HAULR Dispatch Privacy Policy

We are committed to protecting your privacy and complying with the Privacy Act 2020 (the Act). This policy explains how personal information is collected, used, stored and shared when people use HAULR Dispatch, including:

• the office web app;
• the driver phone app;
• the private links it creates (customer, tracking, quote and subcontractor links);
• the public demo on our website; and
• the load marketplace.

It should be read with the HAULR Dispatch Terms of Service.

HAULR Dispatch is operated by Haulr Limited (HAULR, we, us).

1. Who is responsible for your information

HAULR Dispatch is used by transport businesses (our customers) to run their work.

• If you are a driver or office staff member, or a customer or subcontractor of a transport business, that business decides what information about you goes into HAULR Dispatch and how it is used. HAULR holds that information on the business's behalf, as its agent, solely to provide the service to it (section 11 of the Act). Questions about how a business uses your information are best asked of that business first, but you can also contact us.
• HAULR collects information directly, and is responsible for it, when you:
• sign up a business or manage its subscription;
• post a load on the marketplace;
• contact us for support; or
• use the public demo.

2. Information we collect

Office users and account owners

• Name, email address, phone number and role (owner, dispatcher or driver).
• Login details. If you turn on two-step sign-in, the setup is stored, but we never see your codes.
• Billing contact details. Card details are collected and held by our payment provider, Stripe. HAULR never sees full card numbers.

Drivers

• Name, phone number, email address, role and usual truck.
• Information the office adds, which can include:
• driver licence number, classes and expiry dates;
• endorsements and medical certificate expiry dates;
• documents (such as licence or certificate copies); and
• training records and certificates.
• Work records:
• jobs and the time each job step was tapped;
• shifts, breaks and allowances;
• pre-start check answers;
• vehicle problem reports;
• incident and near-miss reports; and
• health and safety documents you have read and signed, with your typed name and signature.
• Pay figures, worked out from timesheets. These are visible to owners only.
• Photos you choose to take, such as delivery, defect and incident photos.

Location

• The driver app records your phone's location only at the moment you:
• tap a job step (for example Start, At pickup, Loaded or Delivered);
• start or finish a shift;
• submit a pre-start check;
• report a vehicle problem; or
• report an incident or near miss.
• We do not track you in the background.
• While you have a job open, the app may compare your phone's position with the job's site on your phone only, to show a "you're at the site" note. That comparison is not stored or sent to us.
• From the locations recorded at job steps, we learn where a business's regular pickup and delivery sites are, so the app can show that note on future jobs. These site locations are stored against the address, not against you, and are only used for that business.
• If a business connects its EROAD account, we receive the current position, speed and status of its vehicles from EROAD's units. This is about the vehicle, but can show where the driver of that vehicle is.

Customers of transport businesses, and people receiving deliveries

• Business and contact names, phone numbers, email addresses, billing and delivery addresses.
• The name and signature of the person who signs for a delivery, and delivery photos.
• Bookings made through a customer link, and the name and any note given when accepting or declining a quote through a quote link.

Subcontractors

• Business name, contact name, phone number, email address, GST registration status and the price agreed for each job.
• Job steps tapped, photos, signatures and, if you allow it in your browser, your location at the moment you tap a job step.

Marketplace posters

• Your name, email address, phone number, pick-up and delivery addresses, and details of the load and dates.

Technical information

• If you allow notifications, a notification token and your device type (iOS or Android), so we can send job notifications.
• Error reports when something goes wrong in the apps (the error message, the screen or page, and the app version), so we can fix problems.
• A record of important changes made in the office app (for example who changed a job's charges and when), for security and to resolve disputes.
• Our hosting providers keep standard server logs, which include IP addresses.
• The apps store your login session and some preferences on your device. We do not use analytics, advertising or tracking cookies.

Public demo

• Each visitor gets their own private demo company with made-up sample data. It is deleted, with anything entered into it, after 24 hours. Please don't enter real personal information into it.
• To stop misuse, we keep the IP address each demo was started from for 2 days.

3. How information is used

We use information only as needed to provide HAULR Dispatch, or as otherwise required by law. That includes to:

• run dispatch for the business: showing jobs to the right drivers, recording progress, photos and signatures, and sending job notifications;
• produce quotes, invoices, timesheets, pay figures, reports, compliance reminders and health and safety registers for the business;
• show the business's customers and subcontractors what their Link allows (clause 4);
• connect to services the business has chosen, such as Xero or EROAD;
• bill the business for its subscription;
• run the marketplace (clause 6);
• provide support, keep the service secure, fix problems and improve it, using de-identified information where possible; and
• comply with the law and enforce our Terms of Service.

We do not sell personal information or use it for advertising.

4. Who can see what

• Drivers see their own jobs, documents and records. They never see prices or other drivers' pay.
• Office staff of a business see that business's information. Pay figures, reports and billing are visible to owners only.
• Customers and people receiving deliveries with a customer or tracking link see their jobs' progress, who signed and delivery photos, but never prices. People with a quote link see that quote's price.
• Subcontractors with a job link see that job and the price agreed with them.
• Each business's information is kept separate from every other business's.
• Anyone who has a link can see what that link shows. Businesses can switch links off or replace them at any time.

5. Disclosure of your information

We may disclose personal information:

• to the business you work for or deal with, as described above;
• if we, or a substantial part of our assets, are acquired by a third party, in which case personal information may be one of the transferred assets;
• if we are under a duty to disclose it to comply with the law, or to enforce our Terms of Service or protect our rights, property or safety or that of others; and
• as aggregated or de-identified information that does not identify you.

A business can also choose to send its own information to its other systems using HAULR Dispatch's API and webhooks or export files. Once it does, that business is responsible for it.

We share information with the following service providers, who process it to provide their services to us:

• Supabase: our database, file storage and server functions, hosted in Sydney, Australia.
• Vercel: hosting for the office web app and our web pages.
• Expo, Apple Push Notification service and Google Firebase Cloud Messaging: to deliver notifications to phones. They receive the notification token and the notification's text.
• Stripe: subscription payments. Stripe collects card details directly.
• Xero, if a business connects it: details needed for draft invoices and bills (customer or subcontractor names, contact details, job references and amounts). We also read back the payment status of invoices.
• EROAD, if a business connects it: we receive vehicle positions as described in clause 2.
• OpenStreetMap: map images on the office app's map. Your browser requests the map tiles directly, which shows OpenStreetMap your IP address and the area you are viewing.

Some of these recipients are foreign persons or entities for the purposes of the Act (for example, they are companies incorporated outside New Zealand).

• Before we disclose your personal information to a recipient outside New Zealand, we take reasonable steps to satisfy ourselves that the recipient is required to protect it in a way that, overall, provides comparable safeguards to those under the Act, for example through our contracts with that recipient.
• Where that is not the case, we will make the disclosure only with your authorisation. You authorise us to do so on the understanding that those recipients may not be subject to privacy laws that provide comparable safeguards to those under the Act.

6. The marketplace

The marketplace is switched off until these documents are final.

• Before you book, transport businesses see only the towns, the load description, its size and weight, and the dates of a load you post.
• After you accept a price, your name, phone, email and addresses are given only to the business whose price you accepted, so it can arrange the job with you. From then on, that business handles your information under its own privacy obligations.
• Unbooked posts are deleted 90 days after they close, and booked posts one year after booking. The business you booked keeps its own job record.

7. Where we store your information and how we protect it

• Information is stored with Supabase in Sydney, Australia. Other service providers handle information as described in clause 5.
• Protection:
• information is encrypted in transit and at rest;
• each business's information is separated by database rules that are tested automatically before every change;
• photos, signatures and documents are stored privately; and
• two-step sign-in is available for every login.
• The transmission of information over the internet is not completely secure. We will do our best to protect your personal information, but we cannot guarantee the security of information transmitted to the service.
• Once we have received your information, we use reasonable security safeguards to protect it against loss and against unauthorised access, use, modification and disclosure.
• If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, as required by the Act. Where the information belongs to a business's records, we will also tell that business without undue delay.

8. How long we keep information

We keep information only as long as it is needed:

• A business's records (jobs, job-step times and locations, photos, signatures, timesheets, invoices, compliance and health and safety records) are kept while its account is active, unless the business deletes them sooner. Businesses decide how long they need their own records for tax, employment and health and safety purposes.
• When a business cancels, we keep its information for 90 days so it can be exported or the account restarted, and then delete it, except where we must keep information by law.
• When the last user of a business deletes their account, that business's information and files are deleted at that time.
• Error reports are deleted after 90 days.
• Marketplace posts: see clause 6.
• Billing and tax records for HAULR's own subscriptions are kept for 7 years, as New Zealand tax law requires.
• Deleted information may remain in our backups for up to 7 days until those backups expire.

9. Children

HAULR Dispatch is not intended for anyone under 18. We do not knowingly collect personal information from people under 18. If we become aware that we have, we will delete it promptly.

10. External links

The apps may contain links to other websites and services. They have their own privacy policies, and we are not responsible for them.

11. Access, correction and deletion

• You have the right to ask for a copy of the personal information held about you, and to ask for it to be corrected, in accordance with the Act.
• If your information is held for a business you work for or deal with, you can ask that business, or contact us and we will work with them.
• Drivers can delete their account in the driver app (main screen, Delete my account). This removes your personal details and your login. Job and timesheet records the business needs for pay, tax and health and safety stay with the business and show as "Deleted user".
• Marketplace posters can cancel a post from the link they were given, and can ask us to delete their information.
• Some information is kept after deletion where we are required to keep it by law, or where it no longer identifies you.

Email support@haulr.co.nz with your requests.

12. Changes to this policy

Any changes we make to this policy will be posted on this page. Where the changes are material, we will notify account owners by email.

This privacy policy was last updated on date.

Contact

• If you are unsure about anything in this policy, or have questions or comments about it, please email support@haulr.co.nz.
• Our Privacy Officer is Raquel Wheatley, who can be contacted at privacy@haulr.co.nz.
• If you are not satisfied with how we have handled a privacy request or complaint, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.