1About this Policy
This Privacy Policy explains how Sentilant – Consultoria e Inovação, Lda. (“Sentilant”, “we”, “us”) processes personal data in connection with DrivianTasks, a transport management system (TMS) made up of the web platform made available to each Customer at a dedicated subdomain of driviantasks.com (for example, customer.driviantasks.com) and the DrivianTasks mobile application for Android and iOS (together, the “Services”), including the Drivian Telematics features integrated in the Services.
DrivianTasks is a business service. It is subscribed by companies (“Customers”) that use it to plan and execute transport and field operations. The people who use the Services on behalf of a Customer, such as managers, dispatchers and drivers, are referred to as “Users”.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Portuguese Law no. 58/2019. It does not apply to third-party websites or services linked from the Services. The use of the Services is governed by the DrivianTasks Terms of Use.
2Who we are and how to contact us
- Company: Sentilant – Consultoria e Inovação, Lda.
- Address: Aceleradora de Empresas do IPN, Rua Pedro Nunes, 3030-199 Coimbra, Portugal
- Privacy contact: privacy@sentilant.com
3Our role: controller and processor
Sentilant acts in two different capacities, and your rights are exercised differently in each case.
3.1 Sentilant as processor (data processed on behalf of Customers)
When a Customer uses DrivianTasks to manage its operations, the Customer is the data controller of the personal data entered into or generated through the Services, including data about its employees, drivers, subcontractors and the recipients of its deliveries (“Customer Data”). Sentilant acts as data processor under Article 28 GDPR and processes Customer Data only on the Customer’s documented instructions, as set out in the service agreement and data processing agreement concluded with each Customer.
The Customer is responsible for determining the purposes of the processing, for having a valid legal basis, for informing its employees and other data subjects, and, where required, for carrying out a data protection impact assessment, in particular regarding geolocation and the evaluation of driving behaviour in an employment context.
If you are a driver or other employee of a Customer, or the recipient of a delivery, please address questions and requests about your data to the company that uses DrivianTasks. If you contact us directly, we will forward your request to that company and assist it in responding.
3.2 Sentilant as controller
Sentilant is the data controller for personal data it processes for its own purposes: visitors to our websites, contacts of Customers and prospective customers, administration of Customer accounts and billing, technical support, security of the Services, and our own commercial communications. Section 4 describes this processing.
4Data we process as controller
| Purpose | Personal data | Legal basis |
|---|---|---|
| Managing the contractual relationship with Customers (account set-up, billing, contract management) | Name, professional email and phone, role, company, invoicing data | Performance of a contract (Art. 6(1)(b)); legal obligations, e.g. tax and accounting (Art. 6(1)(c)) |
| Technical support and service communications | Contact data, content of support requests, account identifiers | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention and integrity of the Services | Access logs, IP addresses, device and browser identifiers, authentication events | Legitimate interest in keeping the Services secure (Art. 6(1)(f)) |
| Responding to contact forms and demo requests | Name, company, email, phone, message content | Pre-contractual steps at your request (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| B2B commercial communications about our products | Professional contact data | Legitimate interest (Art. 6(1)(f)), with the right to object at any time; consent where required by law |
| Website operation and, where applicable, statistics | Cookies and similar identifiers (see section 13) | Strictly necessary: legitimate interest; others: consent |
We do not sell personal data. We do not use Customer Data for our own commercial purposes.
5Data we process on behalf of Customers
Depending on the modules of the TMS activated by each Customer and on how the Customer configures them, the Services may process the following categories of Customer Data:
- User account data: name, email, phone number, role, company, credentials, language and app settings.
- Operational and task data: routes, tasks, orders, schedules, check-ins and barcode scans, timestamps, occurrences, expenses, and data about delivery recipients and sites (names, addresses, contacts, signatures and proof-of-delivery records).
- Location data: GPS position of the mobile device or vehicle while the driver is using the mobile application, including in the background when the screen is off or the app is closed, used to record routes, show the current position of vehicles, support route planning and allocation of new services, and trigger geofencing events. The driver can stop location sharing in the app at any time by turning off work mode. Outside work mode, the app does not use location.
- Driving and telematics data: data from smartphone sensors (GPS, accelerometer, gyroscope, magnetometer) and derived information: trips, distance travelled, activity type, driving events such as harsh braking, harsh acceleration, harsh cornering, speeding and phone handling while driving, driving scores, and weekly risk estimates per driver.
- Tachograph data: digital tachograph files (DDD) and derived data such as driving and rest times and driver allowance calculations.
- Driver and vehicle documents: documents and their validity dates (e.g. driving licence, professional qualifications, vehicle documents), used to verify compliance requirements.
- Transport documents: electronic consignment notes (e-CMR) and related documents, including the data of the parties and signatures they contain.
- Invoices and expenses: supplier invoices and receipts captured by Users, including data read from the invoice QR code and line items extracted automatically.
- Media and other content: photos, videos, audio files, documents and text submitted through the Services, which may be associated with time and location metadata.
- Fleet and cost data: vehicle data, fuel and fuel-card records, and cost parameters configured by the Customer, which may include the cost of individual employees.
- Technical data: device model, operating system, app version, crash and diagnostic logs, and push notification tokens.
The Customer decides which of these categories are collected and is solely responsible for entering, modifying and deleting Customer Data in the Services.
6Automated processing and artificial intelligence
Some features of the Services use automated processing, including machine-learning models and AI services:
- Driving scores and risk estimates are calculated automatically from telematics data. They are decision-support indicators for the Customer. Sentilant does not take decisions about Users based on them. The Customer is responsible for ensuring that any decision affecting a driver involves meaningful human review and complies with applicable employment law.
- Invoice data extraction uses an AI service to read details that are not available in the invoice QR code. The result is presented to the User for confirmation.
7Mobile application permissions
The mobile application requests only the permissions needed for the features activated by the Customer. You can manage permissions in your device settings. Refusing a permission may prevent the corresponding feature from working.
- Location, including background location: to record trips and routes and show the vehicle position while the screen is off or the app is closed.
- Motion and activity sensors: to detect trips, activities and driving events.
- Camera: to capture photos, documents, invoices and barcodes.
- Notifications: to receive new tasks, changes and alerts.
8Recipients and sub-processors
Access to personal data within Sentilant is restricted to employees and contractors who need it to provide, support or secure the Services, and who are bound by confidentiality obligations. We use the following categories of sub-processors, under written agreements that impose data protection obligations equivalent to ours:
| Service | Provider | Location |
|---|---|---|
| Cloud hosting and storage | Akamai | EU |
| Transactional email | DigitalOcean (own SMTP server) | EU |
| Maps, geocoding and routing | Amazon, Google | EU |
| Push notifications | Google (Firebase Cloud Messaging), Apple (APNs) | EU |
| Reporting and dashboards | Local (self-hosted) | EU |
An up-to-date list of sub-processors is available to Customers on request. We will inform Customers of intended changes to sub-processors in accordance with the data processing agreement.
We may also disclose personal data:
- To integrated systems chosen by the Customer, such as the Customer’s ERP, GPS or tachograph providers, or data platforms, when the Customer activates such integrations.
- In a business transfer, such as a merger, acquisition or sale of assets, in which case the recipient will be bound by this Policy and by the agreements with Customers.
- Where required by law or by a competent authority, or where necessary to establish, exercise or defend legal claims or to protect the vital interests of any person.
9International transfers
Customer Data is hosted in the European Economic Area. Where a sub-processor processes personal data outside the EEA, we ensure appropriate safeguards, such as an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or Standard Contractual Clauses.
10Retention
- Customer Data is kept for the duration of the subscription, according to the Customer’s instructions and configuration.
- On termination, the Customer may request an export of its data within 30 days. After that period, Customer Data is deleted from the production systems, and copies in backups are overwritten within 90 days, unless retention is required by law.
- Data processed as controller is kept for the duration of the contractual relationship and afterwards for the periods required by law (e.g. 10 years for accounting and tax records) or for the limitation period of possible legal claims. Security logs are kept for 12 months.
11Security
We implement technical and organisational measures appropriate to the risk, including: hosting in a European cloud environment; encryption of data in transit; encrypted backups with periodic restore tests; multi-factor authentication for administrative access to infrastructure; centralised logging with alerts; web application firewall and intrusion detection; periodic access reviews; separation of production data from development and test environments; and periodic external penetration testing.
No system is completely secure. If we become aware of a personal data breach affecting Customer Data, we will notify the Customer without undue delay so that it can meet its own obligations.
12Your rights
Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability and, where processing is based on consent, to withdraw consent at any time without affecting prior processing.
For data processed as controller (section 4), contact us at privacy@sentilant.com. We will respond within one month, which may be extended in the cases provided by law. For Customer Data (section 5), please contact the company that uses DrivianTasks; we will assist it in responding.
You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or with the supervisory authority of your place of residence or work.
Account deletion
Users’ accounts are created and managed by the Customer. To delete your account and associated data, ask your company’s DrivianTasks administrator, or send a request to privacy@sentilant.com, and we will process it with the Customer. Some data may be retained where the Customer or Sentilant is legally required to keep it.
13Cookies
The DrivianTasks web platform uses cookies that are strictly necessary for authentication, session management and security. These do not require consent.
14Children
The Services are intended for professional use and are not directed at persons under 16 years of age.
15Changes to this Policy
We may update this Policy to reflect changes to the Services or to applicable law. The current version is always available at https://www.driviantasks.com/tms-privacy-policy.html. Material changes will be communicated to Customers by email or through the Services at least 30 days before they take effect.
16Contact
For any question about this Policy or about the processing of personal data, contact us at privacy@sentilant.com or by post at the address in section 2.