Route Planner Teams Data Processing Terms

These terms are part of the Route Planner Teams terms between your business and Grainger & Rossall Ltd (company number 11867613, 189 Lynchford Road, Farnborough, GU14 6HD; "we", "us"). They are the contract UK GDPR article 28 requires when we process personal data for you. Section 15 lists where each of article 28's requirements is met.

1. Roles

Your business decides what personal data goes into Route Planner Teams and why, so for that data you are the controller and we are your processor. It is called "team data" here and is of two kinds:

• driver data: about the drivers you set up (including the manager or anyone else at your business who drives);
• delivery data: about the people and places you deliver to.

The manager's own account details, your payments and how the manager uses the app are our own data as controller, covered by our Privacy Policy, not by these terms. So is a short record of failed sign-ins that we keep to protect drivers' accounts.

You are responsible for having a lawful reason to process team data, for telling your drivers and the people you deliver to how it is used where the law requires (our Privacy Policy's section on drivers' data can help with your drivers), and for not recording more than you need (for example, a photo of the parcel rather than of a person).

2. Subject matter and duration

We process team data so that Route Planner Teams can plan your drivers' days, give each driver their jobs, and record and show proof of your deliveries. We do this for as long as your team exists, and then until the data is deleted as set out in section 10.

3. Nature and purpose

We store team data; work out routes and split jobs between drivers from map positions and working hours; show each driver their own jobs and you their progress and proof of delivery; email each driver a link to set or reset their password; and delete team data on the timetable in section 10. We process it only to provide Route Planner Teams to you, and never for our own purposes, such as advertising, selling it, training models or facial recognition.

4. Types of personal data

Driver data

• drivers' names, email addresses and (if you add them) phone numbers;
• where each driver starts and finishes their day, which may be their home, and their working hours, including hours set for a particular day;
• the jobs given to each driver, and the times, status, notes, photos, signatures and phone positions of the deliveries they record;
• when each driver last signed in. A driver's password is stored only as a salted one-way hash, which nobody, including us and you, can read.

Delivery data

• delivery addresses and postcodes, and the map position of each stop;
• names, phone numbers and other details you type or import into a job;
• delivery status, times and notes;
• photos taken as proof of delivery, which may show a property, a vehicle, a parcel or, if photographed, a person;
• signatures captured on a driver's phone;
• when a photo or signature was taken, and the phone's position and its accuracy.

Route Planner Teams is not designed for special category data (such as health information); please don't record it.

5. Categories of people

• your drivers;
• the people you deliver to, and others at the delivery address;
• people who sign for a delivery;
• your own customers, or the senders you deliver for, where you record their details.

6. Your instructions

We process team data only on your documented instructions. These terms, and what the manager and your drivers do in the app (adding, sending, recording, sharing and deleting), are your instructions. If the law requires us to process team data in another way, we will tell you first unless the law forbids it. We will tell you if we think an instruction breaks data protection law.

7. Confidentiality

Only people who need access to run and support the service can reach team data, and they are bound to keep it confidential.

8. Security

We protect team data with measures appropriate to the risk, as UK GDPR article 32 requires, including:

• encryption in transit (HTTPS) and at rest (our database and photo storage);
• team data reachable only from the manager's signed-in account and from each driver's own login;
• a driver sees only their own jobs, and can look up their own deliveries from the current day and the previous seven; the manager sees deliveries made on your team's plan, for 90 days after the day of the plan;
• drivers' passwords stored only as a salted one-way hash; after repeated wrong passwords, sign-in refused for 15 minutes; password links that work once and expire after 24 hours;
• a removed driver signed out and unable to sign in at once;
• photos and signatures in separate storage, removed from the app 90 days after upload;
• a nightly encrypted backup (AES-256) of our database and photo storage, kept on our own server at Hetzner in Nuremberg, Germany, each copy deleted automatically after at most 12 months (section 10).

9. Sub-processors

You give us general authorisation to use these sub-processors for team data:

We give each sub-processor data protection obligations at least as protective as these, and we stay responsible to you for what they do. Before we add or replace a sub-processor we update this list and email the manager at least 30 days ahead. If you object on reasonable data protection grounds and we can't resolve it, you can cancel, and we will refund any payment covering the time after the change.

Some things the app does in the manager's or a driver's browser reach other services directly. They aren't sub-processing by us, and are listed so you know about them:

• postcodes.io (run by Ideal Postcodes) looks up a postcode that isn't in our own postcode data; it receives the postcode only.
• Map tiles come from our own tile server; if it is unavailable, from OpenFreeMap or OpenStreetMap, which then see which map area is being viewed.
• Google Analytics, where the person has agreed to it, receives page visits and app events (such as a step of the guide). The driver's app can include the first half of a stop's postcode (for example "SW1A"); never names, full addresses, notes or photos.
• Google Maps: when a driver taps to navigate, their phone opens Google Maps with the stop's address or position. A photo's map link opens OpenStreetMap at the photo's position.

10. Deletion and return

• Photos and signatures, and the record of where each was taken, are removed from the app 90 days after upload.
• Backups: everything removed from the app (photos and signatures after their 90 days, a removed driver, a team's data after a pause or an end, a deleted account) stays in our encrypted backups for up to 12 months after it was removed, as proof of delivery in case of a dispute, and is then deleted automatically. We never use backups to bring back deleted data into the app.
• Removing a driver: we delete their email address, phone number, start and finish addresses, password and sign-in sessions at once, and they can no longer sign in. The record of the deliveries they made keeps their name for 90 days, so you can still answer a query about a delivery; we then delete those records and the login.
• A paused team: we keep team data for 12 months from the start of the pause. A team whose subscription, free trial or free time ended without being renewed: we keep it for 90 days after it switched off. In both cases we email the manager 14 days before, and then remove your drivers as for removing a driver, and delete the team's plans (the jobs, with the details of the people delivered to). Nothing is removed unless that email went at least 14 days earlier. Starting again before then keeps everything.
• While your team is running, its plans are kept, so you can look back at past days.
• Copies made to check the route planning: when a route is worked out, we may keep the stop positions, time windows and postcodes for up to 30 days to investigate problems; they are then deleted automatically.
• Deleting the manager's account deletes the team, its plans, its driver logins and all team data from our live systems straight away.
• A copy before deletion: ask us and we will give you a copy of team data in a common format.

11. Helping you

• Requests from people: if a driver or anyone else asks us about their data, we pass the request to you and don't answer it ourselves unless you ask us to. We help you answer requests to see, correct or delete team data, for example by finding a particular delivery's photo.
• Your other duties: we give you the information and help you reasonably need for security, breach notifications, data protection impact assessments and any consultation with the ICO (UK GDPR articles 32 to 36).

12. Breaches

If we become aware of a personal data breach affecting team data, we tell the manager without undue delay, with what we know about what happened, the data and people affected and what we are doing about it, and keep you updated.

13. Audits and information

We make available the information you reasonably need to show that these obligations are met, and allow and contribute to audits, including inspections, by you or an auditor you appoint. You give us at least 30 days' notice, no more than once in 12 months unless there has been a breach or the ICO requires it, and keep what you learn confidential. You pay your own costs.

14. Transfers

Where a sub-processor handles team data outside the UK, the transfer is covered by UK adequacy regulations (the EU and EEA, and the UK Extension to the EU-US Data Privacy Framework for certified US companies) or by the UK International Data Transfer Agreement or Addendum.

15. UK GDPR article 28 checklist