Privacy Policy – atWork Driver

The Data Controller responsible for your personal data is:

atWorkAI – Corporate Welfare Shpk

Durana Tech Park, Rruga Aleksandër Moisiu, Albania

VAT / NIPT: M25201057K

Email: [email protected]

Data Protection Officer: [email protected]

This Privacy Policy applies to atWork Driver (the “App”), intended for couriers who deliver corporate meal orders on the atWork platform.

The App is used to sign in as a courier, go online and offline for work, receive and manage assigned delivery routes and order groups, update delivery statuses, view earnings and shifts, and share location while working.

The App is not intended for, and is not made available to, the general public. Access requires a courier account issued by atWork.

The App collects precise location data from your device, including while the App is in the background and while the screen is locked. This is the central function of the App, so we describe it in full below.

When we collect it: location collection begins only when you set your status to ONLINE in the App. It stops immediately and completely when you go OFFLINE, when you sign out, and when your account is deleted. We do not collect your location while you are offline or signed out.

What we record: latitude and longitude, positional accuracy, altitude, speed, direction of travel, whether the device is moving, your device battery level, and the time of the reading.

How often we record it: while you are online, the App checks your position approximately every three seconds and records a point when you have moved at least 100 metres or at least 10 seconds have passed since the last recorded point, whichever happens first.

Background collection: while you are online, collection continues when the App is in the background or the screen is off, because a delivery must be traceable while you are driving with the phone put away. On iOS, the system displays a blue indicator in the status bar for the entire time background collection is active. On Android, a permanent notification is displayed for the same reason.

Why we collect it: to assign you the delivery nearest to you, to allow the dispatch team and the receiving customer to follow the progress of an order in real time, to estimate arrival times, to assist you if a problem occurs during a delivery, to investigate delivery incidents, and to resolve disputes about whether and when a delivery took place.

Your control: location permission is granted by you in your operating system and can be withdrawn at any time in your device settings. Withdrawing it stops all collection. While it is withdrawn you will not be able to go online or receive deliveries, because the service cannot be operated without it.

In addition to location data, we collect and process:

• Account and identification data: name, surname, username, phone number, email address, courier identifier, and authentication tokens.

• Work and operational data: assigned routes and order groups, delivery statuses and their timestamps, pickup and drop-off addresses, shifts, ratings and reviews where applicable, and earnings records.

• Device and technical data: device model, operating system version, app version, platform, push notification registration token, network status, diagnostic and crash information, and security-related logs.

• Support communications: messages, calls, and feedback you send to our support team.

We do not intentionally collect special category (sensitive) personal data through the App.

We process your data on the following bases:

• Performance of a contract – operating your courier account and enabling you to receive, carry out and be paid for deliveries. Location processing while you are online falls under this basis: the service cannot be provided without it.

• Legitimate interests – platform reliability and security, fraud prevention, incident investigation, and service improvement.

• Legal obligations – compliance with applicable Albanian and EU law, including accounting and tax requirements.

• Consent – where you grant location and notification permissions at the operating system level, and for any optional communications. You may withdraw these permissions at any time.

Your personal data may be used to:

• Create, authenticate and manage your courier account.

• Match you with nearby deliveries and assign routes and order groups.

• Show delivery progress to the dispatch team and to the customer receiving the order.

• Calculate estimated arrival times and optimise delivery routing.

• Send you operational push notifications about assignments and order updates.

• Calculate and display your earnings and shift records.

• Provide support, investigate incidents, and resolve disputes about deliveries.

• Maintain the security, reliability and integrity of the platform, and prevent fraud.

We share data only where necessary, with:

• The customer receiving an order and the corporate client they belong to – limited to your first name and your live delivery progress for that order, for the duration of that order.

• Partner merchants preparing an order – limited to what is needed to coordinate pickup.

• Technology providers acting as processors – hosting and infrastructure, push notification delivery (Google Firebase Cloud Messaging), and error diagnostics.

• Authorities or third parties – where required by law, regulation, legal process or a government request, or where necessary to establish, exercise or defend legal claims.

All processors operate under GDPR-compliant Data Processing Agreements (DPA).

We never sell personal data.

We do not use your data for advertising, we do not share it with advertising networks or data brokers, and we do not track you across apps or websites owned by other companies.

Your data is stored securely within the EU or in locations approved under GDPR. Data is transmitted over encrypted connections (HTTPS/TLS).

Location points are held briefly on your own device in an encrypted queue when the network is unavailable, and are removed from the device as soon as they are delivered to our servers or when tracking stops.

Retention periods:

• Account data: kept while your courier account is active, and for a limited period afterwards where needed for security, dispute resolution and legal compliance.

• Location and delivery records: retained for the period required to operate the service, settle payments, investigate incidents and satisfy accounting and tax obligations (typically up to 6 years where applicable).

• Technical and security logs: retained for a limited period necessary for troubleshooting and security.

You have the right to:

• Access the personal data we hold about you.

• Request correction of inaccurate data.

• Request erasure of your data.

• Withdraw consent at any time, including location and notification permissions in your device settings.

• Restrict or object to processing.

• Request portability of your data.

• Lodge a complaint with your local Data Protection Authority.

To exercise any of these rights, contact [email protected] or [email protected]. We respond within the time limits set by GDPR.

You can request deletion of your courier account from inside the App. Open the Account tab, choose “Delete account”, and confirm.

You can also request deletion at any time by writing to [email protected] or [email protected] from the address registered to your account.

When your account is deleted, location collection stops immediately, your access to the App ends, and your personal data is deleted or irreversibly anonymised — except for records we are required by law to retain, such as delivery and payment records kept for accounting and tax purposes, which are retained for the statutory period and then deleted.

The App does not contain advertising and does not display ads.

The App does not use the device advertising identifier (IDFA/AAID), does not track you across other companies’ apps or websites, and does not ask for App Tracking Transparency permission, because no such tracking takes place.

We use diagnostic and crash information solely to keep the App working correctly.

We apply industry-standard security measures, including encryption in transit, encrypted storage of credentials in the device keychain or keystore, access control on the least-privilege principle, and audit logging.

Authentication tokens are stored in the secure storage provided by the operating system and are removed when you sign out.

The App is intended solely for adult couriers working with atWork and is not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this policy from time to time. The current version is always available at this address, and material changes affecting how we use your location data will be communicated to you in the App before they take effect.