Polityka prywatności

Privacy Notice

English original · October 2026

Data protection enquiries: privacy@truckerpoints.ai

I. Information on the processing of your data pursuant to Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR)

1. Scope

This privacy notice applies to our website, to the TruckerPoints app and to the TruckerPoints web app. It is addressed to the drivers participating in the TruckerPoints programme and to the visitors to our website. Below we describe, for each processing activity, which data we process for which purpose, on what legal basis this takes place, who receives the data and how long we store it.

2. Controller and data protection officer

The controller for this website, for the TruckerPoints app and for the TruckerPoints web app is

TruckerPoints GmbH

Genthiner Straße 34, 10785, Berlin, Germany

info@truckerpoints.ai

Contact for data protection enquiries and for exercising your rights as a data subject: privacy@truckerpoints.ai

3. Data processed in order to provide the website and to create the log files

a. Which data is processed for which purpose?

Each time content on the website is accessed, data is temporarily stored which may permit identification. The following data is collected:

  • date and time of access
  • IP address
  • host name of the accessing computer
  • website from which the website was accessed
  • websites accessed via the website
  • page visited on our website
  • message indicating whether the retrieval was successful
  • volume of data transferred
  • information on the browser type and the version used
  • operating system

The temporary storage of the data is necessary for the course of a website visit in order to enable the website to be delivered. Further storage in log files takes place in order to ensure the functionality of the website and the security of the information technology systems. These purposes also constitute our legitimate interest in the data processing.

b. On what legal basis is this data processed?

The data is processed on the basis of Art. 6(1)(f) GDPR.

c. Are there recipients of the personal data other than the controller?

The website is hosted by the hosting provider we use. The hosting provider receives the data referred to above as a processor.

d. How long is the data stored?

The data is erased as soon as it is no longer necessary in order to achieve the purpose for which it was collected. In the case of the provision of the website, this is the case once the respective session has ended. The log files are kept directly and exclusively accessible to administrators for a maximum of 30 days.

4. Registration, user account, acceptance of the terms and conditions and linking to the systems of participating customers and carriers

a. Which data is processed for which purpose?

When you register for the TruckerPoints programme, we process the information you provide upon registration as well as the data arising when you use your user account. This is:

  • your name
  • your email address (mandatory)
  • your Trucker ID and further account and allocation identifiers
  • your log-in and authentication data
  • the information as to which version of the terms and conditions you accepted and when
  • your language setting and further settings of your account
  • the identifier under which you are recorded in the system of the respective participating customer or carrier
  • the status of the link, including links which are still pending or have failed
  • supplementary information on the respective transport order and on the vehicle, insofar as the partner transmits it to us

We process this data in order to set up and administer your user account, to enable you to access the platform, to authenticate you and to be able to evidence which version of the terms and conditions you accepted. In addition, we link your TruckerPoints account to the identifier under which you are recorded in the system of a participating customer or carrier, in order to allocate activities reported from there unambiguously to your account and to avoid incorrect allocations.

Providing your name and your email address is necessary in order for you to be able to participate in the TruckerPoints programme. Without this information we cannot set up a user account for you. All further information is voluntary. If you do not provide it, you will not suffer any disadvantage.

We receive the identifier in the partner system as well as the supplementary information on the transport order and on the vehicle not from you yourself, but from the participating customer or carrier in whose system you are recorded.

b. On what legal basis is this data processed?

The processing is necessary in order to perform the participation agreement which you conclude with us regarding participation in the TruckerPoints programme. The legal basis is Art. 6(1)(b) GDPR. Insofar as we document which version of the terms and conditions you accepted, we additionally process your data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our legitimate interest is to be able to evidence your acceptance and to implement changes to the terms and conditions with legal certainty. The linking to the systems of participating customers and carriers is likewise necessary in order to perform the participation agreement (Art. 6(1)(b) GDPR); without it we cannot credit you with points for activities in partner systems.

c. Are there recipients of the personal data other than the controller?

Your data is processed by the service providers which operate, host and technically maintain the platform for us. These service providers act as processors and are bound by our instructions. Participating customers and carriers do not receive the data referred to in this section. We provide the respective partner only with the feedback as to whether a link exists and whether a reported activity could be processed.

d. How long is the data stored?

We store the data of your user account for as long as your account exists. Following the closure of your account or an erasure request, we erase or anonymise the data within 90 days, unless we are exceptionally required or permitted to retain it for longer. If your account remains inactive for 24 months, we may close it following prior notification. We retain the evidence of which version of the terms and conditions you accepted for the duration of your participation and thereafter until expiry of the statutory limitation periods. We store the link to a partner system for as long as your user account exists and the link is used. Linking operations which could not be completed are erased by us after 18 months.

5. Crediting, administration and redemption of points

a. Which data is processed for which purpose?

In the context of the points programme, that is to say when crediting points for activities, when maintaining your points account and when redeeming points, we process:

  • the type of activity, such as uploading a proof of delivery, completing a transport or rating a loading or unloading facility
  • the time of the activity
  • your Trucker ID and the identifier of the associated transport order
  • a unique identifier of the transaction, so that the same transaction is not counted more than once
  • the number of points credited
  • information which you enter yourself, such as ratings, free text or notes on parking areas and loading or unloading facilities
  • your current points balance as well as the points credited, corrected, reversed, redeemed and expired
  • the number of points relevant for a tier level as well as your current tier level
  • the reward selected by you, the voucher or redemption code issued, the status of the processing as well as the communication in connection with the redemption
  • as soon as we offer physical rewards, the delivery address which you provide to us

We process this data in order to check whether an activity is eligible for points, to calculate the points and credit them to your account, to display your points balance to you and to document the credit in a comprehensible manner. In addition, we process it in order to maintain your points account, to determine your tier level, to implement the expiry of points, to carry out your redemptions, to provide you with the reward and to handle queries regarding the redemption.

Your tier level results solely from the number of points which you have collected within the relevant period. We display in the app how the tier level is calculated, what benefits it entails and how you can lose it again. In doing so we assess neither your personality nor your work performance. We do not take any decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

b. On what legal basis is this data processed?

The processing is necessary in order to perform the participation agreement; the crediting of points is the principal service of the programme. The legal basis is Art. 6(1)(b) GDPR. Insofar as we are required to record redemption transactions in order to comply with tax and commercial law obligations, the processing is additionally based on Art. 6(1)(c) GDPR.

c. Are there recipients of the personal data other than the controller?

Your data is processed by our processors, in particular by the service providers which host the platform and technically operate the points system. The partner from whose system an activity was reported does not receive any feedback from us as to how many points were credited to you in the individual case. Your tier level and your points balance are transmitted neither to participating customers nor to your employer or carrier. We do not maintain any leaderboard in which you are compared with other users. As matters currently stand, reward partners do not receive any data about you: we purchase the vouchers in advance and merely provide you with the redemption code. As soon as we offer physical rewards, we will have to transmit your name and your delivery address to the respective shipping service provider.

d. How long is the data stored?

We store the evidence of points credited and redeemed for 36 months. If the statutory limitation period runs longer, we store it until that period expires. Other usage data of the platform is erased or anonymised by us after 24 months. We store the data of your points account for the duration of your participation. Insofar as commercial or tax law retention obligations exist or claims are asserted, we store the data concerned, in particular documents relating to invoicing and redemption, until expiry of the respective periods (Sec. 257 German Commercial Code, Sec. 147 German Fiscal Code: six and ten years respectively for accounting vouchers).

6. Activation of GPS and transmission of location and ETA data to participating customers

a. Which data is processed for which purpose?

If you activate location sharing in the app, we process the location data of your device, that is to say the geographical coordinates, the time stamp and, where applicable, the accuracy of the positioning, as well as information derived from this such as an estimated time of arrival.

We transmit this data exclusively to the customer which is expressly named in the description of the respective activity. Before you activate location sharing, we display to you which customer the data is transmitted to.

Location sharing is voluntary. You can end it at any time via the settings of the app or of your device. If you do not activate location sharing, you will not receive any points for this activity; your participation in the programme in all other respects remains unaffected.

We do not use this data in order to assess your work performance, to supervise you or to provide your employer or carrier with an assessment.

b. On what legal basis is this data processed?

The processing is based on your consent pursuant to Art. 6(1)(a) and (f) GDPR, which you give by activating location sharing for the respective activity described. You can withdraw your consent at any time with effect for the future. Insofar as we process the respective personal data on the base of Art. 6(1)(f) GDPR, our legitimate interest is to ensure the correct crediting of points, to protect the programme and its participants against misuse, and to safeguard the fairness and integrity of the points programme.

c. Are there recipients of the personal data other than the controller?

The recipient is the customer named in the description of the respective activity. In all other respects, your data is processed by our processors.

d. How long is the data stored?

We store location and ETA data only for as long as is necessary for the crediting of the points and the transmission to the respective customer, at the longest 30 days. Thereafter we erase or anonymise it.

7. Analyses and reports for participating customers

a. Which data is processed for which purpose?

We prepare regular analyses for participating customers on how the programme is used. For this purpose we evaluate:

  • the number of active users
  • the number of completed activities
  • the number of points issued, redeemed and expired
  • ratings of loading and unloading facilities as well as aggregated feedback
  • invoicing-relevant usage data

The analyses are aggregated or pseudonymised. They contain neither your name nor your private contact details, no location, ETA or route data and no assessment of you personally or of your work performance. If an analysis relates to fewer than ten drivers, we aggregate the data further or omit it so that no conclusions can be drawn about individual persons.

Our customers are contractually prohibited from using the analyses in order to identify individual drivers, to monitor their work performance or to prepare employment-law measures.

b. On what legal basis is this data processed?

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest and the legitimate interest of our customers consist in measuring the success of the programme, developing it further and invoicing the agreed remuneration in a comprehensible manner. You may object to this processing on grounds relating to your particular situation; further information on this can be found below.

c. Are there recipients of the personal data other than the controller?

The recipients are the participating customers for which the respective analysis is prepared, as well as our processors.

d. How long is the data stored?

We store the analyses for 36 months. Analyses which no longer have any personal reference may be retained and used by us beyond that period.

8. Fraud prevention, detection of misuse and security of the platform

a. Which data is processed for which purpose?

In order to protect the platform against misuse and to ensure the security of our systems, we process:

  • your IP address as well as device, browser and session information
  • log files and records of access to your account
  • indications of duplicate accounts, of unusual patterns in the collection of points or of technical manipulation
  • the results of our investigations, including points provisionally withheld or reversed

We process this data in order to prevent and investigate misuse and fraud, to ensure the security and availability of the platform and to ensure fairness towards all participants. An investigation generally takes no longer than 30 days.

b. On what legal basis is this data processed?

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to protect the platform and the participants against misuse and to ensure the security of our systems; Recital 47 GDPR expressly mentions the prevention of fraud. You may object to this processing on grounds relating to your particular situation.

c. Are there recipients of the personal data other than the controller?

Your data is processed by our processors. Insofar as this is necessary for the establishment, exercise or defence of legal claims, we may transmit data to legal advisers, courts or public authorities.

d. How long is the data stored?

We store security logs for 12 months. If data is the subject of an ongoing investigation, a security incident or a legal dispute, we store it until its conclusion.

9. Support and communication with you

a. Which data is processed for which purpose?

If you contact us with a question, a complaint or a request, we process your contact details, the content of your enquiry and the further course of its handling. This also applies if you exercise your rights as a data subject.

In addition, we send you messages which are necessary in order to operate the programme, such as notices of points which are about to expire, of changes to the terms and conditions or of the forthcoming closure of an inactive account.

b. On what legal basis is this data processed?

Insofar as we send you messages which are necessary in order to operate the programme, the processing is based on Art. 6(1)(b) GDPR. We base the handling of your enquiries on our legitimate interest pursuant to Art. 6(1)(f) GDPR in dealing with your requests appropriately and in a comprehensible manner. Insofar as you exercise your rights as a data subject, we are legally obliged to handle your request. The legal basis in this respect is Art. 6(1)(c) GDPR in conjunction with Art. 12 et seq. GDPR.

c. Are there recipients of the personal data other than the controller?

Your data is processed by the service providers which provide our support and communication systems. These service providers act as processors.

d. How long is the data stored?

We store support cases for 18 months. We document the handling of data subject requests until expiry of the statutory limitation and evidence periods.

10. Transfers of personal data to third countries

Some of the processors and other kind of third parties we engage are located outside the European Economic Area (EEA) and/or may process personal data there, for example in the United States. Where we transfer personal data to a recipient in a country for which the European Commission has not adopted an adequacy decision pursuant to Art. 45 GDPR, we ensure an appropriate level of protection through suitable safeguards pursuant to Art. 46 GDPR, in particular through the Standard Contractual Clauses adopted by the European Commission, where necessary supplemented by additional technical, contractual and organisational measures. You can request further information on the safeguards applied, including a copy of the relevant documentation, using the contact details given above.

11. Cookies and comparable technologies

a. Which data is processed for which purpose?

Technologies by means of which information is stored on or read from your device, such as cookies, may be used on our website and in our app. We use technically necessary technologies so that the website and the app function and are secure. Technologies which are not technically necessary, for example for the measurement of reach, are used by us only if you have consented beforehand.

As matters currently stand, we use exclusively technically necessary technologies in the first version of the platform.

b. On what legal basis is this data processed?

For technically necessary technologies, the storage of and access to information is permissible pursuant to Sec. 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) without your consent. The subsequent processing of the data is based on Art. 6(1)(f) GDPR. For all other technologies we obtain your consent pursuant to Sec. 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

c. Are there recipients of the personal data other than the controller?

Your data is processed by our processors. If we use third-party technologies in future, we will name the respective providers at this point.

d. How long is the data stored?

We will inform you of the storage period of the technologies used in the consent dialogue as soon as technologies requiring consent are used.

12. Rights of data subjects

You can exercise your rights at any time and free of charge by writing to privacy@truckerpoints.ai or to the postal address given above. Where we have reasonable doubts as to your identity, we may ask you for additional information necessary to confirm it.

a. Right of access

You may request access pursuant to Art. 15 GDPR to your personal data which we process.

b. Right to object

You have a right to object on particular grounds (see under point II).

c. Right to rectification

Should the information concerning you no longer be accurate, you may request rectification pursuant to Art. 16 GDPR. Should your data be incomplete, you may request its completion.

d. Right to erasure

You may request the erasure of your personal data pursuant to Art. 17 GDPR.

e. Right to restriction of processing

You have the right pursuant to Art. 18 GDPR to request a restriction of the processing of your personal data.

f. Right to lodge a complaint

If you are of the opinion that the processing of your personal data infringes data protection law, you have the right pursuant to Art. 77(1) GDPR to lodge a complaint with a data protection supervisory authority of your choice. This includes the data protection supervisory authority competent for the controller: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), https://www.datenschutz-berlin.de/buergerinnen-und-buerger/beschwerde/einreichen-einer-beschwerde/.

g. Right to data portability

In the event that the requirements of Art. 20(1) GDPR are met, you have the right to have data which we process by automated means on the basis of your consent or in performance of a contract handed over to you or to third parties. The collection of the data for the provision of the website and the storage of the log files are strictly necessary for the operation of the website. They are therefore not based on consent pursuant to Art. 6(1)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, but are justified pursuant to Art. 6(1)(f) GDPR. The requirements of Art. 20(1) GDPR are therefore not met in this respect.

h. Right to withdraw consent

Insofar as we process your data on the basis of your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected. Withdrawal is just as easy as giving consent.

II. Right to object pursuant to Art. 21(1) GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is carried out on the basis of Art. 6(1)(f) GDPR. The controller will then no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or unless the processing serves the establishment, exercise or defence of legal claims. The collection of the data for the provision of the website and the storage of the log files are strictly necessary for the operation of the website. You may also exercise this right in relation to the other processing activities which we base above on Art. 6(1)(f) GDPR, in particular in relation to the analyses for participating customers and in relation to fraud prevention and the safeguarding of the security of our platform. You can object by writing to privacy@truckerpoints.ai.

III. Changes to this privacy notice

We adapt this privacy notice if the processing activities described or the legal framework change. The version applicable at any given time is available in the app and on our website. We will additionally inform you of material changes in the app or by email. The privacy notice is not a contract; your consent is therefore not required for a change.

Version of this privacy notice: October 2026.