Privacy Policy

1. Who we are and this policy

TruckThrust is a driver-first platform for European road freight — compliance, routing, documentation and parking in one mobile app, with a companion dispatcher dashboard. This policy applies to the TruckThrust mobile app and the TruckThrust website, and explains what personal data we handle, why, who we share it with, and the rights and controls you have.

TruckThrust is operated by Kaaal Int Lda, [registered address], Portugal (“TruckThrust”, “we”, “us”). Contact us about privacy at samson@kaaal.eu.

Our role under the EU GDPR depends on how you use TruckThrust:

• Haulage operators and dispatchers using TruckThrust for a fleet are the controller of the driver and operational data they enter or generate; we act as their data processor for that data.
• Drivers using the app under an employer’s account: the employer is the controller and we process the data on their instructions.
• Our website, sign-ups, billing and direct messages: we are the controller.

Where we act as a processor, direct data requests to the controller (your employer) and we will assist them; this policy applies in full where we are the controller.

2. What data we collect

The data we handle depends on the modules you use:

• Account & contact data — name, work email, phone, employer/company, role, and login credentials.
• Driver & compliance data — driving, rest and break times, duty/availability status, tachograph and EU 561/2006 records, and cabotage and border-crossing events.
• Precise location (GPS) — your position, planned and driven routes, and secure-parking selections, in real time and as history, while the relevant feature is in use (see §3).
• Documents & records — CMR, proof of delivery, ADR and other transport documents, vehicle-inspection checklists and photos, and driver-journal notes (including voice-to-text).
• Vehicle & telematics data — vehicle identifiers, toll-transponder registrations where supported, fuel and idle-time data, and derived emissions figures.
• Device & technical data — device model, operating system, app version, diagnostic and crash logs, and IP address.
• Usage data — how you interact with the app and website, for security and product improvement.

We collect this data directly from you and from your use of the app. We do not buy personal data about you from data brokers.

3. Device permissions

The app requests device permissions only for the features you use, and you can review or revoke them at any time in your device settings. Denying a permission disables the related feature, not the whole app.

• Location (precise) — to place you on your route, count cabotage and border-crossing events, and find nearby secure parking. Used while the relevant feature is active. If a feature needs location while the app is in the background (for example, continuous trip tracking), we explain why and request that permission separately.
• Camera — to photograph transport documents and inspection defects.
• Microphone — for voice-to-text entries in the driver journal.
• Notifications — to alert you to breaks, checkpoints and compliance deadlines.
• Files & storage — to attach documents and cache them for offline use.

4. How we use data, and our legal bases

Where we are the controller, we rely on these Article 6 GDPR legal bases:

• Performance of a contract — to create and run your account, deliver the modules you use, and provide support.
• Legal obligation — to help you meet, and to retain, records required by EU and national transport law (e.g. driving-time and tachograph records, transport documentation).
• Legitimate interests — to secure the service, prevent fraud and abuse, understand usage, and improve features, balanced against your rights.
• Consent — for optional analytics, marketing, and any processing that specifically asks for it. You can withdraw consent at any time.

We do not sell personal data, and we do not use your data for third-party advertising.

5. Biometric sign-off and sensitive data

Fingerprint sign-off. When you sign an inspection or document with a fingerprint, authentication is performed by your device’s built-in biometric hardware. TruckThrust receives only confirmation that authentication succeeded — your fingerprint and other biometric identifiers never leave your device and are not collected, transmitted or stored by us. A PIN or on-screen signature is always available as an alternative.

Activity status. A status such as “sick” can imply health information (a special category under Article 9 GDPR). We process it only to route the status to dispatch, HR and compliance as your operator’s workflow requires, on the operator’s legal basis, and for no other purpose.

Rest and fatigue suggestions are generated from your own driving history to prompt safe breaks; they are decision support, not medical assessments.

6. Offline-first operation

TruckThrust is designed to work without connectivity. Compliance logs, document capture, signatures and photos are stored securely on your device and synced to our servers when a connection returns. Data on the device is protected by the device’s own security and by app-level encryption.

7. Who we share data with

• Your employer / operator — driver and operational data is visible to the haulage company that operates your account, as the controller.
• Service providers (sub-processors) — vetted vendors that process data only on our documented instructions under Article 28 contracts, and never for their own purposes: EU-region cloud hosting, mapping and routing, push notifications and messaging, and error and crash monitoring. A current sub-processor list is available on request.
• Your integrations — where you connect a TMS or telematics provider through our API, data is shared on your instruction and under your control.
• Authorities — enforcement or tax authorities where we are legally required to disclose, or where you present records during a roadside or company check.
• Corporate transactions — a successor entity in a merger, acquisition or reorganisation, subject to this policy.

8. Where data is stored and international transfers

TruckThrust runs on EU-hosted infrastructure, and we keep personal data within the European Economic Area (EEA) wherever possible. If any processing involves a transfer outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate additional safeguards.

9. How long we keep data

We keep personal data only as long as necessary:

• Compliance and transport records — retained for the periods required by applicable EU and national law, then deleted or anonymised.
• Account data — kept for the life of the account and a limited period afterwards to meet legal and accounting obligations.
• Diagnostic and usage data — kept for a short period for security and troubleshooting.

10. Deleting your data and account

You can ask us to delete your personal data and close your account at any time:

• In the app — Settings → Account → Delete account.
• By email — write to samson@kaaal.eu from your registered address.
• Online — follow the steps on our account deletion page.

We action verified deletion requests within 30 days. We delete or irreversibly anonymise your data, except records we are required to keep by law — for example, driving-time and transport documents kept for their statutory retention period — which we stop using, isolate, and delete once that period ends.

If we hold your data on behalf of your employer (as a processor), we act on their instructions; contact your employer or us and we will coordinate the request.

11. How we protect data

We encrypt personal data in transit and at rest, operate role-based access controls, and follow an information-security programme aligned to ISO 27001. No system is perfectly secure, but we protect your data proportionately to its sensitivity and will notify the relevant parties promptly in the unlikely event of a breach, as the law requires.

12. Your rights

Subject to conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances (see §10);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with a supervisory authority — for us, the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD), or the authority where you live or work.

To exercise these rights, contact samson@kaaal.eu. Where we process your data on behalf of your employer, please direct your request to them and we will assist.

13. Automated decisions

TruckThrust does not make decisions producing legal or similarly significant effects about you based solely on automated processing. Compliance checks, cabotage counts and rest reminders are decision support with human oversight; responsibility for acting on them rests with the driver and operator.

14. Children

TruckThrust is a professional tool intended for people aged 18 and over. It is not directed at children, and we do not knowingly collect their data.

15. Cookies and the website

Our website uses strictly necessary cookies to function, and — only with your consent — optional analytics cookies to understand how the site is used. You can manage optional cookies through the banner on your first visit and change your choice at any time.

16. Changes to this policy

We may update this policy as the product and the law evolve. We will change the “last updated” date above and, for material changes, give notice in the app or by email.

17. Contact us

For any privacy question or to exercise your rights, contact samson@kaaal.eu, or write to Kaaal Int Lda, [registered address], Portugal. TruckThrust is part of the Kaaal portfolio — kaaal.eu.