Trajenda Privacy Policy
Last updated: 28 October 2026 · Version: 1.3
This is a translation. The Dutch version at trajenda.com/privacy is the binding text for Dutch customers.
Trajenda v.o.f., Gasthuisstraat 27, 5931 NT Tegelen, Netherlands, Chamber of Commerce (KvK) 42185785, branch number 000066918065, VAT ID NL870091487B01 ("Trajenda", "we") provides software that transport companies use to plan trips and communicate with their drivers.
This policy covers two different situations, and the difference matters:
- If you are our customer (a transport company, or a planner working there), we are the controller for your account data.
- If you are a driver at a company that uses Trajenda, your employer is the controller for your data. We are a processor: we process only on your employer's instructions. Questions about your data go to your employer first; we help them answer.
1. What we process
About users (planners and drivers)
| Data | Why |
|---|---|
| Name, email address, phone number | Signing in, and so a planner knows who to call |
| Role (planner or driver) and company | Determines what someone may see |
| Preferred language | Instructions and messages are translated into it |
| Sign-in and session data | Security and abuse detection |
About trips
Destinations, addresses, contacts at the customer, time windows, arrival and departure times, cargo data (weight, items, temperature, ADR class, seal number), documents (consignment notes, proofs of delivery, signatures) and issue reports.
Driver location
Only where the driver has given explicit consent. The position is only tracked while a trip is running. Consent is per driver, off by default, and can be withdrawn at any time with one button ("Stop sharing") with no consequence for the trip.
The same consent applies to the place in a photo or record (proof of delivery, damage and evidence photos, ADR, load securing, refusal). With location sharing on, such a record gets the coordinates of that moment. That can also be outside a trip, for a photo of a defect during a vehicle check. With it off, it carries only the time, and the app does not ask the phone for its position at all. The place the phone's camera writes into a photo itself (EXIF) is removed from ordinary photos (JPEG, PNG, WebP) added in the driver's screens, before they are stored, including a photo of a consignment note.
We never infer trip status from location. A status changes only because the driver pressed a button. That is deliberate: the gap between "the truck is at the gate" and "the driver has arrived" is exactly the kind of inference nobody wants drawn about them.
Chat and voice messages
Text is translated into the recipient's language. Voice messages work: recorded, sent and played back. Automatically transcribing a voice message to text is switched off today. If we ever turn that on, the original audio will always remain available alongside the transcript, because a transcript can be wrong and the recipient must be able to hear what was actually said.
1a. The Android app
The Trajenda app (Google Play, com.trajenda.app) is the same service as trajenda.com, in an app on your phone: the app loads trajenda.com. Everything in this policy also applies to the app. What the app asks for on your phone, and why:
| Permission on your phone | When the app asks | What for |
|---|---|---|
| Location | First when you tap "Turn on location sharing", after the app has explained what is shared | Sharing your position with your planner during your shift, and while sharing is on, the place of a single photo or record at that moment (see §1) |
| Notifications | Just before location sharing starts, or when you tap "Turn on notifications" | So you see the persistent notification while your location is shared, and notifications from Trajenda if you turned them on (see below). Refusing blocks nothing |
| Camera | When you tap a photo button or "Turn on camera" in the scanner | Photos of damage, seals, consignment notes and proof of delivery; scanning barcodes and QR codes |
| Microphone | When you tap record for a voice message | The voice message to your planner |
The app does not ask for "Allow all the time". You can refuse any permission, or withdraw it later in your phone's settings.
Location in the app. Location is only shared if you turned sharing on yourself, and only during an open shift. This includes when the screen is locked, as long as the shift is running; you then see a persistent notification "Trajenda is sharing your location". While driving, your position is recorded at most once every two minutes; while parked, at most once every five minutes. Sharing stops when you tap "Stop sharing" or when your shift ends. A shift also closes by itself after 30 minutes without activity; a location point that was sent counts as activity, as does a status button.
To send your position while the screen is locked, the app receives a temporary key for each shift. It only works for your location points, only while your shift is open and sharing is on, and for no more than 24 hours. We only store a digital fingerprint (hash) of that key, not the key itself.
If you briefly have no signal, the app keeps the points on your phone (at most 250, no older than 6 hours) and sends them as soon as you have signal again.
Camera. Photos you take are stored with the trip, like other documents (see §3). The scanner reads barcodes and QR codes on your phone itself. The camera image does not leave your phone; only the code that was read is added to the trip.
Microphone. The app only uses the microphone while you record a voice message. A voice message is a message like any other (see §3).
Notifications in the app. You only get notifications if you tap "Turn on notifications" yourself; until then the app sets nothing up for them. To deliver a notification to your phone, the app uses Firebase Cloud Messaging from Google. For this, the app receives a registration number (token) for this installation from Google. We store that number with your account, so that a notification meant for you reaches your phone. With each notification we give Google only that number and the notification itself: the title, the short text, the place in the app a tap leads to, and a label that lets a newer notification replace an older one. No recipient name, no email address, no user number.
Please note: Google can read the title and text of such a notification. Depending on the kind of notification, it contains for example a destination or place, a trip reference, a driver's name, or a short part of a message or note (such as a message from a customer or the note with a damage report). The text of a chat message from the planner to the driver is not in it, only that there is a message. This differs from notifications in the browser (Web Push): those are encrypted for your device, and the browser's push service cannot see the content.
If you turn notifications off or sign out, the app deletes the registration number on our side and revokes it with Google. How long Google itself keeps data is in §3; who Google is and where it processes, in §4. Analytics (Google Analytics) is switched off for the app.
What the app does not do. No ads. No third-party analytics or tracking software. No access to the contacts, calendar or phone number of your phone. No in-app purchases: your employer manages the subscription. The app does not back up its data to your Google account.
If something goes wrong. If something goes wrong in a screen, an error report is sent to us: the message, the page and the browser type. No name, no company, no IP address. We remove email addresses, phone numbers and typed values before storing it. The report goes into our database in Stockholm, where we keep it for 30 days, and into the server log of our hosting (Vercel, see §4), which Vercel keeps for its own period.
2. Legal bases
| Processing | Basis |
|---|---|
| Account, trips, communication | Performance of the contract with the transport company |
| Driver location | Consent of the driver, separate and withdrawable |
| Retaining consignment notes (CMR) and other documents | Legal obligation (Dutch retention requirement) |
| Retaining proofs of delivery | Legitimate interest: being able to prove delivery |
| Security, abuse detection, billing | Legitimate interest |
Location consent is deliberately separated from everything else. Consent you cannot withdraw is not consent, which is why the withdrawal button sits on the driver's own screen rather than in an employer settings menu.
3. Retention
| Data | Period |
|---|---|
| Driver location | 30 days (carrier may set 7 – 30) |
| Chat and voice messages | 1 year (30 days – 3 years) |
| Status and problem reports | 2 years (90 days – 7 years) |
| Duty time and odometer readings | 2 years (2 – 7 years, statutory minimum) |
| Access log | 1 year (180 days – 3 years) |
| Link between a fine and a driver | 1 year (90 days – 2 years) |
| Push notification registration (browser, or the app's registration number) | 180 days without use; in the app also removed as soon as you turn notifications off or sign out |
| A notification not yet delivered, at Google (app) | Until delivered, at most 4 weeks (Firebase Cloud Messaging default) |
| The app's registration number, at Google | Until it is revoked; Google then deletes it from its systems within 180 days |
| Translation memory (messages and instructions translated before, so the same sentence is not translated again) | 180 days after last use |
| Documents on a trip: uploaded consignment notes (CMR) and photos | 7 years (legal requirement; carrier may set 1 – 7 years) |
| Signed proof of delivery or loading note (name, signature, time, place) | As long as the trip exists, not deleted because of age |
| Vehicle checks and defect photos | As long as the carrier's account exists, not deleted because of age |
| Your own account (name, email address, phone number, sign-in) | Until you ask for deletion yourself: then 30 days after your request, or sooner if your employer carries it out (see §7) |
| Temporary key for location with the screen locked (app) | Until the end of your shift, at most 24 hours |
| Location points not yet sent, on your phone | Until they are sent, at most 6 hours |
| Error reports from the app and the website, in our database | 30 days |
| Billing records | At least 7 years (tax retention requirement); not deleted automatically after that |
When the contract ends. A carrier's account is not deleted automatically when the contract ends. That is deliberate: otherwise a failed payment could wipe a customer's whole file without anyone asking for it. Until something happens, the periods above keep applying. If a departing customer wants everything gone, they email contact@trajenda.com; our support then deletes the company, its trips with what belongs to them, and its users' accounts.
A signed proof of delivery is deliberately left out of the nightly clean-up. It cannot be changed once signed, and its value is that it still exists when a customer raises a delivery months or years later. It therefore stays as long as the trip exists, and a trip with a proof of delivery is not cleared from the bin automatically either. If a proof of delivery has to go, our support deletes the trip at the carrier's request, one trip at a time and with an entry in the log.
For a traffic fine, only the LINK to the driver expires. The fine itself stays as a cost against the vehicle — that is administration. The link is information about how an employee performs, and that should not become a file kept for years. The 90-day floor exists so an objection period and a payroll cycle fit inside it.
Thirty days for location is a deliberate choice: long enough to settle a dispute about a delivery, short enough to explain to a works council. No screen in the app looks back further than thirty days, so keeping it longer serves no purpose.
4. Who we share with
We never sell data. We use these processors:
| Party | For | Location |
|---|---|---|
| Supabase | Database, authentication, document storage | EU (Sweden, Stockholm) |
| Vercel | Application hosting | EU (Sweden, Stockholm) |
| Resend | Sending email | EU |
| DeepL | Translating instructions and messages | EU |
| Stripe | Payments and billing | Not yet established |
| OpenAI | Transcribing voice messages (switched off today) | United States |
| Google (Firebase Cloud Messaging) | Delivering notifications in the Android app | Worldwide, including the United States |
Google processes Firebase data on its global infrastructure, including in the United States. That transfer is based on the EU-U.S. Data Privacy Framework, in which Google participates, and otherwise on the European Commission's Standard Contractual Clauses included in Firebase's data processing terms. Google acts as our processor. What Google sees is described in §1a, under "Notifications in the app". As long as you do not turn on notifications, the app does not request a registration number from Google and no notification goes through Google.
Processing by OpenAI would be a third-country transfer under the European Commission's Standard Contractual Clauses, if that feature is ever switched on — it is off today. If a customer requires all processing to stay in the EU, we can switch to an EU alternative — tell us.
A current list is at trajenda.com/en/subverwerkers. Customers are informed in advance of a new processor and may object.
5. What a public tracking link does and does not show
A planner can share a per-trip link with the shipper. Anyone holding that link sees: the stops, the town, the agreed times, and arrival and departure times.
What the link does not show, and why:
- The driver's location. The driver consented to the employer tracking the location for dispatch. That is not consent to be visible to arbitrary third parties through a link that can be forwarded.
- Street addresses (town only), chat, documents, issue reports, internal notes, the driver's name and phone number, the vehicle, cargo data, and anything about other trips.
A link is per trip, off by default, and revocable at any time. Revocation takes effect immediately.
6. Security
Data belonging to different transport companies is separated at row level in the database (row level security), not only in the application. We test that separation automatically on every change: a dedicated test suite actively tries to reach one company's data from another.
Traffic is over TLS. Documents live in private storage reachable only through short-lived signed links.
7. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability.
If you are a driver: direct your request to your employer. They are responsible; we carry it out for them. You can withdraw location consent yourself, directly in the app.
Deleting your account
You can request deletion of your account yourself, in the app or on trajenda.com: open your profile and tap "Request deletion". The request goes to your employer, who can carry it out straight away. If nothing happens, it is carried out automatically after 30 days. Until then you can withdraw the request. Your name, phone number, email address and sign-in are then erased, and your location points too. Trips, documents, signatures and invoices stay with the company, without your name. More on trajenda.com/account-verwijderen.
If you are a customer: email contact@trajenda.com. We respond within 30 days.
You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Changes
We inform customers in advance of substantive changes. The date at the top of this policy indicates the current version.
Questions: contact@trajenda.com