Privacy Policy

Effective Date: 15 July 2026

Last Updated: 15 July 2026

1. Who We Are

MyWay Route Planner is operated by Proalab Limited, registered in New Zealand.

Proalab Limited is the data controller for individual users, and acts as a data processor for organizations that provide B2B access (see Section 8).

By using the Service, you agree to the collection and use of information in accordance with this Policy. Terms not otherwise defined in this Policy have the meanings set out in our Terms of Service.

2. What Data We Collect

• Account Data — name, email, login credentials.
• Location (GPS) — real-time and background.
• Contacts — selected entries only. We don’t upload your full address book.
• Camera / Photos
• Digital Signature
• Payment Data — we don’t store card numbers. Processed by app store platforms and payment processors.
• Push Notification Token
• Advertising / Attribution ID — IDFA (iOS, via ATT permission) and GAID (Android).
• Support Communications — messages and attachments via in-app chat/helpdesk.
• Usage / Technical Data — IP, device/OS, app version, activity logs, crash and diagnostic data.
• Cookies (Web) — session, preference, and analytics.

All permission-based data (location, contacts, camera, signature, push, advertising ID) is collected only when the related feature is used by you, for core app functionality, and is not sold or shared with advertisers beyond the attribution use stated above.

App Tracking Transparency (iOS)

We request permission via Apple’s App Tracking Transparency framework before accessing your advertising identifier. Change this anytime in Settings → Privacy → Tracking.

3. Legal Basis for Processing

• Account data — Contract performance
• Location — Consent
• Contacts — Consent
• Camera / photos — Consent
• Digital signature — Consent (via app user)
• Payment processing — Contract performance
• Push token — Consent (notification permission)
• Advertising ID — Consent (ATT prompt on iOS; opt-out available)
• Support chat data — Contract performance / legitimate interests
• Usage / technical data — Legitimate interests
• Marketing emails — Consent

You may withdraw consent at any time; this doesn’t affect the lawfulness of prior processing.

4. Third-Party Service Providers

• Billing platforms — Subscription processing (app stores and web)
• Analytics providers — Usage tracking, crash reporting
• Advertising / attribution networks — Ad campaign measurement, install attribution
• Support / helpdesk platform — Customer support ticketing and chat
• Cloud hosting providers — Data storage and infrastructure

Providers may change over time. A current list of active sub-processors is available on request (see Section 13). We do not sell your data or share it with third parties for their own marketing.

5. Data Retention

• Account and profile data — Until account deletion
• Route and location history — Until deleted by user or account deletion
• Proof-of-delivery photos/signatures — Until deleted by user or account deletion
• Support chat history — 24 months, or per helpdesk provider policy
• Usage logs and diagnostics — 12 months rolling
• Payment records — As required by applicable tax law (typically 7 years)

To delete your account and associated data, contact us (Section 13) or use the in-app account deletion feature.

6. International Data Transfers

Proalab Limited is based in New Zealand. Your data may be processed in other countries, including the United States and EU member states, through our sub-processors.

Where we transfer data from the EU/UK, we rely on Standard Contractual Clauses (SCCs) or applicable adequacy decisions.

7. Your Rights

All users: access, correct, delete your data; withdraw consent.

EU/UK (GDPR / UK GDPR): restrict or object to processing; data portability; lodge a complaint with your national supervisory authority.

California (CCPA/CPRA): know what’s collected and how it’s used; request deletion; opt out of “sale or sharing.”

We use advertising identifiers for campaign attribution, which may qualify as “sharing” under CCPA/CPRA. Opt out by disabling tracking permissions on your device, or by contacting us (Section 13).

Other jurisdictions: we comply with applicable laws in Canada (PIPEDA), Brazil (LGPD), Australia, New Zealand, and other markets where we operate.

To exercise any right, contact us using the details in Section 13. We respond within 30 days and may require identity verification.

8. B2B and Team Accounts

When an organization subscribes to MyWay for its employees or contractors:

• The organization is the data controller for its users’ data.
• Proalab Limited acts as a data processor, processing solely on the organization’s instructions.
• Organization admins may access, export, or delete data belonging to users within their org.
• Organizations may request a Data Processing Agreement (DPA) — see Section 13.

9. Children’s Privacy

The Service is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from minors. Contact us if you believe we have, and we will delete it promptly.

10. Security

We use encryption in transit (TLS) and at rest, access controls, and regular security reviews. No system is 100% secure.

11. Data Breach Notification

In the event of a personal data breach, we will notify affected users and relevant supervisory authorities without undue delay, and no later than 72 hours where required by GDPR.

12. Changes to This Policy

Changes are posted here with an updated effective date. For material changes, we notify users via email or in-app notice at least 14 days before they take effect.

13. Contact

Proalab Limited

Email: info@mywayroute.com

Website: mywayroute.com