TM Tacho Manager Privacy policy

Privacy Policy

This page is based on the current capabilities, privacy controls, login flows, transport-order workflows and mobile smart-card workflows present in the Tacho Manager web app and mobile app.

Translations of this page are provided for convenience — the English version is the binding one.

1. What Tacho Manager does

Tacho Manager is a tachograph-focused fleet platform that lets users register accounts, sign in, upload and review tachograph-related files, manage drivers, vehicles and documents, dispatch transport orders with electronic consignment notes (e-CMR), compute payroll from card data, track vehicles via GPS providers, process fuel receipts, and use a mobile app that can interact with a compatible smart-card reader to read a driver tachograph card.

2. Personal data we may process

  • Account and login data such as username, recovery email, linked Google account identifiers and related authentication session data.
  • Company or driver profile data entered during registration or administration, including company details, driver names, national ID / social-security numbers where the employer records them, and driver documents with their photographs.
  • Tachograph-related file content uploaded through the website or mobile workflow, including driver card files and vehicle files.
  • Transport-order data: loading/unloading places, times, assigned driver, check-in events, remarks, cargo photographs and consignment-note content.
  • Device location data (GPS coordinates, accuracy and timestamp) captured when a driver performs an explicit action such as accepting an order, checking in a loading/unloading, attaching a photo or signing a consignment note.
  • Signature data on consignment notes: the drawn signature image, the typed signatory name, an optional ID number, the signing time and position.
  • Vehicle position data received from connected GPS tracking providers when the GPS module is enabled.
  • Fuel receipt and invoice images and the values extracted from them (litres, plates, amounts, station data).
  • Derived operational data generated from uploaded files, such as activities, infringements, rest planning, payroll figures, consumption statistics and related compliance indicators.
  • Push notification device tokens when notifications are enabled in the mobile app, and the language preference cookie.
  • Technical and security data needed to protect the service, such as session identifiers, rate-limiting entries, login attempt state and consent status.
  • Optional analytics data only when analytics are enabled and the visitor has granted consent.

3. How we use the data

  • To create and manage user accounts and driver–company links.
  • To authenticate users, including username/password and Google sign-in flows.
  • To process uploaded tachograph files and produce reports such as infringements, activities, rest planning and work summaries.
  • To dispatch transport orders, record GPS-stamped check-ins and produce electronic consignment/control documents with their audit trail.
  • To compute payroll figures, fuel consumption statistics and working-time registries from the collected data.
  • To send push notifications about assignments, reminders and expiries when the user has enabled them.
  • To support mobile smart-card workflows, including reading a driver card, saving a local copy and uploading the resulting file.
  • To maintain security, enforce rate limits, prevent misuse and keep the service available.
  • To improve the product only through optional analytics where consent is required and granted.

4. Device location data

The device's GPS position is requested only at the moment of an explicit driver action — accepting an order, checking in a loading or unloading, attaching a photo or signing a consignment note — and only with the browser or operating-system location permission granted. It is stored with the corresponding event as delivery evidence and shown to the company managing the order. Tacho Manager does not track the driver's device continuously in the background.

Continuous vehicle positions come only from dedicated GPS trackers installed on vehicles and connected through the optional GPS module, not from the driver's phone.

5. Electronic consignment notes (e-CMR / DeCA)

Consignment notes contain the transport parties' identification (names, addresses, tax numbers), goods data, signatures with the signatory's typed name and optional ID number, GPS positions and timestamps, and a tamper-evident fingerprint of the signed content.

Each note carries a QR code with a unique, unguessable link that serves the document without login, so roadside inspectors and the parties to the transport can verify and download it. The link is deactivated a limited time after the transport is completed. Signed consignment/control documents are retained for at least one year to comply with transport-law retention duties.

6. Legal bases

  • Performance of a contract or pre-contractual steps when providing the service requested by users.
  • Legitimate interests for security, fraud prevention, operational stability and service administration.
  • Legal obligations, including transport-document retention and, where applicable, working-time registry duties.
  • Consent where optional analytics cookies or similar tracking technologies are used, and for device location at the moment it is requested.

7. Google sign-in

If you choose Google sign-in, Tacho Manager may receive your Google account identifier, verified email address and basic profile information needed to authenticate or link your account. The platform uses this information to sign users in, link an existing account or complete account setup.

8. Mobile app, smart-card reader and push notifications

The Android mobile app can work with a compatible card reader to detect the reader, request access, read a driver tachograph card, save a local file copy and upload data into the service. Files generated through that workflow are processed to provide reporting and account functionality in the web application.

When the user enables notifications, the app registers a push token (Firebase Cloud Messaging) linked to the signed-in account so that assignment, reminder and expiry notifications can be delivered. Disabling notifications or signing out deactivates the token.

Files uploaded through the service may be transmitted to the server and stored in encrypted form so they can be used for reporting, compliance analysis, downloads and account administration.

9. Linked driver and company accounts

A driver account can link to one or more company accounts with an invitation code. While a link is active, data needed for the working relationship is shared between the linked accounts: uploaded card files, driver documents, transport orders and their check-ins, and — where the company grants access — payroll and working-time views. Unlinking stops future sharing.

10. Cookies, local storage and consent

Tacho Manager uses session and preference technologies needed for sign-in, theme and language preference, mobile app handoff support and privacy consent. Optional analytics are loaded only when privacy features are enabled and consent has been granted. More detail is available in the cookie policy.

11. Security and confidentiality

Tacho Manager applies technical and organizational measures intended to protect account data and uploaded tachograph files against unauthorized access, loss, misuse or disclosure. These measures can include access controls, authentication safeguards, encrypted storage workflows, tamper-evident document fingerprints and security logging.

12. Data sharing and processors

Tacho Manager may rely on infrastructure, email delivery, push notification (Firebase), analytics, authentication, GPS tracking providers, AI extraction providers for fuel documents, or support providers where needed to operate the service. Data should only be shared to the extent necessary to provide the platform, protect the service, comply with law or support explicitly enabled optional features. Where processors are used, they should act under appropriate contractual and confidentiality obligations.

Fuel receipt and invoice images are submitted to the configured AI extraction provider solely to read the document's commercial values; consignment-note documents are accessible through their QR verification link as described above.

13. Retention and deletion

Account information, uploaded tachograph files and generated report output may be retained for as long as needed to provide the service, maintain account history, protect security or comply with applicable obligations. Signed consignment/control documents are retained for at least one year under transport law. Other retention periods can vary depending on account status, system administration needs and legal requirements.

Users can request account deletion and deletion of associated uploaded data by using the published deletion request channel or, when available, by initiating the verified deletion flow from the account profile area.

14. GDPR rights

Depending on the laws that apply to you, you may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent for optional analytics processing. You may also have the right to lodge a complaint with your local supervisory authority.

15. International transfers

If data is processed outside your country or the EEA/UK, appropriate safeguards should be used where required by applicable law, such as adequacy decisions, standard contractual clauses or comparable lawful transfer mechanisms.

16. Contact

Set the appropriate GDPR/privacy contact email in the main application privacy settings so this page and the live application footer can point visitors to the right contact address.