PRIVACY POLICY – HELLOTRANSFER DRIVER APP

Version: 1.0.0

Effective Date: 2026-10-24

1. WHO WE ARE

This Privacy Policy explains how HelloTransfer Limited (“we”, “us”, “our”) processes personal data when you use the HelloTransfer Driver app.

Data Controller

HelloTransfer Limited

Website: https://hellotransfer.io/

Email: [email protected]

2. PERSONAL DATA WE COLLECT

We collect and process the following personal data:

Driver name
Driver email address
Driver phone number
Login authentication tokens (JWT)
Location data (GPS) while a ride is in progress, including in the background, with precise or approximate accuracy
Ride steps you report (start, arrival at pickup, pickup, completion or no-show), each with its place and time
Chat messages you exchange with passengers and with dispatch about a booking
Photos you take with your device’s camera or select from your gallery as evidence in no-show cases
Your device’s push notification token and the language the app is set to
App crash reports and diagnostic data via Sentry: the error, your device model, operating system and app version, and the screens and network requests that led to it. They do not include your name or email address.

We do not collect personal data beyond what is listed above.

3. DEVICE PERMISSIONS

The app requests the following device permissions to function properly:

Camera (Android: CAMERA / iOS: NSCameraUsageDescription)

The app uses your device’s camera to capture location photos as evidence in no-show cases.

Camera access is only used when you actively choose to take a photo within the app. The app does not access the camera in the background or capture photos without your knowledge.

Photo Library / Media Storage (Android: READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE / iOS: NSPhotoLibraryUsageDescription)

The app requests access to your device’s photo library so you can select existing photos as evidence in no-show cases.

You can manage these permissions at any time through your device’s settings.

Location – Always On (Android: ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, ACCESS_BACKGROUND_LOCATION, FOREGROUND_SERVICE_LOCATION / iOS: NSLocationWhenInUseUsageDescription, NSLocationAlwaysAndWhenInUseUsageDescription)

While a ride is in progress, the app needs access to your device’s location, including when the app is running in the background. This is mandatory for the app to function correctly. Background location access is necessary to:

Provide real-time GPS tracking of the driver’s location during the ride
Send location updates to the dispatch system and to the booking’s source platform
Enable accurate pickup coordination with passengers

On Android devices, a persistent notification (foreground service) is displayed while location tracking is active to inform you that the app is accessing your location.

Location – iOS Specific (Precise and Approximate Location)

On iOS devices, the app requests location access with the following options:

Precise Location (Full Accuracy): When enabled, the app receives your exact GPS coordinates. This is the recommended setting, as it allows accurate driver positioning and precise pickup coordination.
Approximate Location (Reduced Accuracy): iOS allows you to grant location access with reduced accuracy, which provides only your approximate location (within several kilometers). The app still works with reduced accuracy, but arrival time estimates become less accurate and coordinating with passengers may be harder.

The app requests “Always” location permission on iOS to enable background location tracking during rides. You will be prompted to select your preferred accuracy level. We strongly recommend enabling precise location.

Motion & Fitness Activity (Android: ACTIVITY_RECOGNITION / iOS: NSMotionUsageDescription)

The app requests access to motion and fitness activity data from your device’s motion sensors. This lets the app detect whether you are stationary, walking or driving, so it can:

Adjust how often it records your location based on whether you are moving
Save battery by recording your location less often while you are stationary

Motion data is processed only on your device and is not sent to our servers. Each location point the app sends contains the coordinates, their accuracy, your speed, your heading and the time it was recorded.

Notifications (Android: POST_NOTIFICATIONS / iOS: notification permission)

The app asks for permission to show notifications so it can tell you about new, changed or cancelled bookings and new chat messages. If you decline, the app still works, but you will not receive these alerts.

You can manage these permissions at any time through your device’s settings. However, disabling location permissions will prevent the app from functioning as intended. Disabling motion permissions may result in reduced battery optimization.

4. HOW DATA IS COLLECTED

Personal data is collected in the following ways:

Directly from you through the app (for example, chat messages you write and photos you take or select)
Automatically by the app during normal use (for example, location data during rides, the push notification token and crash reports)
Driver data provisioned centrally by the transport company you drive for before your first app access

Location data is collected from the moment you start a ride until the ride is completed or marked as a no-show, including when the app is in the background. On iOS, the accuracy of location data depends on whether you have granted precise or approximate location access. Photos are captured or selected only when you explicitly open the camera or photo library in the app.

5. PURPOSE OF DATA PROCESSING

We process personal data for the following purposes:

User authentication and access control
Providing core app functionality, including ride status updates and GPS-based tracking
Real-time location monitoring during rides for dispatch and passenger coordination
Letting you chat with passengers and dispatch about a booking
Sending you push notifications about bookings and chat messages in the language you use
Adjusting location recording and battery usage based on detected motion
Capturing and uploading photos as evidence in no-show cases
Monitoring app stability and fixing errors through crash analytics

6. LEGAL BASIS FOR PROCESSING

Personal data is processed based on:

Performance of a contract – drivers are under contract with HelloTransfer Limited or with the transport company they drive for before using the app; location tracking during rides, ride step reporting, chat and no-show photos are necessary to fulfill contractual obligations
Legitimate interest – maintaining, securing and improving the app, including battery optimization through motion-based location adjustments and crash analytics
Consent – for features that depend on optional device permissions, such as notifications

7. AUTOMATED DECISION-MAKING

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. All decisions regarding your data or any complaints are made manually by our staff.

Personal data may be shared with:

The companies handling the booking – staff of the transport company you drive for, and of the company that assigned the booking to it, can see your location and ride steps recorded during the ride, and can read and write the booking’s chat
Passengers – the passenger sees the chat messages you send them, and also sees messages dispatch writes in the booking’s chat as coming from you
DigitalOcean, LLC – hosts our servers and databases in Frankfurt, Germany
Booking.com (Booking.com B.V.) – for bookings that come from Booking.com, we send your first name, last name and phone number when you are assigned, each ride step with its place and time, your live location during the ride, and the chat messages you exchange with the passenger
Expo (650 Industries, Inc.), Apple Push Notification service and Google Firebase Cloud Messaging – to deliver push notifications; they receive your device’s push token and the notification content, which can include the passenger’s name, the pickup time and the beginning of a chat message
Sentry (Functional Software, Inc.) – for crash reporting and diagnostics

We do not sell personal data to third parties.

9. INTERNATIONAL DATA TRANSFERS

Our servers and databases are hosted by DigitalOcean, LLC in Frankfurt, Germany, within the European Union. DigitalOcean is a US company, and Booking.com, Expo, Apple, Google and Sentry may process data outside your country and outside the EU. In such cases, appropriate safeguards such as Standard Contractual Clauses and applicable data protection frameworks are used.

10. DATA RETENTION

Personal data, including location data, ride steps and chat messages, is retained for the duration of the driver’s contractual relationship and for a period of 3 (three) years after the contract ends, in accordance with legal and operational requirements.

Photos captured for no-show evidence are retained only as long as necessary to resolve the relevant operational case, and no longer than 3 years.

Your push notification token is deleted from our servers when you log out. If your session expires, or you log out without an internet connection, the token stays on our servers, and notifications can still reach the device, until the push service reports that it is no longer valid, for example after you uninstall the app.

Motion activity data stays on your device and is not stored by us.

11. USER RIGHTS

Under applicable data protection laws, including the GDPR, Brazil’s LGPD, Argentina’s Law 25,326, Colombia’s Law 1581 of 2012 and Chile’s Law 19,628 as amended by Law 21,719, you have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your data and your account
Restrict or object to processing
Request data portability
Withdraw consent for notifications at any time in your device’s settings

Location, camera and photo library access are needed to perform your contract (section 6). You can turn them off in your device’s settings, but the app then cannot record rides or no-show evidence.

We will respond to your request within 30 days.

Requests, including requests to delete your account, can be made by contacting: [email protected]

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

Argentina: Agencia de Acceso a la Información Pública (AAIP)
Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
Chile: Agencia de Protección de Datos Personales, once it begins operating under Law 21,719
Colombia: Superintendencia de Industria y Comercio (SIC)
European Union: the data protection authority in your country of residence

12. DATA SECURITY

We use appropriate security measures to protect personal data, including:

Secure hosting infrastructure
Encrypted communication (HTTPS/TLS)
JWT-based authentication
Restricted access controls
Secure transmission of photos, chat messages and location data
Processing motion sensor data only on your device

13. CHILDREN

This app is intended only for registered drivers. It is not intended for use by children under the age of 18.

14. CHANGES TO THIS POLICY

This Privacy Policy may be updated periodically. When changes are made, the version number and effective date will be updated. We encourage you to review this policy regularly. The current version is published at https://hellotransfer.io/driver-app/privacy/.

15. CONTACT

For privacy-related questions or requests, contact:

Email: [email protected]