Privacy Policy — odtah.li Driver mobile app
This policy applies solely to the odtah.li Driver mobile app (Android / iOS). The odtah.li web platform has a separate privacy policy.
Last updated: September 28, 2026
Version: 1.3
Česká verze těchto zásadDeutsche Version
1. Operator
The odtah.li Driver mobile app (the “App”) is operated by:
Assistance Solutions s.r.o.
registered office at Příčná 1892/4, 110 00 Prague 1, Czech Republic
Company ID (IČO): 24941778
registered in the Commercial Register of the Municipal Court in Prague, file no. C 445391
data box: 2j2dnga
contact: dpo@odtah.li
support contact: support@odtah.li
(the “Operator”)
The App is a working tool for roadside-assistance and vehicle-recovery drivers. It acts as a client of the odtah.li platform — it displays assigned jobs, navigation, and lets drivers document an intervention. Personal data of drivers and customers is processed by the Operator as a processor under Article 28 GDPR; the controller is the recovery or assistance company that employs or contracts the driver.
To identify the specific controller of your data, contact your employer or the Operator at dpo@odtah.li — we will tell you which platform client manages your data.
2. Device permissions the App uses
The App requests only the permissions necessary to perform work tasks. Each permission can be revoked at any time in device settings; some features may then be unavailable.
| Permission | Purpose | When active |
|---|---|---|
| Camera | Taking photos of the vehicle, damage, and sign-off protocols as part of documenting an intervention | Only when the driver actively takes a photo |
| Location (GPS) | Determining the intervention site and navigating to the vehicle. For companies that enable driver location tracking, additionally permanently for the duration of a shift (including in the background, with the app closed or the screen locked), so dispatch can see driver positions and assign the nearest driver to a new job. | Only in connection with an active job; for companies with location tracking enabled, permanently in the background for the duration of a driver's shift (an optional feature the company controls; the driver is informed before it's turned on) |
| Notifications (push) | Alerts about newly assigned jobs and status changes | While signed in |
| Photos and media / storage | Saving captured photos and sign-off protocols to the device gallery | Only when the driver captures a photo as part of documenting an intervention |
The App does not use the microphone and does not record audio. The App does not access contacts, call logs, SMS messages, or the calendar on the device.
3. What data the App collects and why
The following table lists every category of data the App collects or processes, together with its purpose. This list corresponds to the Data Safety declaration on Google Play.
| Data type | Specific data | Purpose | Shared with third parties |
|---|---|---|---|
| Personal identifiers | Driver’s name and email address (obtained at sign-in via email + password or via Google account) | Authentication and account management | No |
| Phone number | Driver’s phone number (previously entered into the platform) | Initiating a notification phone call to the driver about a new job | Yes — Twilio (see section 5) |
| Location | Precise GPS coordinates of the driver during an active job; for companies with location tracking enabled, permanently for the duration of a shift (including in the background) | Determining the intervention site, navigation, job documentation; dispatch coordination and nearest-driver assignment | No |
| Photos | Photos of the vehicle, damage, intervention site, and sign-off protocols | Intervention documentation, evidentiary record, basis for invoicing and claims | No |
| Job data | Customer name and contact, licence plate and vehicle details, address and intervention description, signature | Performance of the assigned job | No |
| In-app activity | Records of actions in the App (opening a job, changing status, taking a photo) | App operation, job life-cycle | No |
| Device identifiers | Device identifier (push token) | Delivery of push notifications | Yes — Google (Firebase Cloud Messaging) |
| Security logs | Sign-in records (time, IP address, device type) | Service security and fraud prevention | No |
The App does not collect data for advertising or marketing purposes, does not sell data to third parties, and data is not used for training machine-learning models or for advertising profiling.
4. Purpose and legal basis
We process data to operate the App and to carry out the driver’s work tasks — job assignment, navigation, and intervention documentation.
Legal basis:
- Performance of a contract (Art. 6(1)(b) GDPR) — between the driver and their employer
- Legitimate interest (Art. 6(1)(f) GDPR) — service security, fraud prevention, and detection and fixing of app bugs
- Compliance with legal obligations (Art. 6(1)(c) GDPR) — accounting and tax regulations
Providing this data is a necessary condition for a driver to perform their work through the App; without it, jobs cannot be assigned or documented.
5. Recipients and data location
Personal data is retained and processed within the European Union (EU/EEA). The Operator does not transfer it outside the EU/EEA.
The App shares data with the following third parties, always only to the extent necessary:
- Google LLC (Firebase Cloud Messaging) — receives the device identifier (push token) for notification delivery.
- Twilio Inc. — if the controller uses the phone-notification feature, Twilio receives only the driver’s phone number in order to initiate a notification call. The call reaches the driver as a regular incoming call over the mobile network; the App does not record or process the audio and does not access the microphone.
- SMSbrána s.r.o. — if the controller uses the SMS feature, receives only the driver’s phone number and message text to send the SMS notification.
All communication is encrypted (HTTPS); stored data and data in transit are both encrypted.
6. Retention
- Job data is retained for the duration of the contract between the driver’s employer and the Operator and a further 30 days after its termination (for backup and recovery purposes), then irreversibly deleted.
- Driver account data (email, name) is deleted at the controller’s request or within 90 days of account deactivation.
- Location records (for companies with driver location tracking enabled) that are not linked to a job are deleted after 90 days. Records linked to a job are part of that job’s documentation and are retained for 5 years.
- Security logs are retained for 90 days.
- Anonymised operational statistics (job counts, intervention times) may be retained indefinitely.
- Accounting records are retained for 10 years under Czech Act No. 563/1991 Coll. on Accounting.
After signing out and uninstalling the App, the App does not retain any personal data on the device beyond the sign-in session and cache. Photos the driver saved to the device gallery remain in the gallery until the driver deletes them; job data remains stored on the platform with the relevant controller.
7. Account and data deletion
You can request deletion of your account and associated personal data in the following ways:
- In the App — request account deactivation via account settings.
- By email — send a deletion request to dpo@odtah.li from the email address associated with your account.
- Through your employer — the controller (your recovery or assistance company) may request deletion of your account on your behalf.
After a deletion request, driver account data (name, email) is deleted within 90 days. Job data associated with completed jobs is retained for the period stated in section 6, as it forms part of the controller’s records and may be subject to statutory accounting archiving; after that period it is irreversibly deleted.
Photos saved to your device gallery can be deleted at any time directly in the device gallery.
8. Your rights
As a data subject you have the right to:
- access your data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing (Art. 21 GDPR)
Exercise these rights with the relevant controller (your recovery or assistance company). The Operator will provide the necessary cooperation. If you do not know which controller processes your data, contact us at dpo@odtah.li — we will tell you the relevant organisation.
You also have the right to lodge a complaint with the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.
9. Children
The App is a professional work tool intended solely for adult drivers of recovery and assistance companies. It is not intended for children or persons under 18 years of age. We do not knowingly collect personal data from children.
Version 1.3, effective from September 28, 2026.