeguards

MaxTech implements technical and organizational measures aligned with ISO 27001 and GDPR standards:

• Encryption: All data in transit is encrypted using TLS 1.3, and data at rest is secured via 256-bit AES encryption.

• Access Controls: Strict Role-Based Access Control (RBAC) and Least Privilege Access protocols.

• Anonymization: Delivery history and shift records are disconnected from direct personal identifiers upon account deletion or lifecycle completion.

9. Account Deletion & GDPR Data Subject Rights

Account Deletion Flow

• Drivers: Delete your account from inside the Univooz GO app. Open Settings → Request account deletion and confirm. The app opens a deletion case and shows you its reference number. You do not need to send an email, make a phone call, or visit a website.

  Fleets create and manage driver accounts, so a fleet owner or administrator completes the deletion. You can see the state of your request in the app at any time, and you can withdraw the request while it is still pending.

  When the deletion completes:

  • Your access to the app ends. We revoke your sessions, your credentials, and your push tokens.

  • We remove your direct identifiers, your profile picture, your compliance documents, and the delivery-proof media that identifies you.

  • We keep a pseudonymized work record attached to your past shifts, routes, deliveries, earnings, and the deletion audit trail. That record no longer identifies you directly.

  We keep the pseudonymized record because fleets carry legal duties for payroll, tax, insurance, and dispute evidence. We hold it for those purposes only, and only for the period the law requires.

• Business Clients & Website Visitors: Contact info@maxtech.solutions to request account deletion.

General GDPR Rights

If you reside in the EEA or UK, you also hold rights to Access, Rectification, Restriction/Objection, and Data Portability.

• Note for End-Recipients: If you are an end-customer seeking to exercise rights over delivery records, please contact the merchant/business you purchased from directly, as Univooz processes this data solely under their instruction.

• Complaints: You have the right to lodge a complaint with your local Data Protection Authority (e.g., Datatilsynet, CNIL, ICO).

10. Contact Us & Data Protection Officer

For privacy inquiries, Data Subject Rights requests, or DPA questions, contact us at:

MaxTech Solutions (Trading as Univooz)

General Support & Privacy Inquiry Contact: info@maxtech.solutions