Privacy Policy

NexOS Driver App by NexDash Autonomy GmbH

Last updated: 2026-10-28

Who This Policy Covers

This policy covers the NexOS Driver app. Drivers use it for work. They work for NexDash Autonomy GmbH or one of its subsidiaries.

Who Is Responsible and How to Reach Us

NexDash Autonomy GmbH operates NexOS and is the controller of your data:

NexDash Autonomy GmbH
Kantstr. 30
10623 Berlin, Germany
Email: privacy@nexdash.com

• For drivers of a subsidiary, the subsidiary is your employer.
• Write to the address above with any privacy question or to use any right in this policy.
• No data protection officer is published.

What We Collect

The app collects these categories of data. They come from you, your employer and the vehicle systems of your truck:

• Location. Your precise location while you use the app. Your location in the background while a route is active or navigation runs. You can switch location off in your device settings.
• Account and contact data. Your name, your email address and your sign-in data.
• Photos, voice and messages. Only what you choose to send.
• Device identifiers. They let us send you push notifications.
• Diagnostics. Crash data and error reports.
• Work records. Personnel data and documents, working, driving and rest times, vehicle and tachograph data linked to you, vehicle reports and checks, and attendance and performance records, including absence reasons.

You must give the data needed for your account and for your employment. Without it we cannot give you access or check your licences before a tour.

What We Do Not Do

We do not sell your data. We do not use it for advertising. We do not track you across the apps or websites of other companies.

Why We Process Data and the Legal Basis

• Art. 6(1)(b) GDPR: carrying out your employment relationship and giving you the tools for your work.
• Art. 6(1)(c) GDPR: a legal obligation, such as the law on driving and rest times (Regulation (EC) No 561/2006) and the check that a driver's licence and driver card are valid.
• Art. 6(1)(f) GDPR: legitimate interests of ours and of your company, which your interests do not override: running, securing and improving NexOS; translation and an AI assistant; finding data errors and vehicle faults; understanding the energy use of electric trucks; and letting customers follow their delivery.
• Employment law and health data: we apply Art. 6(1) GDPR directly. Where Sec. 26 BDSG also applies, it applies in addition. We do not rely on Sec. 26 BDSG alone. The absence reason “sick” is health data. We process it under Art. 9(2)(b) GDPR together with Sec. 26(3) BDSG.
• Consent: we do not rely on your consent, with one exception. A company that switches on copies of ID cards and driving licences, which is off by default, must hold the holder's documented consent.

Who Receives Data

Authorised staff of your employer and of NexDash see your data as far as their role allows. These categories of outside recipients also receive data:

• Hosting and IT service providers.
• Sign-in providers.
• Map, font, routing and navigation providers.
• AI service providers for translation, speech and the assistant.
• Messaging, notification and error-reporting providers.
• Customers of the carrier, who see the position and expected arrival of the truck that carries their shipment. The position comes from the truck, not from your phone.

A list of our service providers is available on request at privacy@nexdash.com.

Transfers Outside the EU and EEA

Several of our providers are in a country outside the EU and the EEA, including the USA, or process data there. Most are covered by an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework, or by standard contractual clauses. Details are available at privacy@nexdash.com.

How Long We Keep Data

We keep data as long as we need it for its purpose and as long as the law requires. Most records stay while your account exists. When we no longer need data, we delete it or remove your name from it, unless a law requires us to keep it.

• Records of your use of NexOS: 90 days.
• Messages: 365 days.
• Server and security logs: up to 90 days.

Deleting Your Account

To delete your account and its data, open Settings in the app and choose “Delete account”. You can also write to privacy@nexdash.com.

Automated Decisions and Profiling

NexOS makes no decision about you by automated means alone with a legal or similarly significant effect, except three. By default it approves a vacation request when there is no conflict, and never declines one. It refuses a tour assignment if your employment has ended or your licence or driver card expires before departure. It compares your energy use with an expected figure to calculate a bonus amount that managers see (profiling). You can ask a person to review any of these decisions, state your view and contest it (Art. 22(3) GDPR).

Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), notification of recipients (Art. 19) and portability (Art. 20). You can object (Art. 21), ask for human review of an automated decision (Art. 22) and complain to a data protection authority (Art. 77).

To use any right, write to privacy@nexdash.com. We answer within one month, or within three for a complex request, free of charge (Art. 12 GDPR).

Your Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interests (Art. 21(1) and Art. 6(1)(f) GDPR). We then stop that processing unless we show compelling legitimate grounds that override your interests, or it serves to establish, exercise or defend legal claims.

Write to privacy@nexdash.com and say which processing you object to. No particular form is needed. We do not use your data for direct marketing.

Complaints

You can complain to the supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin

Changes to This Policy

The date of the latest version is at the top of this page. If we add a purpose, a recipient or a transfer, we tell you before the change applies (Art. 13(3) GDPR).