Privacy Notice.

This notice describes how Jics ("we") handles personal data when running the Jics fleet tracking and logistics platform. Section 2 says which Jics company is responsible for which data. Jics is used by businesses in many countries, so this notice is written to meet the EU General Data Protection Regulation and the UK General Data Protection Regulation with the UK Data Protection Act 2018 (together, the "GDPR"), the Swiss Federal Act on Data Protection, the privacy laws of the United States, including the California Consumer Privacy Act as amended (the "CCPA"), and the Nigeria Data Protection Act 2023 (the "NDPA"). Sections 10 and 11 add information that applies only to people in Europe and in the United States. It applies to:

• visitors to jicsmotion.com,
• staff of our customers (administrators, fleet and security managers) who sign in to the dashboard or the mobile app,
• drivers and field staff who use the operator app or drive a vehicle fitted with a tracker or camera,
• people who receive tracking links and confirm deliveries, and
• anyone who contacts us by email or other channel.

Jics is provided by two companies, described under Company information in our Terms: Plaman Engineering Limited Company, and Plaman Engineering Limited, which develops and runs the platform and this website. Which one a customer contracts with depends on the country of operation chosen for the customer's account.

• For data processed inside a customer's tenant — user records, vehicle telemetry, trip data, customer delivery confirmations — the customer is the controller, and the Jics company it contracts with acts as processor (a "service provider" under US state privacy laws) under the Data Processing Addendum.
• For our customers' own account and billing contacts, the controller is the Jics company the customer contracts with.
• For visitor, prospect and demo-request data, the controller is Plaman Engineering Limited.

Neither company has an office in the European Economic Area (EEA), the United Kingdom or Switzerland, and the team that supports the platform works from Nigeria. Before we provide the platform to our first customer in the EEA or the United Kingdom, we will appoint a representative there, as Article 27 of the GDPR requires, and publish their contact details in this section. Until then, please contact us directly using the details in section 16.

3.1 Account data

Names, work email addresses, phone numbers, role, company, sign-in times and the technical details of each sign-in, including the network address of sign-in attempts, which we keep for a short time to block repeated wrong passwords. When a company signs up, we also record the network address the sign-up came from and the email address used, for 7 days, to stop automated and repeated sign-ups. Drivers sign in with a phone number and password, or with a QR code shown by their manager, and their account is paired to one phone.

3.2 Location and vehicle data

Position, speed, direction, ignition state, mileage, fuel level, battery and temperature readings from tracker devices, and position and movement from the operator app, including in the background while a driver is on duty. Readings are stamped with the time and the vehicle they belong to, and the driver on duty at the time.

3.3 Video, sound and events

Where a customer fits a dash camera: video clips and still images from the road and, if fitted, the cabin, and the driving events the camera detects (such as distraction or harsh braking). The customer's managers can also watch a dash camera's picture live; it is passed through and not recorded, and the control room opens a camera's live picture by itself for about a minute when that camera detects a serious alarm (such as a collision or driver tiredness), or, when the driver raises a panic or SOS alert, until the alert is dealt with (at most 30 minutes). While someone has the dashboard's control room open, the road camera of a vehicle with its engine on sends a still photo every couple of minutes; road photos for the control room are shown and not kept. While a panic alert is active: sound recorded by the driver's phone. If the driver enters their duress PIN instead of cancelling, the phone looks cancelled but keeps sending its position and sound until a manager closes the alert; drivers are told this when they set the PIN. Where the customer's dash camera has a microphone and speaker, the customer's managers can open a live two-way voice call with the cabin: while the call is open they hear what is said in the cabin and can speak through the camera. The call is passed through live and is not recorded or kept. Driving scores are calculated from these events and from movement data.

3.4 Delivery data

Recipient name and contact details where the customer supplies them, the one-time code or link used at the door, and the time, location, photo and signature captured when a delivery is confirmed.

3.5 Device data

Tracker serial and network identifiers, SIM identifiers, phone model and app version, an identifier for the phone an operator's account is paired to, push-notification tokens, and the identity tags drivers carry.

3.6 Payment data

Plan, invoices and payment status. Card details are entered on the payment processor's own pages and held by it (Stripe, or Paystack or Flutterwave for customers whose account's country of operation is Nigeria); we receive a payment reference and the outcome, never the full card number.

3.7 Usage data

Pages viewed, actions taken, device and browser information, and performance measurements used to operate and improve the platform.

3.8 Marketing data

Information you provide when signing up for updates or contacting sales.

3.9 Demo requests

When you book a demo on our website we collect your name, company, phone or WhatsApp number, fleet size and sector. We use them only to arrange and hold your demo, never for marketing lists, and remove them 12 months after your request.

3.10 Robot check

When a company signs up on the dashboard, a check run by Cloudflare (Turnstile) confirms that a person, not an automated program, is filling in the form. Cloudflare receives the device's network address and technical signals from the browser for this purpose, and tells us only whether the check passed.

We use personal data to:

• provide and operate the Jics platform on behalf of customers,
• authenticate users and maintain tenant isolation,
• raise live alerts to the role that needs to know,
• record delivery confirmations against the trip,
• diagnose and fix issues, and to investigate suspected abuse or fraud,
• communicate with operators and prospects about the service, and
• meet legal and contractual obligations.

Under the GDPR and the NDPA we rely on:

• performance of a contract — operating the service for our customers and their staff, and taking payment;
• legitimate interests — operating, securing and improving the platform, preventing fraud and abuse (including the sign-up checks in section 3), and our customers' interest in managing and protecting their vehicles, people and goods, where these interests are not overridden by the rights of the individual;
• consent — for optional marketing, and where a customer's own policy or the law requires consent for tracking or recording;
• legal obligation — responding to lawful requests and keeping financial records; and
• vital interests — passing a panic alert's position and sound to the people who can help when someone may be in danger.

Where a customer tracks its own drivers or records its own vehicles, the customer is the data controller and chooses the lawful basis; in Europe this is usually the customer's legitimate interests, supported by a data protection impact assessment. We ask every customer to tell its drivers, in writing and before tracking starts, what is recorded and why, and we give customers a ready-made driver tracking notice in the dashboard to do so.

We share personal data only with the providers below, who process it for us under contract, and only as needed to run the service. We do not sell personal data, and we do not share it for targeted or cross-context behavioural advertising.

• Supabase, Inc. — database, file storage and sign-in; data held in the European Union (France).
• Vercel, Inc. — hosting for the website and dashboard; servers in the United States and a worldwide delivery network.
• Hetzner Online GmbH — the server that receives tracker data and our own map services; Finland.
• Google LLC — Google Maps Platform for companies whose plan includes Google's maps (Google receives the device's location and map requests under the Google Privacy Policy); Firebase for app notifications; and Gmail for the mailboxes that receive email sent to our addresses.
• Brevo (Sendinblue SAS) — sends the emails the platform itself sends, such as password resets and staff invitations; France.
• Cloudflare, Inc. — our domain's name servers, the forwarding of email sent to our addresses, and the robot check on the company sign-up form; United States, with servers worldwide.
• OpenFreeMap, Komoot GmbH and FOSSGIS e.V. — open map tiles, place search and road routes for places outside our own coverage; they receive only the map area, the search text or the route points, never who asked.
• Stripe, Inc. — card payments for customers whose account's country of operation is any country other than Nigeria; United States.
• Paystack Payments Limited and Flutterwave Technology Solutions Limited — card and bank payments for customers whose account's country of operation is Nigeria; Nigeria.

We do not send SMS messages.

We will publish changes to this list here before they take effect. We may also share data when legally required, in connection with a sale or reorganisation of our business (with continued confidentiality), or with the service provider a customer has appointed to manage its account.

Your data is stored in the European Union (France and Finland), the emails we send go through France, data passes through servers in the United States and Germany, and our support team in Nigeria can access it to run the service. How each move is protected depends on where the data comes from:

• From the EEA, the United Kingdom or Switzerland: where data goes to a country whose protection has not been recognised as adequate by the European Commission (or by the UK or Swiss authorities) — including Nigeria and the United States — we use the European Commission's Standard Contractual Clauses, with the UK Addendum or the Swiss amendments where needed. They are built into our Data Processing Addendum for customers and into our providers' data processing terms. Where a US provider is certified under the EU–US Data Privacy Framework and its UK and Swiss extensions, we may rely on that certification instead.
• From Nigeria: we transfer data under sections 41 to 43 of the NDPA. Our providers are bound by contracts that require protection at least as strong as Nigerian law, and we transfer only what the service needs.
• From the United States and other countries: we apply the same contracts and safeguards.

You can ask us for a copy of the safeguards that apply to your data.

We keep personal data only as long as the purpose needs it:

• Account and company data: for the customer's subscription and 30 days after it ends.
• Positions, trips, deliveries, alerts, photos, signatures and camera clips: for the subscription; the customer can delete most of them sooner, and can export them from the dashboard or ask us for a complete copy for 30 days after the subscription ends, after which we delete them.
• Road photos for the control room: not kept; each is replaced by the next and none is saved.
• Sensor readings (fuel, battery, temperature): a rolling 90 days.
• Panic-alert sound recordings: for the subscription, or earlier when the customer asks us in writing to delete a recording.
• One-time sign-in codes and delivery codes: minutes to hours, then discarded.
• Company sign-up attempt records (network address and email): 7 days.
• Invoices and payment records: six years, as tax law requires.
• Backups: overwritten within 14 days of deletion.
• Demo requests: 12 months, then removed.
• Marketing data: until you unsubscribe.

Wherever you live, you can ask us to:

• tell you whether we hold personal data about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer need or have no right to keep;
• restrict how it is used, or object to a use based on legitimate interests or to direct marketing;
• give you the data you provided in a common, machine-readable form, or send it to another organisation;
• stop relying on your consent, where we rely on it, without affecting what was done before; and
• not make a decision about you by automated means alone where it significantly affects you.

Driving scores and camera events are aids for the customer's managers, not automatic decisions: any decision about a driver is taken by a person.

Where your data sits inside a customer's account (for example, you drive for one of our customers), please ask that customer first, because it decides how that data is used; we will help it answer within the time the law allows. Otherwise contact hello@jicsmotion.com. We answer within 30 days, do not charge for a reasonable request, may need to confirm who you are first, and will never treat you less favourably for using your rights.

If you are not satisfied, you can complain to the data protection authority where you live or work, or where the problem arose — for example the data protection authority of your EEA country (listed at edpb.europa.eu), the UK Information Commissioner's Office (ico.org.uk), the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch) or the Nigeria Data Protection Commission (ndpc.gov.ng). Section 11 explains the options for people in the United States.

• Who decides: for data inside a customer's account, the customer is the controller and we are its processor; for website visitors, prospects, demo requests and the billing contacts of our customers, we are the controller (section 2).
• Representative: see section 2.
• Legal bases: as set out in section 5 — Article 6(1)(a) consent, (b) contract, (c) legal obligation, (d) vital interests and (f) legitimate interests of the GDPR.
• Do you have to give us your data? A customer's staff and drivers must provide the data their employer needs for their work, and the employer explains this. Website visitors and prospects choose what to give us; without it we cannot answer you or arrange a demo.
• Special categories: the platform does not need health, biometric or other special-category data, and customers must not load it. Location and camera data can still reveal sensitive facts, which customers must consider in their impact assessment.
• Transfers: see section 7.
• Rights and complaints: see section 9. You may complain to the supervisory authority in the EEA country where you live or work or where the problem arose, to the UK Information Commissioner's Office, or to the Swiss Federal Data Protection and Information Commissioner.

This section is our notice at collection and privacy policy for the CCPA and for the consumer privacy laws of other US states, such as Colorado, Connecticut, Virginia, Texas and Oregon. Whether or not a particular state law applies to us, we give US residents the rights described here.

What we collect and why. In the last 12 months we have collected the categories below, from the sources and for the purposes set out in sections 3 and 4, and we keep each for the periods in section 8:

• identifiers — name, email address, phone number, account and device identifiers, network address;
• professional or employment information — company, role, and the trips and deliveries given to a driver;
• commercial information — plan, invoices and payment status;
• internet or other electronic network activity — sign-in records, and the pages viewed and actions taken in the platform;
• geolocation data, including precise geolocation, from trackers and the operator app;
• audio, electronic and visual information — dash-camera video and images, road photos for the control room (shown, not kept), panic-alert sound, live cabin voice calls (passed through, not kept), delivery photos and signatures;
• inferences, limited to driving scores calculated from driving events; and
• sensitive personal information, limited to precise geolocation and account sign-in details.

We use sensitive personal information only to provide the service, keep it secure and for the other purposes the law permits, and never to infer characteristics about anyone.

Who receives it. We disclose personal information for business purposes only to the service providers listed in section 6 and to the customer whose account the data belongs to. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16, and we do not give personal information to anyone for their own direct marketing.

Your rights. Depending on your state, you have the right to know what personal information we hold and how we use it, to get a copy, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising (we do none of these), and not to be treated less favourably for using these rights. To make a request, email hello@jicsmotion.com with the subject "Privacy request". We confirm your identity by matching details we already hold, aim to reply within 30 days, and always reply within 45 days, or within a further 45 days where the law allows and we tell you why. You may use an authorised agent, who must show your signed permission. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing.

Appeals. If we turn down your request, you can appeal by replying to our decision, and we will answer within 45 days. If you are still not satisfied, you can contact your state attorney general or, in California, the California Privacy Protection Agency (cppa.ca.gov).

Data inside a customer's account. When we hold data for a customer — for example a driver's positions — we act as that customer's service provider. Please send requests about it to the customer, and we will help it respond.

We protect personal data with encryption in transit and at rest, sign-in protection, role-based access, strict separation of each customer's data at the database level, audit logs of sensitive actions, secrets kept out of code, daily backups by our hosting provider and an export of the data before every change to the database. Only the people who need access to run the service have it. No system is perfectly secure: if a breach affects your data we will tell the customer concerned within 48 hours of confirming it, so that it can meet its own duty to tell its regulator (72 hours under the GDPR and the NDPA). Where we are the controller, we will notify the regulator and, where the law requires, the people affected ourselves.

The platform is for businesses and their adult staff and is not directed at children. We do not knowingly collect personal data from anyone under 18, other than a recipient's name and confirmation details where a customer delivers to a household. If you believe we hold a child's data in error, contact us and we will delete it.

The dashboard, the operator app and tracking links use only the cookies and on-device storage needed to keep you signed in, remember your settings and keep the service secure. The company sign-up form also uses Cloudflare's robot check (section 3.10), which may keep a short-lived security token in your browser. This website keeps two choices in your browser: the light or dark look you pick, and the country you chose on the pricing page, in a cookie kept for one year so the right price list opens next time. Neither identifies you. We do not use advertising or analytics cookies, and we do not track you across other websites. Because we use only cookies that are strictly necessary, we do not ask for cookie consent; if that ever changes, we will ask you first, as European law requires.

We may update this notice from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the platform or by email before they take effect.

Questions about this notice or how we handle personal data, and requests to exercise your rights, can be sent to our data protection contact at hello@jicsmotion.com, or by post to the Jics company concerned, at the address shown under Company information in our Terms. You may also complain to a data protection authority, as described in section 9.