Who is responsible for what
Your recipients’ names, addresses and phone numbers are your data — you are the controller. We process them only to run the service, on your instructions, as processor (article 28 GDPR). This is set out in writing in the Data Processing Agreement, which is concluded when the Order Form is confirmed.
Where the data is
- Servers in Germany (Hetzner), in a separate installation and database for each customer.
- Backups every hour (database) and every night (database and photos), in Germany and, encrypted, in Finland — both within the EU.
- Only the following leaves the EU: the device’s IP address for map tiles and the text of addresses for geocoding (OpenStreetMap Foundation, United Kingdom, adequacy decision), and, if you use Google address search, the text being typed (Google, possibly USA under the Data Privacy Framework). We can disable Google search for you.
- On the “Fleet” plan, PRODEL can be installed on your own server — then delivery data is stored exclusively there. External map, address-search and navigation services are still used, unless agreed otherwise.
Driver location
This is what everyone asks about, and rightly so. PRODEL:
- sends position only while a route is in progress (started by the driver, or by the dispatcher on their behalf) and not during a break;
- sends only when the app is open in the foreground — never from the background;
- keeps only the latest position — no movement history, no speeds;
- deletes even the latest position when the route is finished;
- shows an indicator on the driver’s screen, so they always know whether their position is being sent.
As employer, you must inform your drivers in writing about this feature before their first route, and consider whether an impact assessment is needed. We provide a ready-made notice, in Greek and English, on the Driver notice page, for your personnel file.
What we do not do
- We do not sell, rent or analyse your data for our own purposes.
- We put no tracking or advertising tools in the app or on the website.
- We give nobody access to your database without your instruction, unless the law requires it.
Data-subject rights
If a recipient or driver asks you for access, correction or erasure, the app lets you handle it yourself: editing a stop’s details, deleting a route (together with its stops and photos), deleting a driver account. Where more is needed — e.g. an export of everything concerning one person — we help within 5 working days.
Data breaches
If we discover an incident concerning your data, we inform you without undue delay and at the latest within 48 hours of establishing it, with everything you need for your own notification to the authority. For the data for which we are the controller (website, contact form), we notify any breach to the Commissioner within 72 hours (article 33) and, where required, to the persons themselves (article 34).
Contact for data matters
Three Button Trading Ltd, reg. no. HE 426226, 4 Makedonias Street, Troulloi, 7505 Larnaca, Cyprus, email andreas@3buttontrading.com, +357 99 606664 — andreas@3buttontrading.com