Privacy policy
Last updated:
This policy explains how SOFTGENIO, S.L. processes personal data on the Dropium platform: on the website, in the control centre and in the field mobile applications. It is written to be readable in full without signing in.
1. Two distinct roles, depending on whose data it is
This comes first because it determines who each person should contact to exercise their rights.
- For drivers, warehouse operators and platform users, SOFTGENIO is the data controller.
- It decides what their data is used for and answers to them directly. The rest of this policy is addressed to these people.
- For the recipients of shipments, SOFTGENIO is a data processor (Article 28 GDPR).
- It processes their data solely on behalf of, and following the instructions of, the company that commissioned the shipment — which is the controller and already informed them at the time of purchase.
If you are the recipient of a shipment and wish to exercise your rights, you must contact the company that sold you the product or commissioned the transport. If you write to us, we will redirect you to them and inform them.
2. Data controller
- Legal name
- SOFTGENIO, S.L.
- CIF
- B21778881
- Registered office
- Calle Milán 2, 28850 Torrejón de Ardoz, Madrid, Spain
- Telephone
- +34 627 60 33 36
- Exercising your rights
- info@softgenio.tech
- Data protection contact
- dpo@softgenio.tech
3. What we process, why, on what legal basis and for how long
Each processing activity with its specific legal basis and retention period, as required by Articles 13(1)(c) and 13(2)(a) GDPR.
| Data subject | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Driver / operator | Name, email, identifier, password, permissions | Account and authentication | Performance of a contract | For the duration of the relationship, plus applicable limitation periods |
| Driver / operator | Latitude and longitude when each event is recorded | Traceability of goods | Legitimate interest (Art. 6(1)(f)) | 12 months by default, or the period set by the logistics operator they work for; in France, 60 days, in line with the CNIL reference framework |
| Driver / operator | IP address, installation identifier, notification token, approximate location at sign-in | Access security and traceability | Legitimate interest (Art. 6(1)(f)) | 6 months |
| Driver / operator | Crash and diagnostic reports | Fixing application errors | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Driver / operator | Aggregated usage statistics | Improving the application | Consent, revocable at any time | 2 months |
| Driver / operator | Messages in the chat of each task (parcel, incident, route or stop) with the control tower: text, photos and voice notes, author and read status. They may show or name the recipient or their address | Coordinating the task and serving as evidence in the event of a claim | Legitimate interest (Art. 6(1)(f)) | 6 months from each message |
| Shipment recipient | Name, address, phone, signature, delivery photo, cash-on-delivery amount | Carrying out and evidencing the delivery | On behalf of the shipper — SOFTGENIO acts as processor | As instructed by the controlling shipper |
| Anyone visiting this website | Page visited, referrer, country, browser and load times, with no cookies and no visitor identifier | Measuring audience in aggregate | Legitimate interest (Art. 6(1)(f)) | Only aggregated figures are consulted; Cloudflare’s retention period, as set out in its policy |
| Anyone booking a demo | Name, email and whatever you tell us about your company and your role | Arranging and holding the demo | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) | 1 year from the last communication, unless a contractual relationship begins |
| Anyone contacting us | Name, email or phone and the content of the message | Replying to your enquiry | Legitimate interest (Art. 6(1)(f)) | 1 year from the last communication |
Task messaging. Each task — a parcel, an incident, a route or a stop — has its own chat between the driver and the operator’s control tower. Only the people involved in that task can read it, and the name of whoever writes appears on every message. Photos and voice notes are stored on Amazon Web Services (S3). The notification announcing a new message does not include its content. Messages are deleted after 6 months, or earlier if the data of the order the chat belongs to is erased. If the author asks for their messages to be erased, they are emptied: the text, the author and the attachments are deleted, and only a record that a message existed remains, so that the conversation of the others is not left incomplete.
Worker consent is not used as the legal basis for geolocation or traceability: in an employment relationship it is not considered freely given, because saying no means saying no to the person who pays you. In exchange, the right to object is effective and immediate, as set out in the next section.
4. Geolocation of drivers and operators
What the device does: when an event is recorded — a delivery, a pickup, an incident, a scan — the approximate latitude and longitude at that moment may be stored, in order to know where the movement took place.
What it does NOT do — these are limits, not nuances:
- Position is read only when an event is recorded. There is no continuous tracking, none in the background and none with the app closed.
- It is not used to assess an individual driver’s performance.
- It is not used to monitor break times or to verify compliance with working hours.
- It is not consulted outside working time.
- Accuracy is moderate: it tells one warehouse from another, not a position inside one.
How to object: from “Profile > Privacy” in the application, at any time and without having to give a reason. Records keep working normally, they are simply stored without location. The last position held on the device is erased when it is switched off.
Location points are kept for 12 months by default, or for the period set by the logistics operator they work for, which may be shorter or longer; in France, 60 days, in line with the CNIL reference framework. They are only kept longer if they are evidence in ongoing litigation.
In France this arrangement is additionally subject to prior consultation of the works council (Art. L2312-38 of the Labour Code) and prior individual information of the worker (Art. L1222-4). That obligation falls on the employer deploying the application.
5. Recipients and processors
We do not sell personal data, we do not disclose it for advertising purposes and no advertising networks are involved: the applications contain no advertising and no advertising identifier. The following providers process data on our behalf, as processors within the meaning of Article 28 GDPR:
- Google Ireland Ltd. / Google LLC
- Push notifications (Firebase Cloud Messaging), crash reports (Crashlytics) and usage statistics (Analytics) in the mobile applications, and the Google Calendar appointment page used to book a demo from this website.
- Amazon Web Services
- Storage of the photos and voice notes of task messaging (S3).
- CARTO
- Map tiles. Receives the device IP address when the map loads.
- Amazon Web Services EMEA SARL
- Server and database infrastructure. Region: Ireland (European Union).
- Cloudflare, Inc.
- Hosting and content delivery for this website, and cookie-free audience measurement (Cloudflare Web Analytics). Processes the IP address of visitors in order to serve pages.
- Apple Inc. / Google Ireland Ltd.
- Distribution of the mobile applications in their stores.
- Authorised staff of the logistics operator
- Coordinators and managers of the company that grants you access to the platform, within their permissions.
6. International transfers
Firebase services and the Google Calendar appointment page involve processing by Google LLC in the United States. Hosting and audience measurement for this website are provided by Cloudflare, Inc., also a US entity.
These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it and, alternatively, on the standard contractual clauses approved by the European Commission.
The server infrastructure and the operational database remain in the European Union.
7. Security
- Communications with the server are encrypted over HTTPS.
- Session identifiers are stored encrypted in the operating system’s secure store, never in plain text.
- Access is restricted by permission profiles and protected with two-factor authentication.
- Local device data is erased on sign-out or when another operator signs in, which allows devices to be shared across shifts without carrying over information from the previous one.
8. Your rights
You may exercise the rights of access, rectification, erasure, restriction of processing, objection and portability.
To exercise them, write to info@softgenio.tech. We will respond within one month of receiving the request.
You may also lodge a complaint with the supervisory authority of your country of residence:
- Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
- France: Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr
9. This website
Processing on this website is different from, and far more limited than, that of the applications. It has no forms of its own and no accounts, and it sets no advertising cookies. It measures its audience with Cloudflare Web Analytics, which uses neither cookies nor your browser’s storage and only provides aggregated figures. To book a demo, the contact page embeds Google’s appointment calendar, which only loads when you click “See available times”; the details you enter when booking are received by Google and reach us as an appointment in our calendar. The detail is in the cookie policy.
10. Changes to this policy
Any substantial change to processing triggers fresh information: the applications display the privacy notice again when the version of the text changes, before recording any new event.