Your data and GDPR
Last updated: 24 September 2026
This page explains in plain language what happens to personal data in TIR40 and how to use your rights under the GDPR (the EU General Data Protection Regulation). It is a summary: the binding texts are the Privacy Policy and the Data Processing Agreement, linked at the top of this page.
1. Who is responsible for what
- The haulier (the company that uses TIR40) is the controller of the data about its own drivers, customers and loads. It decides what is entered and how long it is kept.
- Company name SRL, the company behind TIR40, is the haulier's processor: we host the data and handle it only on the haulier's instructions.
- For the people who sign in to TIR40 and for visitors to our pages, we are the controller (see the Privacy Policy).
So if you are a driver or a contact at a customer, start with the haulier you work with. We help them answer you.
2. What TIR40 holds about people
| Whose data | What | How it gets there |
|---|---|---|
| Users (dispatchers, managers, admins) | Name, email address, role, language. The password is kept only as a hash by our sign-in provider. | Entered when the account is created. |
| Drivers | Name, phone number, language, licence and certificate dates, working-time records (start of day, weekly rest), per-diem figures, the position sent when the driver taps “Arrived” or chooses to share their location, problem reports they send from their link (what is wrong and an optional short note), and photos of documents such as a signed CMR. | Entered by the haulier's staff, or sent by the driver from their own link. |
| Contacts at customers | Company name, contact person's name, email, phone, VAT and billing details. | Entered by the haulier's staff, or read from an order the haulier uploaded. |
| Anyone named in a document | Names and addresses on transport orders, pasted order emails and CMR photos. | Uploaded by the haulier's staff or the driver. |
There is no continuous tracking of drivers: a position is stored only when the driver taps “Arrived” or chooses to share it. The driver's page never shows the price or the original order.
3. Where the data is and who else handles it
Workspace data is stored in the EU (Ireland). We use a small number of service providers — for the database and storage, hosting, AI features, sending email, and map search. The full list, with what each one does and where, is in the Privacy Policy.
The AI features send data to Anthropic (United States) only in these cases: when someone reads an order PDF or a pasted email into a load, when someone asks for a delay or demurrage email draft, when a signed CMR photo is uploaded (it is checked automatically for a signature, a stamp and remarks), and when a driver opens their link and the dispatcher's notes are translated into the driver's language. Anthropic's commercial terms state that data sent through its API is not used to train its models. We do not sell personal data and do not use it for advertising.
4. Your rights
- Access: ask for a copy of the personal data held about you.
- Correction: ask for wrong data to be fixed.
- Deletion: ask for your data to be deleted, unless the law requires it to be kept (for example accounting records).
- Restriction and objection: ask us to pause processing, or object to processing that rests on a legitimate interest.
- Portability: receive your data in a common format. A company administrator can download all of the company's data as a zip of CSV files from Settings → Export all data.
- Withdraw consent, where processing is based on consent.
You can also complain to a data-protection authority — in Romania the ANSPDCP (dataprotection.ro), or the authority in the country where you live or work.
5. How to make a request
- Drivers and customer contacts: ask the haulier first. If that does not resolve it, or you cannot tell which haulier holds your data, write to us and we will pass it on or answer.
- Users of TIR40 and visitors to our pages: write to privacy@tir40.eu.
We answer within one month, as the GDPR requires. We may ask you to confirm who you are before we share or change anything.
6. What a company administrator can do themselves
- Download all of the company's data (Settings → Export all data).
- Delete loads and documents they no longer need, and permanently delete retired trucks, trailers and drivers.
- Ask us to close the account; the data is then deleted as set out in the Data Processing Agreement.
7. Security in short
Each company's data is separated from every other company's at database level, connections are encrypted, uploaded files sit in private storage that only the signed-in app can open, driver links contain a long random code, and changes to loads are recorded in an audit log. If a breach affects your data we will tell you as the law requires.
8. Contact
Company name SRL, registration number registration number (CUI / J-number), registered address, Romania. Privacy questions and requests: privacy@tir40.eu.