Customer data protection policy

1. Scope and roles

This policy covers customer data: everything your company, your users, your customers and your drivers enter into or generate in the Transynq service, including the web app, the driver app, WhatsApp for drivers, customer and subcontractor logins, and the API.

You are the controller of your customer data and decide why it is processed. Transynq processes it on your behalf, only to provide the service and only on your instructions as set by your subscription and the settings you choose. Microsoft, as our hosting provider, processes it on our behalf as a sub-processor.

These commitments are set out as contract terms in our Data Processing Agreement, which you can sign with your subscription.

This policy does not cover the public transynq.io website, which is described in its own notices.

2. The data we process

The service holds the data you need to run transport work, and nothing it does not need:

• Operational records: bookings, jobs, legs, consignments, manifests, rate cards, invoices, costs and the documents attached to them.
• People's details: names, phone numbers and email addresses of your users, customers, receivers, drivers and subcontractors.
• Proof of delivery: signatures, photos, times and any notes captured at the stop.
• Location: vehicle position and time only, and only when your company turns tracking on and the driver grants permission on the phone.
• Security records: sign-in attempts with IP address and user agent (never the password), and history of changes to jobs, pricing and permissions.

3. How we use it

We use customer data only to provide, support and secure the Transynq service for you. We do not sell customer data, we do not use it for advertising, and we do not use it to train AI models.

Transynq AI, when your company switches it on, reads curated views of your data to answer your users' questions. It needs an explicit permission, can be switched off per company and keeps no audio.

4. Where your data is stored

Each customer deployment runs in the Microsoft Azure region nearest you, with regions across Australia, the UK, Europe, North America and Asia. Your database, file storage and compute stay in that region, and backups can be kept in-region on request. Microsoft will not store or process customer data outside your chosen geography without your authorisation.

Optional integrations send data to the provider that runs them, which may be outside your region. Each one receives data only when you enable it; they are listed under sub-processors below.

5. How we protect it

Customer data is encrypted in transit with TLS 1.2 or better and at rest with AES-256 for databases, backups and files. Each deployment has its own database, and inside it every query is scoped to your company in code, with automated tests that fail if anything bypasses that scope. Secrets are held in Azure Key Vault and never in source code.

The full set of controls, laid out against the CSA CAIQ domains, is on the security and trust page.

6. Who can access it

Inside your company, access is set by you: six kinds of user, each limited to its own scope, and around 210 permissions checked on every request. You can add Microsoft Entra ID sign-in and set your own idle timeout.

At Transynq, staff access customer data only when it is needed to run, support or secure the service. Operational access uses Azure role-based access control and managed identities, with no shared service passwords.

7. Sub-processors

Microsoft Azure hosts every deployment. The other providers in the table below receive customer data only when you enable the feature that uses them. We update this list before a new sub-processor receives customer data.

8. If there is a breach

If we become aware of a security breach that affects your customer data, we will notify you without undue delay and in any case within 72 hours.

Our notice will say what happened, what data is affected as far as we know, what we have done to contain it and what you may need to do, including any notice you owe to regulators or individuals. We will keep you updated as we learn more and give you the information you need for your own obligations.

9. Retention and deletion

While your subscription is active, your customer data is kept for as long as you keep it in the service. Application logs are kept for 30 days.

When your subscription ends, your customer data stays available for you to export for 30 days. After that it is deleted from the live service, and backups that still contain it age out and are deleted within a further 35 days.

10. Your data, your control

You can export any list to CSV or Excel at any time, and take data out through the API, FTP or SFTP, or your accounting integration.

If one of your users, drivers or customers asks to see, correct or delete their personal data, you can act on most requests directly in the service. Where you need our help, we will assist you in answering the request.

We disclose customer data to a government or law enforcement body only where the law requires it, and we will tell you first unless the law forbids it.

11. Privacy laws

Transynq is built to help you meet your obligations under the privacy laws that apply to you, such as the Australian Privacy Act, Singapore's Personal Data Protection Act and the EU and UK GDPR. Microsoft acts as a data processor under its Data Protection Addendum and GDPR terms.

Transynq itself holds no third-party certification yet. Microsoft Azure's certifications are listed on the security and trust page.

12. Changes and contact

We will update this policy as the service changes and show the new version and effective date at the top of this page.

For questions about this policy or a data protection request, email contact@transynq.io.