1. Who is responsible
For the website and the contact form, the controller is Three Button Trading Ltd, reg. no. HE 426226, 4 Makedonias Street, Troulloi, 7505 Larnaca, Cyprus, email andreas@3buttontrading.com, +357 99 606664. We have not appointed a Data Protection Officer, as the conditions of article 37 GDPR are not met; the company’s management handles all data-protection matters at the same email address.
For data inside the application (recipient, driver and route details), the controller is the business customer using PRODEL. We act as processor under the Data Processing Agreement. If you are a recipient or a driver with a question about your data, contact first the business that serves or employs you; we will help it answer. If we receive your request directly, we forward it to that business within 3 working days.
2. What data, why, for how long
a. Website visitors
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address, browser type, pages opened, time (server log files) | Security, abuse prevention, error diagnosis | Legitimate interest (article 6(1)(f)) | 90 days, rotated daily (up to one extra day until the next rotation), plus up to 7 days in server backup images. The server does not produce visitor statistics from these files. |
| IP address and, where given, email, as attempt and request counters (sign-in, password reset, contact form, opening the delivery tracking page of section e) | Rate limits against automated attacks and abuse | Legitimate interest (article 6(1)(f)) | Up to 24 hours from the last attempt or request; clean-up runs at least every 6 hours |
b. Contact form
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, business, email (required); phone, number of drivers, message (optional) | To contact you about a demo or trial of PRODEL | Steps prior to entering into a contract at your request (article 6(1)(b)) and your consent | 24 months from submission, or earlier if you ask. Database backups may keep an encrypted copy for up to 13 months after deletion. If the database is restored from a backup, deletions are re-applied automatically within 6 hours; only after a total loss of the server might deletions of the last 24 hours need to be repeated by us. |
The notification of a new contact is delivered to our own mailbox, on our own server and over our own private network, without a third-party provider.
c. Application users (dispatchers and drivers)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, phone (optional), password (stored only as a bcrypt hash), role | Sign-in and operation of the account | Performance of the contract with the customer-employer | While the account exists, and 30 days after the subscription ends |
| Position of the driver’s device | Live map for the dispatcher, starting point for re-optimisation, arrival times — including the calculation of the estimated arrival window that the recipient sees on the delivery tracking page (section e); the position itself is never shown to the recipient | The customer’s legitimate interest in coordinating deliveries; the customer must inform its drivers before their first route | Sent only while a route is in progress and not during a break, only with the app open in the foreground. Only the latest known position is stored — no movement history, no speeds — and it is deleted when the route is finished. Positions are not written to log files. |
| Actions in the app: route start and finish times, time of each delivery or failure, breaks and their duration, undos, stops added by the driver, amounts declared as collected | Operation of the service, the business’s history | Performance of a contract | For the duration of the subscription and 30 days after it ends; the customer may delete routes earlier |
| Password-reset token (only as a hash, with creation and use times) | Secure setting of a new password | Legitimate interest (account security) | Valid for one hour and used once; the record is deleted 7 days after it expires or is used |
| IP address in server log files and attempt counters | Security, as in section a | Legitimate interest | As in section a |
d. Delivery recipients (our customer’s customers)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name or company name, address and its coordinates, phone, delivery notes (e.g. access instructions), delivery window, parcel type and count, cash-on-delivery amount and amount declared as collected, proof photo, driver’s note, failure reason, delivery time | Carrying out and documenting the delivery | Determined by our customer as controller | Determined by our customer, who can delete routes in the app; at the latest 30 days after its subscription ends |
Proof photos are stored in a private area on our servers and are visible only to the customer’s dispatchers and to the driver to whom the route is assigned; they are not reachable by a public link. They are deleted when the route is deleted or the delivery is undone, and at the latest 30 days after the subscription ends; backup copies may exist for up to 13 months (section 3). Our customer must not enter door codes or other security details in the notes without need, and photos should show the parcel or the delivery point, not people.
e. Delivery tracking link (recipients)
Our customer may send you a link so that you can see roughly when your delivery will arrive. The page opens without an account or a password. Our customer is the controller for this too: it decides whether, to whom and by what means the link is sent; we provide the page as its processor. If nobody sends you a link, you see and receive nothing.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| What the tracking page shows (listed below), as read from the stop’s details at the moment the page is opened | So that the recipient can see the progress and estimated time of their delivery | Determined by our customer as controller, which decides whether to send a link | Nothing new is stored for the link. The page stops showing any data 48 hours after the stop is closed (completed or not completed), or 3 days after the route’s date if the stop was never closed |
| IP address of whoever opens the page, in server log files and in the request counter | Security, as in section a | Legitimate interest | As in section a |
The page shows only:
- the business name and a contact phone, as our customer entered them in its Settings — both optional, and shown until it changes or clears them;
- the recipient’s name, as our customer typed it for that particular stop;
- the status of the delivery or pickup: scheduled (and for which day), on the way, you are the next stop, the driver has arrived, completed, not completed;
- while the route is running, an estimated arrival window (e.g. 10:25 – 11:00) and how many stops come before yours;
- the agreed delivery window, if one was set;
- the cash-on-delivery amount, if any, while the delivery is pending;
- after delivery, the time it was completed.
It never shows: the driver’s name, the driver’s location or any map, the recipient’s address or phone, delivery notes, proof-of-delivery photos, the reason a delivery was not completed, or any other stop on the route.
How the time is calculated. The arrival window is calculated on our server from the stop order, road travel times and — while the route is running — the last position sent by the driver’s device. This is the same single “latest position” described in section c: sent only while a route is in progress and not during a break, overwritten each time, and deleted when the route is finished. The position is never sent to the recipient; only the resulting time window is, and that window is an estimate.
Who sends the link. Our customer’s staff (a dispatcher or a driver), from their own device, using the device’s SMS, WhatsApp, Viber or share sheet, or by copying the address. PRODEL does not send SMS or chat messages, has no SMS provider, and does not learn whether or to whom a link was sent. The messaging apps and the mobile carrier are chosen and used by our customer independently of us; they are not our sub-processors (section 3).
Validity. The address has the form …/t/[stop id].[signature]. The signature is computed by our server with a secret key (HMAC); the address cannot be guessed or derived from another address, and nothing new is stored in the database for the link. Anyone holding the address can open it until it expires: 48 hours after the stop is closed (completed or not completed), or 3 days after the route’s date if the stop was never closed. After that the page shows no data; it only says that the link is not valid. A single link cannot be revoked earlier, other than by our customer deleting the stop.
On your device. The page sets no cookies and stores nothing on your device (no localStorage), and it has no analytics. It carries a noindex tag and is excluded in robots.txt, so that it does not appear in search engines. While the delivery is pending it refreshes itself every 60 seconds. Requests to the page are rate-limited per IP address, using the same counter that limits sign-in attempts and contact-form submissions (section a), and the ordinary server log files apply.
3. Where the data is and who sees it
The application, the database and the photos are hosted on Hetzner servers in Germany. Database backups are taken every hour during working hours and once a night, and photo backups once a night; they are kept in Germany and, encrypted, in Finland (EU). Daily backups are kept for 14 days and the first of each month for up to 13 months; whole-server images are kept for 7 days. We do not sell, rent or share data with third parties for their own purposes. The sub-processors needed to run the service are:
| Provider | Country | Purpose | What it receives |
|---|---|---|---|
| Hetzner Online GmbH | Germany and Finland (EU) | Hosting of the application, the database and proof photos; backups | All service data |
| Amazon Web Services EMEA SARL (Amazon SES) | Luxembourg (EU); processing in Frankfurt, Germany (region eu-central-1) | Relay of service email to users (password reset, notifications) | The recipient's email address and the message content |
| OpenStreetMap Foundation | United Kingdom (adequacy decision) | Map tiles on the driver and dispatcher screens; address geocoding (Nominatim) | For tiles: the device's IP address and the map area. For geocoding: the address text, sent from our server, without user details |
In addition, the following third-party services receive data as independent controllers, under their own terms — when our customer uses address search, when the driver chooses navigation, or when one of our customer’s users sends a delivery tracking link from their own device (section 2e):
| Service | Country | When | What it receives |
|---|---|---|---|
| Google Ireland Ltd (Places API) | Ireland (EU); possible onward transfer to Google LLC, USA (EU-US Data Privacy Framework) | Address autocomplete when a stop is entered | The address text being typed — sent from our server, without IP or user details |
| Waze / Google Maps / Apple Maps (navigation apps) | On the driver's device, under each app's own terms | Navigation to the stop, when the driver taps “Navigate” — opens the app the driver has chosen | The stop's coordinates — from the driver's device, not from our server |
| SMS / WhatsApp / Viber (the device's messaging apps) | On the device of the customer's user (dispatcher or driver), under the terms of each app or mobile carrier | Sending the delivery tracking link to the recipient, when a dispatcher or driver of the customer chooses to send it — the messaging app on their own device opens and they send the message themselves; PRODEL sends no messages and has no SMS provider | The recipient's phone number and the message text containing the link address — from the user's device, not from our server, which does not learn whether or to whom it was sent |
Transfers outside the EU/EEA take place only to the United Kingdom (OpenStreetMap Foundation, a country with an adequacy decision of the European Commission) and, for address search through Google, possibly to the USA under the adequacy decision for the EU-US Data Privacy Framework. Our customer may ask us to disable Google search; OpenStreetMap is then used alone.
4. Cookies and device storage
PRODEL uses only what is strictly necessary for its operation and no tracking or advertising tool. Details on the Cookies page.
5. Security
- All communication between your device and the service uses HTTPS (TLS); internal connections between our systems do not leave the server or our private network.
- Passwords are stored only as bcrypt hashes; nobody, including us, can read them.
- Access to data only for each customer’s authorised users — with the sole exception of the delivery tracking page, immediately below; the role is re-checked against the database on every user-management action and at least every 60 seconds for the rest. Changing a password signs out all other devices.
- The only page that shows delivery data without sign-in is the delivery tracking page (section 2e): it shows limited details of a single stop, only to someone holding its signed address — which cannot be guessed — and only until it expires.
- Rate limits against automated attacks on sign-in, password reset, forms and the delivery tracking page.
- Each customer is served by a separate installation, with its own database and photo storage.
- Administrative access to production systems is held only by the company’s management, with personal keys over an encrypted connection. Software development takes place in a separate environment with fictitious data.
6. Your rights
You have the right:
- to access your data and obtain a copy;
- to have inaccurate data corrected;
- to erasure (“right to be forgotten”), where there is no lawful ground for retention;
- to restriction of processing and to object to processing based on legitimate interest;
- to portability of the data you gave us;
- to withdraw your consent at any time, without affecting the lawfulness of prior processing.
To exercise them, write to andreas@3buttontrading.com. We reply within one month at the latest; for complex or numerous requests the period may be extended by two months, and we will tell you so within the first month. We do not make decisions about you solely by automated means and we do not profile you; the suggested stop order and driver allocation are a tool that the dispatcher reviews and changes.
You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus (1 Iasonos Street, 1082 Nicosia · tel. +357 22818456 · commissioner@dataprotection.gov.cy · www.dataprotection.gov.cy) or with the supervisory authority of the member state where you live.
7. Minors
The service is addressed to businesses and is not intended for persons under 18.
8. Changes
If this policy changes, the new version is published here with a new date; previous versions are available on request at andreas@3buttontrading.com. For material changes affecting application users, we notify customers’ dispatchers by email at least 30 days before they take effect.