Privacy Notice for Drivers and Vehicle Assistants

TMS driver application

Effective date:  

This is a translation of the Thai original. If the two versions conflict, the Thai version governs.

Read this part if you read nothing else

This notice tells you plainly what the app collects about you, who can see it, and what you can do about it.

The five things that matter most

1. This app does not watch where you are all day. It reads your position only when you photograph proof, check a vehicle in or out, or change a job status. Close the app and the system does not know where you are. Outside working hours, it does not know either.
2. If you decline location permission, you can still use the app and complete jobs normally. That is deliberate. You are not being forced.
3. Your employer owns the data, not us. We build and run the system. To see, correct, or delete your data, speak to your employer first.
4. Your bank account number and a photo of your driving licence are stored in the system — used to pay you, and to confirm you are licensed to drive.
5. What your supervisor and dispatchers can see is set out in clause 4. Nothing is hidden.

1. Who collects your data

This determines who you need to talk to.

Your employer or the company you work for is the "Data Controller". They decide what is collected about you, why, and for how long.

  (us) is the "Data Processor". We build and maintain the system and store the data on your employer's instructions. We will not use your data for anything other than what your employer instructs.

Put simply: we look after the filing cabinet, but your employer owns the files.

2. What the app collects

2.1 About you

• Name, telephone number, email, profile picture
• Password — stored in a transformed form. We do not know your password and cannot recover it.

2.2 Driving licence

• Licence class, licence number, expiry date
• A photograph or scan of the licence

Why: your employer has a legal duty to verify that drivers are properly licensed, and needs the expiry date to remind you before it lapses.

2.3 Payment account

• Bank name, account number, account holder name, or PromptPay ID

Why: to pay you. It is not used for anything else.

2.4 Pay

• Per-trip pay and the monthly total you see on the earnings screen

2.5 Daily work

• Assigned jobs, routes, pickup and delivery points
• Vehicle check-in and check-out times, with odometer readings and vehicle condition photographs
• Photographs at pickup and delivery
• Recipients' signatures
• Delivery issue reports — customer unreachable, wrong address, no recipient, and so on
• The history of status changes you make, with timestamps

2.6 Location — read this one carefully

The system reads your position at only three moments:

1. When you photograph proof of pickup or delivery, or take a customer's signature
2. When you check a vehicle in or out
3. When you change a job status — starting, completing, or reporting an issue

Outside those three moments, the system does not read your position.

• The app requests "while using the app" permission only, not background permission
• Close the app and the system does not know where you are
• On days off, outside working hours, or whenever the app is not open, the system does not know where you are
• The system does not record the route you drive — only the points where you did one of those three things

The "where is the vehicle" screen a dispatcher sees shows the last point where you did one of those things, together with the time it was recorded — not your live position.

Why location is recorded — to confirm goods were actually delivered where they were meant to be. If someone claims they never received a delivery, the coordinates and photograph protect you too, not just the company.

If you do not want location recorded — decline the permission prompt, or turn it off in your device settings. You can still complete jobs. Proof will be recorded without coordinates. Your employer may have internal rules about this, which is between you and them, not us.

2.7 Technical data

IP address, device model, app version, and access times — kept for security and troubleshooting.

3. What your data is used for, and on what basis

On consent — why we do not ask for your consent to location

The law recognises that consent between an employee and an employer is rarely freely given, because you are not in a position where refusing is easy.

Asking for consent in that situation creates the appearance of a choice you do not really have. So we do not rely on consent. We rely on legitimate interest instead.

The benefit to you: that basis carries a right to object (clause 6), and it obliges your employer to weigh the company's interest against your rights, in writing.

4. Who can see your data

4.1 People at your company

According to permissions your company's administrator sets. Typically:

4.2 Other companies using the same system

They cannot see your data at all. The system isolates data between companies completely.

4.3 Service providers we use

• Cloud providers storing the data and photographs
• The SMS provider that sends your login OTP
• The mapping provider that displays routes and delivery points
• Google or LINE, if you chose to log in that way

The full list is in clause 5.2 of the Privacy Policy.

4.4 Legal requests

If a court or competent authority orders it, we may have to disclose data. We check the order's validity first and disclose only what is necessary.

4.5 What definitely does not happen

We do not sell your data. We do not use it for marketing, and we do not give it to insurers or anyone else.

5. How long it is kept

Actual periods also depend on your employer's own policy, which may be shorter or longer within what the law allows.

6. Your rights

Under the Personal Data Protection Act B.E. 2562 you have the right to:

6.1 How to exercise them

First: tell your employer or HR. They own the data and are the only ones who can decide what gets deleted or changed.

If that gets you nowhere, or you do not know who to contact, email  . We will forward your request to the relevant company within 7 days and tell you where we sent it.

If you still are not treated fairly, you can complain directly to the Personal Data Protection Committee Office at https://www.pdpc.or.th.

Exercising your rights is free, and exercising a legal right must not result in you being penalised or treated unfairly.

6.2 What to realistically expect

Some things cannot be deleted straight away — proof of delivery attached to a work order, for example, because it is a business record the company must keep by law and for potential disputes.

We would rather say so plainly than let you expect otherwise. But your personal details, such as your bank account number and licence photograph, can be deleted once you no longer work for that company.

7. Security

• Data is encrypted in transit from your phone to the server
• Your login token is stored in your device's encrypted store (Keychain on iPhone, Keystore on Android), not a plain file
• Photographs and licence files are stored where outsiders cannot open them; access requires a special link that expires in 15 minutes
• Passwords are stored in a form that cannot be reversed

What you can do

• Use a strong password and do not reuse it on other apps
• Never share an OTP code with anyone. We never call or message you asking for an OTP. If someone claiming to be staff asks for your OTP, that is a scam.
• If you lose your phone, tell your supervisor or administrator immediately so the account can be suspended

8. If you leave the company

• You can no longer access the app under that company
• Your personal details (payment account, driving licence) are deleted within 90 days
• The proof of delivery you recorded stays in the company's system for the period in clause 5, because it is the company's business record rather than purely your personal data
• If you move to another company using the same system, that company cannot see anything from your previous employer

9. If there is a data breach

If a breach occurs that significantly affects you:

1. We notify your employer within 48 hours of becoming aware
2. Your employer must notify the Personal Data Protection Committee Office within 72 hours, and notify you if the breach poses a high risk to you
3. The notification will say what happened, what data of yours was affected, and what you should do

10. Changes to this notice

If something significant changes — new categories of data, or a change in how location is collected — we will give at least 30 days' notice, through the app or through your employer.

In particular, if the system ever moves to continuous or background location tracking, you must be told first and your device must ask you for new permission. It cannot happen quietly.

11. Contact

Your employer — for questions about your data, work, pay, and exercising your rights: contact your company's HR department or system administrator.

Us (the system provider) — for app problems and security matters:   Email:   Personal data matters:  

Supervisory authority Personal Data Protection Committee Office (PDPC) Website: https://www.pdpc.or.th

This document exists in Thai and English. If they conflict, the Thai version governs.