PRIVACY · TRIVO PLATFORM
Privacy
Policy.
How TRIVO collects, uses, shares and protects personal data across our website, contact channels and transport-management platform.
Effective date: 30 September 2026This Policy is intended to provide the information required by Regulation (EU) 2016/679 (“GDPR”). It should be read with our Terms & Conditions and Cookie Policy.
1. Who is responsible for your data
For website enquiries, subscription-launch signups, account administration and our own business operations, the data controller is STANDARD DIGITAL SOLUTION SRL, operator of TRIVO.
2. When TRIVO acts as processor
Business customers may upload or create data about their drivers, staff, clients, contacts and other individuals. For that customer-controlled operational data, the customer normally determines why and how the data is processed and acts as controller; STANDARD DIGITAL SOLUTION SRL processes it to provide TRIVO and normally acts as processor.
Customers are responsible for giving appropriate information to those individuals and having a lawful basis for using their data. Where required, controller and processor obligations are governed by a data processing agreement under Article 28 GDPR.
3. Personal data we process
- Account and identity data: name, business email, password hash, user role, company membership and authentication-session information.
- Company and subscription data: legal and trading names, registration and tax details, address, billing plan, subscription status and payment-provider references. TRIVO does not store complete payment-card details; subscription checkout and billing are handled by Stripe.
- Operational transport data: driver and vehicle details, contact information, routes, trips, locations, kilometre records, transport orders, clients, invoices, expenses, revenues and documents entered or uploaded by users.
- Contact and update-list data: name, email, company, enquiry topic, message, consent record, confirmation status, confirmation-token hash and timestamps used to document a contact or subscription-update request.
- Technical and security data: IP address and request metadata that may be generated by hosting infrastructure, login-session identifiers, timestamps, error and security logs.
- Integration data: route locations sent to a routing provider and document contents sent to a configured document-analysis provider when a user actively requests those features.
Please do not submit special-category data, criminal-offence data or unnecessary personal information unless there is a valid legal basis and it is genuinely required for your transport operation.
4. Why we use data and our legal bases
| Purpose | Typical data | Legal basis |
|---|---|---|
| Provide accounts, workspaces and TRIVO features | Account, company and operational data | Performance of a contract; for customer-controlled data, processing on the customer’s documented instructions |
| Secure the service, prevent abuse and diagnose faults | Session, request, error and security data | Legitimate interests in protecting TRIVO, its customers and users; legal obligations where applicable |
| Respond to an enquiry or demo request | Contact form and correspondence data | Steps requested before a contract and legitimate interests in business communication |
| Send subscription-launch information | Email and consent record | Consent, which may be withdrawn at any time |
| Manage subscriptions, invoices and accounting | Company, plan, billing and transaction references | Performance of a contract and legal obligations |
| Establish, exercise or defend legal claims | Relevant account, contract and correspondence records | Legitimate interests and compliance with legal obligations |
Where we rely on legitimate interests, we consider the necessity and impact of the processing and the reasonable expectations of the individuals concerned.
5. How data is collected
We collect data directly from you when you create an account, complete forms, contact us or use TRIVO. Business customers and authorised users also enter data about their operations and personnel. Technical data is generated when the service receives and processes requests. Configured providers return route or document-analysis results only after a user invokes the relevant feature.
6. Recipients and service providers
Access is limited to authorised personnel and suppliers who need the data for their role. Depending on the feature used, data may be shared with hosting and security providers, business email providers, payment and billing providers once subscriptions are enabled, routing/map providers, document-analysis providers, professional advisers, and public authorities where legally required.
Providers are selected and used under appropriate confidentiality, security and data-protection terms. We do not sell personal data and do not use it for third-party behavioural advertising.
7. International transfers
We aim to process data in the European Economic Area where reasonably available. Some service providers may process data outside the EEA. Where GDPR transfer restrictions apply, we use an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where necessary. You may request information about the relevant transfer safeguard by contacting us.
8. Retention
We keep personal data only for as long as necessary for the relevant purpose, considering the contract, customer instructions, security needs and legal limitation or retention periods.
- Account and operational data is retained while the customer account is active and then deleted or returned in accordance with the customer agreement, backup cycle and applicable law.
- Authentication sessions expire after 30 days unless ended earlier.
- Contact enquiries are normally retained for up to 24 months after the enquiry is closed, unless a longer period is needed for a contract, legal obligation or claim.
- Subscription confirmation links expire after 48 hours. Confirmed email and consent records are retained until consent is withdrawn, the purpose ends, or the address remains unengaged for 24 months; unconfirmed records are removed periodically when no longer needed.
- Billing, invoice and accounting records are kept for statutory retention periods.
- Security logs and backups are retained for limited, documented periods appropriate to security, recovery and legal needs.
Data may be retained longer where preservation is required by law, a competent authority or a genuine legal claim.
9. Your GDPR rights
Subject to the conditions and exceptions in applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. Where processing is based on consent, you may withdraw consent at any time without affecting processing already carried out.
Send requests to contact@trivo-app.com. We may need to verify your identity and, for customer-controlled workspace data, coordinate with the relevant business customer as controller.
You may also lodge a complaint with the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), or the competent authority in your EU country. We encourage you to contact us first so we can address the concern.
10. Cookies and session storage
TRIVO uses a strictly necessary authentication cookie called trivo_session to keep signed-in users authenticated. It is HttpOnly, SameSite=Strict, limited to TRIVO and set for up to 30 days. The public website and forms do not currently set analytics, advertising or social-media cookies. Details are in our Cookie Policy.
11. Automated features
Document extraction, route calculations and financial summaries support human users and may be incomplete or inaccurate. They do not make decisions producing legal or similarly significant effects about individuals on behalf of STANDARD DIGITAL SOLUTION SRL. Users must review important operational results before relying on them.
12. Security
We use proportionate technical and organisational safeguards designed to protect personal data, including access controls, password hashing, secure session cookies, transport encryption, server-side secret handling, backups and logging. No online service can guarantee absolute security. Please protect your credentials and report suspected unauthorised access promptly.
13. Children
TRIVO is a business service and is not directed to children. We do not knowingly invite children to create accounts or submit personal data through the public website.
14. Changes and contact
We may update this Policy when the platform, providers or legal requirements change. The current version and effective date will be published here; material changes will be communicated where required.
For privacy questions or requests, email contact@trivo-app.com, use our contact form, or write to STANDARD DIGITAL SOLUTION SRL at the registered office shown above.