This is an English translation provided for convenience. In the event of any discrepancy, the Romanian version available at www.routena.com/politica-confidentialitate shall prevail.
1. Introduction
Welcome to the Routena website and application (“We”, “our Company”, “the Platform”, “Routena”), operated by SPECTRALAB SOLUTIONS S.R.L. At Routena, we care about the privacy of your data and want to inform you about how we collect, store, use and protect personal data.
This policy applies both to the www.routena.com website and to the Routena application (including the main application and the mobile application for drivers) and its subdomains (e.g. app.routena.com). When creating an account, the Client accepts both the Terms and Conditions of use and this Privacy Policy.
This policy must be read together with the Terms and Conditions and the GDPR page, which detail the roles of the parties, the sub-processors and the rights of data subjects.
2. Data collected
2.1. Personal data: We collect personal data that you provide voluntarily, such as name, email address, phone number and any other information you provide during registration and use of our platform.
2.2. Usage data: We automatically collect information about how you use our platform, such as IP addresses, browser type, pages visited and platform usage data.
2.3. Data entered by the Client into the platform: In the course of operational use, the Client enters, imports or generates data in the platform that belongs to and is controlled by the Client, including: names and data of employees and drivers, documents and photos (e.g. CMR, delivery notes, identity documents, licenses), vehicle data, data about partners and their contacts, order and route data, GPS location data, as well as financial and fiscal data. The Client decides what data to enter and for what purpose. This data is used for the Client’s management and operational purposes (planning and executing transports, invoicing, reporting). In relation to this data, the Client acts as Controller, and Routena as Processor, in accordance with art. 28 GDPR.
3. Purpose of data collection
3.1. Service provision: We collect and process data to provide our services, to authenticate you and to allow you to use the features of our platform.
3.2. Analytics and improvements: We use data (generally aggregated or technical) to carry out statistical analysis and to improve our services, including the website and the application.
3.3. Communication: We may use your contact data to send you updates, offers and relevant information about our services. Marketing communications are sent only with your consent, which you can withdraw at any time.
3.4. Legal basis: We process personal data on the basis of one or more of the grounds provided for by the GDPR, depending on the context: performance of the contract (provision of the services), compliance with a legal obligation (e.g. fiscal obligations and transmission of e-Factura to ANAF), our legitimate interest (platform security, fraud prevention, service improvement) and, where applicable, your consent (e.g. marketing communications, certain cookies). For data entered by the Client into the platform, the legal basis is established by the Client, as Controller.
4. Storage and retention of data
We retain personal data for as long as necessary to achieve the purposes described in this policy or in accordance with applicable legal obligations. For data entered by the Client into the platform, upon termination of the services access is discontinued and the data is automatically deleted within 60 days; the Client may request immediate deletion, which is carried out within a maximum of 5 working days (see section 3.5 of the Terms and Conditions). We keep data in a secure environment and take appropriate measures to protect it.
5. Access to data
You have the right to request access to your personal data that we hold and to have it corrected if it is inaccurate. Requests concerning data entered into the platform by a Client (e.g. data of an employee or driver) should be addressed primarily to that Client, in its capacity as Controller. For any request, you can contact us at [email protected].
6. Data sharing
We do not sell your personal data and do not disclose it to third parties for their own purposes.
Data entered by the Client is used for the Client’s operational and management purposes. Routena does not pass this data on further except where necessary to provide the service and, as far as possible, without identifying data. Automated technical integrations do not receive driver-identifying data: for example, for route calculation we transmit GPS location coordinates to the routing service, without transmitting information that identifies the driver (name, contact details). This minimization applies to all integrations where a third-party service does not need identifying data to perform its function.
Where the execution of the transport requires it, certain documents or confirmations sent to the Client’s partners (e.g. a transport confirmation sent to a client or supplier) may include the driver’s name and the vehicle registration number, because the partner needs this information to hand over or collect the goods. These transmissions are initiated by the Client, as Controller, for legitimate operational purposes.
We may also disclose data in the following situations: (i) to sub-processors that provide us with infrastructure and services (e.g. hosting, maps and routing, authentication, payments, email, monitoring), contractually bound to comply with data protection; (ii) where the Client itself initiates a transmission (e.g. transmission of e-Factura to ANAF, as the Client’s fiscal obligation); (iii) where we are legally required to do so or receive a reasoned request from a competent authority. The list of categories of sub-processors is available on the GDPR page.
7. Cookies and similar technologies
Our website may use cookies and similar technologies to ensure proper operation and to collect information about usage. Non-essential cookies (analytics, advertising, functionality) are set only after obtaining your consent through the cookie banner. You can manage or withdraw your preferences at any time from the cookie banner or your browser settings.
8. Links to other websites
Our platform may contain links to other websites. We are not responsible for the privacy practices of these third-party websites.
9. Data security and breach notification
We implement technical and organizational measures to protect data against unauthorized access, loss or destruction, such as encryption in transit (HTTPS/TLS), role-based access control, per-Client data isolation and periodic backups. However, no method of transmission or storage can be guaranteed to be 100% secure. In the event of a data breach that poses a risk, we will notify the supervisory authority and, where applicable, the Client (the Controller) without undue delay and, where feasible, within a maximum of 72 hours, in accordance with the GDPR.
10. International transfers and changes to the policy
10.1. Where data is transferred outside the EU/EEA, we ensure that adequate safeguards exist (e.g. an adequacy decision or the Standard Contractual Clauses approved by the European Commission). Where possible, data is processed and stored in data centers within the EU/EEA.
10.2. We reserve the right to modify this policy at any time. Any change will be posted on this page, and continued use of the platform will constitute your acceptance of these changes.
11. Contact
For questions or concerns regarding this privacy policy, please contact us at [email protected].
12. Routena Mobile Application – Drivers
This section applies to users of the Routena mobile application for drivers (“the Mobile Application”).
12.1. Account creation
Accounts in the Mobile Application are not created directly by drivers. They are generated by the Routena client (the transport operator) through the main application.
The transport operator acts as Controller, and Routena acts as Processor in accordance with art. 28 GDPR.
12.2. What data is processed
Through the Mobile Application, the following categories of data may be processed:
- identification data (name, authentication data);
- information about assigned orders and routes;
- status updates and timestamps;
- uploaded documents and photos (e.g. CMR, delivery notes);
- GPS location data (in real time and, if explicitly permitted, in the background);
- technical data necessary for the operation of the application.
Drivers do not enter additional personal data in the application beyond the operational information necessary to execute the transport.
12.3. GPS location
The application may collect location data:
- in the foreground (while the application is in use);
- in the background, only if the user explicitly grants this permission from the device settings.
Location data is used exclusively for:
- transmitting the position to the main Routena application;
- tracking the execution of transport orders;
- informing the client (the transport operator) about the delivery status.
The user can withdraw the location permission at any time from the device settings, although certain functionalities may become limited.
12.4. Notifications
The application may send push notifications related exclusively to:
- assigned orders;
- route changes;
- operational instructions.
Notifications are not used for marketing purposes.
12.5. Data retention and security
Data is stored in secure infrastructure and is retained only for the period necessary to execute the contract between Routena and its client (the transport operator) or in accordance with applicable legal obligations.
12.6. Rights of data subjects
Any request regarding the exercise of the rights provided for by the GDPR (access, rectification, erasure, etc.) should be addressed primarily to the transport operator that created the user’s account.