Data Protection Policy

This Data Protection Policy explains how Handova LLC ("Handova", "we") protects personal data in practice: the rules our team and contractors follow, and the technical and organisational measures behind the Handova service. It works together with our Privacy Policy (what we collect and why), the Data Processing Agreement (our commitments to business customers) and the GPS Tracking and Driver Consent Policy. If this policy and one of those documents differ, that document applies.

1. Scope

This policy applies to all personal data Handova handles, in every country, whether we act as a controller (for example, data about our own customers' account holders, website visitors and partners) or as a processor / service provider for companies that use Handova (for example, their drivers' reports and location). It applies to everyone who works for or on behalf of Handova.

2. Principles we follow

We follow the principles of the EU and UK General Data Protection Regulation (GDPR), which we use as our worldwide baseline, as well as the U.S. state privacy laws (such as the California Consumer Privacy Act) and other national laws that apply to us. In particular:

• Lawful, fair and transparent: we tell people what we do with their data, and have a legal basis for each use.
• Purpose limitation: data collected to run fleets is used to run fleets. We do not sell personal data or use it for advertising.
• Data minimisation: we collect only what each feature needs. For example, phone location is collected only during a driver's shift.
• Accuracy: people can correct their own details in the app, and companies can correct their drivers' records.
• Storage limitation: data is kept only as long as set out in the Privacy Policy. Location points are deleted automatically after 365 days.
• Integrity and confidentiality: the security measures in section 4.
• Accountability: we keep records of processing, records of each acceptance of our terms, and logs of staff access to company data.

3. Roles and responsibilities

• Management is responsible for this policy, for giving the team the means to follow it, and for reviewing it at least once a year.
• Privacy contact: questions, requests and concerns go to privacy@myhandova.com. This contact coordinates data subject requests, breach handling and records of processing.
• Everyone at Handova must follow this policy, complete privacy and security training when they join and at least yearly, keep passwords and devices secure, and report any suspected breach at once.
• Customers (companies) decide how they use Handova for their drivers and staff, must have a lawful basis for it (including any notice or consent their local law requires for tracking), and must handle requests from their own drivers and staff.

4. Security measures

• Separation: each company's data is kept apart, and every page and API checks which company the signed-in person belongs to.
• Access control by role: drivers, company managers and Handova staff each see only what their role needs.
• Staff access: Handova staff cannot see a company's private details (such as driver contact details) unless they ask for access, give a reason, and the access is logged and time-limited.
• Passwords: stored only as slow, salted hashes (scrypt). Log-in attempts are limited to slow down guessing.
• Encryption in transit: all connections use HTTPS (TLS). Cookies are marked secure and HTTP-only where possible.
• Protection against common attacks: forms are protected against cross-site request forgery, database queries are parameterised, and uploaded photos are checked and re-encoded.
• Backups and recovery: regular, access-controlled backups that are tested for restore.
• Updates: software and dependencies are kept up to date, and security fixes are applied promptly.
• Suppliers: we use only service providers that give suitable written data protection commitments. The current list is in the Data Processing Agreement.

5. Data protection by design

Before we build or change a feature that uses personal data, we ask what data it really needs, who should see it, how long it should be kept, and whether it could surprise the people it is about. Features with higher risk, such as location tracking, get a written assessment (a data protection impact assessment where the law requires one) and privacy settings that are on by default.

6. International transfers

Handova is a U.S. company with customers in many countries. When personal data moves between countries, we use the safeguards described in the Privacy Policy and Data Processing Agreement, such as the European Commission's Standard Contractual Clauses and the UK Addendum.

7. Personal data breaches

1. Anyone who suspects a breach reports it at once to the privacy contact.
2. We contain it, investigate what happened and which data and people are affected, and record it, even if it turns out to be minor.
3. Where we process data for a company, we tell that company without undue delay and in any case within 48 hours of becoming aware of it, as set out in the Data Processing Agreement.
4. Where we are the controller, we notify the supervisory authority within 72 hours where the law requires it, and the people affected where there is a high risk to them.
5. We fix the cause and review what we can learn.

8. Your rights and how to use them

Depending on where you live, you may ask to see, correct, delete or receive a copy of your data, to object to or restrict some uses, and to withdraw consent. Write to privacy@myhandova.com. If you are a driver or employee of a company that uses Handova, your company decides about your work data; we will pass your request to them and help them answer it. We reply within the time the law requires (usually one month), and we will not treat you differently for using your rights. You may also complain to your local data protection authority.

9. Changes

We review this policy at least once a year and when the law or our service changes. The version and date at the top show when it last changed.