1. Information We Collect

1.1 Personal & Employee Information

• Employee Identification: Employee ID, Full Name, Company Email Address
• Contact Details: Phone Number, E-mail
• Employment Data: Department, Employee Role
• Account Information: Username, Encrypted Password, Profile Picture

1.2 Transport & Usage Data

• Transport Requests: Pickup/Drop locations, Times, Dates, Approval records & Passengers
• Travel History: Completed trips, Routes taken
• Vehicle Information: Vehicle details, Driver information
• Cost Calculations: Travel expenses, Estimated costs, Cost centers

1.3 Device Information

• Device Details: Device type, OS version, Unique device identifier
• App Usage: Login times, Feature usage statistics
• Location Data: Once logging to the app

2. How We Use Collected Information

2.1 App Functionality

• User authentication and role-based access control
• Transport request processing and management
• Cost calculation and expense tracking
• Approval workflows for transport requests

2.2 Role-Specific Processing

• System Admin: User management, System configuration, Data oversight
• HOD/HR: Employee management, Policy enforcement, Cost analysis
• Transport Supervisor: Vehicle allocation, Driver management, Schedule optimization
• Security: Verification, Movement tracking, Security oversight
• Employee: Personal transport requests, Travel history, Workflows tracking
• Driver: Start and end trips, Vehicle management

2.3 Analytics & Improvement

• App performance monitoring and bug fixing
• Usage pattern analysis for feature improvement
• Transport efficiency optimization
• Cost reduction analysis

3. Data Sharing & Disclosure

3.1 Internal Sharing

• Data is shared ONLY within authorized company personnel
• Role-based data visibility ensures minimal access principle
• Transport supervisors see relevant transport data
• HR/HOD sees department-level analytics and costs
• Security sees only necessary verification data
• Data is shared with the project team for maintenance and support

3.2 No External Sharing

• No data is sold to third parties
• No advertising partners have access
• No external marketing use

3.3 Legal Compliance

• Data may be disclosed if required by law
• Only to comply with legal obligations
• With appropriate internal authorization

4. Data Security

• End-to-end encryption for all sensitive data
• Regular security audits and penetration testing
• Multi-factor authentication for admin accounts
• Role-based access controls (RBAC)
• Regular data backups and disaster recovery
• Secure hosting on Railway platform with enterprise security

5. User Rights & Controls

5.1 Employee Rights

• View and update personal information
• Access personal transport history
• Request data correction

5.2 Account Management

• All accounts require system approval
• Self-service profile updates
• Password reset functionality
• Account deactivation upon employee exit handled manually

6. Data Retention

• Active employee data: Retained indefinitely
• Transport records: 1 years for audit purposes
• Inactive accounts: Archived after 3 months
• Deleted accounts: Permanently removed after 7 days
• Backup data: Rotated every 90 days