Privacy Policy

This Privacy Policy explains how Handova LLC ("Handova", "we") collects, uses, shares and protects personal information, and the choices and rights you have. It applies to the Handova website, apps and service, and to people who contact us. It is written to meet the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA), the other U.S. state privacy laws, and the data protection laws of the other countries where Handova is used.

1. Two roles: whose information, and who decides

• Handova as processor / service provider. When a company uses Handova, information about its drivers, staff, assets and operations (shift reports, cash and expense records, vehicle checks, location during shifts, documents) is Customer Data. The company is the controller (in California, the "business") and decides why and how it is used. We process it only on the company's instructions, under our Data Processing Agreement. If you are a driver or staff member, your employer or the company you work for is responsible for this information; please contact them first to use your rights. We will help them answer you.
• Handova as controller. We decide how to use information about account owners and administrators, billing contacts, website visitors, people who contact us, businesses that join the Handova network, and information we need to secure and improve the Service. This policy mainly describes that information.

2. Information we collect

We do not ask for, and you should not enter, sensitive information such as health, religion, ethnicity, sexual orientation, biometric data or criminal records. Precise geolocation and government ID numbers are "sensitive personal information" under some laws; we use them only to provide the Service, as described here.

3. How we use information, and our legal bases

We do not use personal information for automated decisions that have legal or similarly significant effects on you. Handova flags reports (for example a cash shortage or unusual fuel use) for a person at the company to review; the company decides what to do.

We do not use Customer Data to train general artificial-intelligence models, and we do not sell it.

4. Who we share information with

• Within your company. Company managers see their drivers' reports and, on plans that include it, location during shifts. Drivers see their own records.
• Service providers (sub-processors) that host, run and support Handova, bound by contracts that protect the information:

• Network partners, only when you choose to send them a request; we share what you put in the request and your contact details.
• Handova staff, only as needed for support, security and billing. Staff cannot see a company's private details (driver licences, IDs, addresses, vehicle papers) unless they ask for access for a support reason; each access is logged.
• Authorities and others where required by law, or to protect rights, property and safety. We review requests and push back on ones that are too broad. Where lawful, we tell the affected company first.
• A buyer or successor, if Handova is sold, merged or reorganised, under the same protections.

We do not sell personal information and do not "share" it for cross-context behavioural advertising (as those terms are defined in the CCPA). We do not use advertising or tracking cookies. We honour Global Privacy Control signals.

5. International transfers

Handova LLC is based in the United States and serves companies in many countries, so information may be processed in the United States and in the countries of our service providers. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments), or another valid transfer mechanism, plus extra safeguards such as encryption in transit. For other countries with transfer rules (for example South Africa, Nigeria, Kenya, Brazil, India and others), we rely on contractual protections and the other grounds those laws allow. You can ask privacy@myhandova.com for a copy of the relevant safeguards.

6. How long we keep information

• Account information: while the account is open, then deleted or anonymised within 90 days, unless kept longer by law.
• Customer Data: as long as the company keeps its account and decides; deleted within 30 days after the account is closed (backups roll off within a further 90 days).
• Location points: 365 days, then deleted automatically (companies may ask for a shorter period).
• Billing and tax records: as long as tax and accounting laws require (usually 5 to 10 years).
• Security logs: up to 12 months.

Deleting your account

You can delete your account at any time, in the app (Profile → Delete my account) or on the web at https://myhandova.com/delete-account, where we email you a link to confirm. When you delete your account we delete straight away your name, email, phone number, password, photo, ID and licence numbers, address, emergency contact and GPS location history, and you can no longer log in. Daily reports and shifts a driver sent stay with their company as its business records, shown as "Deleted user". If you are the last manager of a company, deleting your account also deletes the company and all its Customer Data. We keep payment records and the record of which terms were accepted for as long as the law requires (see above). Copies in backups are overwritten within 90 days.

7. Security

We use encryption in transit (HTTPS), hashed passwords, access controls by role, login limits, logging of staff access to company data, separate data for each company, backups and regular updates. If a breach affects your personal information, we will inform the company responsible and, where the law requires, the authorities and you, without undue delay.

8. Your rights

Depending on where you live, you may have the right to: know and access the personal information we hold; get a copy in a portable format; correct it; delete it; restrict or object to some uses (including to direct marketing at any time); withdraw consent where we rely on it; limit the use of sensitive personal information; and not be discriminated against for using your rights. To use your rights, write to privacy@myhandova.com or use the controls in your profile (including Delete my account). We will verify your identity and answer within the time the law requires (usually 30 days under GDPR and 45 days under the CCPA). You may use an authorised agent where the law allows. If your request concerns Customer Data, we will pass it to your company and help it respond.

• EU, EEA and UK: you may complain to your data protection authority.
• California and other U.S. states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island): you have the rights above as your state's law provides, and you may appeal a refusal by replying to our decision; if we deny your appeal, you may contact your state Attorney General. In the last 12 months we collected the categories listed in section 2, for the purposes in section 3, and disclosed them only to the recipients in section 4. We have not sold or shared personal information.
• Africa, Asia, Latin America and elsewhere, for example under South Africa's POPIA, Nigeria's NDPA, Kenya's Data Protection Act, Brazil's LGPD or India's DPDP Act: you have the rights your law gives you, and you may complain to your national data protection authority.

9. Cookies and similar technologies

We use only cookies and storage that are strictly necessary: a session cookie that keeps you logged in (for up to 30 days if you choose "Remember me"), a security token against forged requests, and your device's storage for the app's offline files and small preferences. We do not use advertising cookies or third-party analytics trackers. If this changes, we will update this policy and ask for consent where required.

10. Children

Handova is for businesses and is not directed to children. Users must be at least 18. We do not knowingly collect information from children; if we learn that we have, we will delete it.

11. Changes

We will post changes here and update the date above. If changes are material, we will tell account owners by email or in the Service before they take effect.