Privacy Policy

ROIG Drivers App mobile application

Last updated: 20/07/2026

This Privacy Policy explains how the personal data of the drivers who use theROIG Drivers App (the "App") is processed. The App is an internal tool for managing daily transport services. It is intended for professional use by ROIG staff only.

1.Data controller

Legal name: Roig Bus SA
Tax ID (CIF/NIF): A07111628
Address: Av. dels Benvinguts, 64, 07660 Cala d'Or, Illes Balears
Contact email: informatica@roig.com

2.Scope

The App is an internal, professional tool for ROIG bus drivers in Mallorca. It lets drivers view and manage their daily services (arrival, departure and excursion), confirm stops and reservations, report incidents, attach voucher photos, chat with other drivers and receive notifications. It is not aimed at the general public.

3.Data we process and purposes

We only process the data needed to provide the service:

Data category	Purpose	Legal basis
Account data: driver number and name	Authenticate the user and identify their session	Performance of the employment/contractual relationship
Credentials: password	Verify identity at sign-in (not stored on the device)	Performance of the employment/contractual relationship
Service operational data: service type and status, schedules, flight number, assigned vehicle, agency, stops, passenger count, luggage and reservation client name	Display and manage assigned services and confirm their completion	Performance of the employment relationship · legitimate operational interest
Photographs (vouchers, incidents and stop confirmations)	Document and justify service operations	Legitimate interest · service performance
Location (only while the App is in use, at the moment a photo is taken)	Record the place where the supporting photo is taken	Legitimate interest (subject to system permission)
Chat messages: content and sender name	Internal communication among drivers and with the organisation	Performance of the employment relationship · legitimate interest
Push notification identifier (token) and device name	Send alerts about services and messages	Legitimate interest · consent (notification permission)
Minimal technical data (App version)	Support and diagnostics	Legitimate interest

4.Device permissions

The App requests the following permissions, always for a specific purpose that is shown when they are requested:

Camera: so you can take photos of the vouchers and/or incidents you have during your working day.
Photo library: so you can select photos of the vouchers and/or incidents you have during your working day.
Location (while using the App): to record the place where you take the voucher and incident photos. No continuous or background tracking is performed.
Notifications: to send you alerts about your services, vouchers and other important updates.
Face ID / biometrics: so you can sign in quickly and securely without typing your password every time.

About biometrics: biometric data (Face ID / fingerprint) is processed entirely on your device by the operating system; the App never accesses or transmits it. It is used solely to locally unlock access to your session.

You can grant or revoke these permissions at any time in your operating system settings. The App will keep working, although some features may be limited.

5.Data we do NOT collect

We do not use any third-party analytics, advertising or tracking tools. In particular: there are no advertising trackers, we do not use the advertising identifier (IDFA/AAID), we do not track you across apps or websites, and we never sell or share data for commercial purposes.

6.Data retention

Session data (tokens) is kept while the session is active and is deleted from the device on sign-out.
Operational data and pending actions are stored locally on the device and deleted on sign-out.
Photos pending upload are stored locally only until they are synced with the server.

7.Recipients and processors

Data is processed within ROIG's infrastructure and by the providers strictly necessary for the App to work:

ROIG servers (own backend): primary destination for operational data, credentials, chats and photos. On a transitional basis, some data may be routed through an internal system that is being migrated.
Expo / EAS: receive the notification identifier to deliver alerts and serve App updates.
Google (Firebase Cloud Messaging): technical transport for push notifications on Android devices.
Google Maps: if you tap a stop or itinerary link, Google Maps opens in your browser or external app (a Google service, subject to its own privacy policy).

Data is never shared with third parties for advertising purposes, nor sold under any circumstances.

8.Security

We apply reasonable technical and organisational measures: communications with the server use encrypted connections (HTTPS/WSS), the long-lived session token is stored in the operating system's secure store (Keychain on iOS / Keystore on Android), and the access token is kept only in memory during the session.

9.Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing toinformatica@roig.com. You also have the right to lodge a complaint with theSpanish Data Protection Agency (AEPD,www.aepd.es) if you believe the processing does not comply with the regulations.

10.Minors

The App is a professional tool aimed at ROIG staff and is not intended for minors.

11.Changes to this policy

We may update this Privacy Policy to reflect changes in the App or in applicable regulations. We will publish the updated version on this same page, indicating the last-updated date.

12.Contact

For any question regarding this policy or the processing of your data, write to us at informatica@roig.com. See also ourSupport page.