Privacy policy — ASG Mobile and the DeCA portal

1. Controllers and contact #

Depending on the data, the controller is ASGTRANS or the client company that provides it:

• Each client company is the controller of the data it enters or sends for its own business: its DeCAs and route sheets, with the parties, vehicles and drivers; its imports, its address book and its external DeCAs; its drivers' delivery confirmations; the drivers and users it registers; and the driver-card data its drivers send to the DAC platform. ASGTRANS processes that data on the company's behalf, as its processor (Article 28 of the General Data Protection Regulation, GDPR), under its instructions and the contract between them.
• ASGTRANS is the controller of the data it processes on its own account to provide the service: user accounts and access; the security of the service (server logs, the audit trail, usage limits and error reports); the app's installation records and roadside look-ups; service e-mails; and the public download of each DeCA through its QR code, which the Resolution of 5 June 2026 requires.

If you are a driver or work for a client company, it is your company that must tell you how it processes your data. This policy describes what the service does with it, and your company may refer you to it.

ASGTRANS — Asesoría y Servicios Globales al Transporte, S.L., CIF B50953165, with its registered office at Polígono Industrial Ciudad del Transporte, Edificio Somport, local 56, 50820 San Juan de Mozarrifar (Zaragoza), Spain. You can write to us about this policy or your data at lopd@asgtrans.com, or by post to that address.

ASG Mobile and the DeCA portal are developed and operated on ASGTRANS's behalf by UAB Sistemium (Vilnius, Lithuania), as ASGTRANS's processor and, for client companies' data, as sub-processor.

2. What this policy covers #

This policy covers:

• ASG Mobile, the app for Android and iOS, in its two parts:
  • DAC: downloading the tachograph driver card and sending it to ASGTRANS's DAC platform, and client companies' access to that platform;
  • DeCA: the roadside look-up of DeCAs in progress, creating and amending DeCAs from a phone linked to a company, copies for offline use, and delivery confirmation;
• the DeCA portal (deca.asgtrans.com), where client companies create and manage their Electronic Administrative Control Documents (DeCA);
• the DeCA application programming interface (API), used by client companies' systems;
• the public download of each DeCA through its QR code, which the Resolution of 5 June 2026 requires.

It does not cover the asgtrans.com website or the commercial relationship with ASGTRANS, which are governed by our general privacy policy.

3. What data we process and where it comes from #

We do not process special categories of data, such as health data.

3.1 ASG Mobile: the DAC part

• Driver card. The app reads the driver card's file (.ddd or .tgd) with a reader connected to the phone, or takes it from a file you choose. The file holds what the EU tachograph rules define: the driver's identification (card number, name and date of birth), their driving, rest and work activities, the vehicles used, where each working day started and ended, and the events and faults recorded.
• Sending it. When the file is read from a card, the app does not store it on the phone; when a file on the phone is chosen, the system file picker may leave a temporary copy. In both cases the app sends it to the DeCA server, which forwards it to ASGTRANS's DAC platform. The server keeps the file for at most 7 days, while it completes the transfer, and a record of the transfer with the card number and the file name.
• Client companies' access. A client company signs in with the user name and password of its DAC account. The password is not stored on the phone; only a session identifier, in the system's secure storage (Keychain on iOS, Keystore on Android), until signing out. In the app, the company sees its drivers, their activity reports and the infringements detected, and can add or edit drivers (first name, surname, DNI/NIE, card number, date of birth and e-mail address). These data are stored on ASGTRANS's DAC platform (portal.asgtrans.com), which keeps them for five years.

3.2 ASG Mobile: the DeCA part

• Installation registration. The first time a DeCA feature is used, the app registers with the server and receives an installation identifier. To register, it sends only the operating system (Android or iOS), its own version and the app's identifier.
• Roadside look-up. To find their DeCAs in progress, the driver enters their NIF, the company's NIF or CIF and the registration plate. The app sends them to the server, which returns the documents that match all three. To prevent abuse, the server keeps each look-up for 30 days, with those three details and the IP address only as irreversible cryptographic hashes. When a look-up finds documents, the audit trail also records the IP address and the device or browser identifier (User-Agent).
• Details remembered on the phone. After a look-up with results, the app remembers those three details on the phone for the next trip, and keeps copies of the documents for offline use. Copies of goods DeCAs do not contain the driver's NIF; copies of passenger route sheets contain the driver's name and NIF, because the document includes them. "Forget my details" deletes the remembered details, the saved route sheets and any pending delivery confirmations. Copies of goods DeCAs are replaced at each look-up and deleted when the app is uninstalled.
• Phone linked to a company. A company can link a phone with a single-use code. The server keeps the link: the installation, the name the company gives the phone, and when it was linked and unlinked. The audit trail records each link and unlink with the IP address and the User-Agent.
• Creating and amending DeCAs from the phone. A linked phone can create and amend its company's DeCAs, with the data in section 3.3. The audit trail records which phone did so, from which IP address, and the document's driver NIF.
• Address book. When a party's name or NIF is typed, the app sends what was typed to the server to suggest matches from the company's address book (section 3.3).
• Delivery confirmation. On delivering the goods, the driver can photograph the signed delivery note: up to three photographs, taken with the camera, never from the gallery. They may show the names, signatures and stamps of the people receiving the goods. The app removes the photographs' metadata, including any location, and the server removes it again on receipt. They are sent with the date and time, the driver's NIF and the plate from the look-up, the consignment confirmed and the installation. Until the server receives them they wait on the phone, excluded from backups; once received, they are deleted from the phone. In the portal, only the company's administrators and ASGTRANS's super administrator see them. They are never part of the DeCA's PDF and cannot be obtained through its QR code.
• Permissions. The app uses the camera, for delivery photographs, and on Android the USB port, for the card reader. It does not access location, contacts, the microphone or the photo gallery.

3.3 The DeCA portal and the API

• User accounts. For each user we keep their e-mail address, name, company, role, language, the date of their last sign-in and failed sign-in attempts. The password is kept only as an irreversible cryptographic hash. The data comes from the users themselves or from whoever invites them: the administrator of their company or ASGTRANS. Accounts are not deleted: when they are no longer needed, an administrator deactivates them.

• DeCA data. The company issuing a DeCA enters its data by hand, by importing a spreadsheet, from its own systems through the API, or from a linked phone:

  • the parties (for goods, the contractual shipper and the actual carrier; for route sheets, the carrier and the hirer): name or company name, NIF or CIF and, for goods, the address. When a party is a sole trader, these are a natural person's data;
  • the consignments: origin, destination, goods and dates;
  • the registration plates of the vehicle and, where there is one, the trailer, and the observations;
  • the driver's NIF, which the rules require to be recorded. It is never printed on the PDF of a goods DeCA; the PDF of a passenger route sheet prints the driver's name and NIF;
  • the history of amendments, with the previous values and the reason for each change, as the rules require;
  • the user who creates or amends each document.

  The driver's NIF is visible to the company's users with access to its documents, to the ASGTRANS staff who provide the service, and to the company's systems through their API keys.

• Imports. The rows of an imported spreadsheet are kept as imported, the driver's NIF included.

• Address book. Name, NIF or CIF and address of the company's counterparties, taken from its own documents or saved by its users.

• Audit trail. Who carried out each relevant operation (creating, amending or cancelling a document, linking a phone, viewing a delivery photograph…), when, from which IP address and with which device or browser. The company's administrators and ASGTRANS staff can consult it.

• API keys. The name, prefix and date of last use of each key; the key itself is kept only as a hash.

• E-mails. The portal sends invitations, with the quick-start guide, password-reset links, and notices of a change of address, to both the old and the new address. We keep a record of each message for 90 days: recipient, type and outcome. If a message cannot be delivered, the technical notice also reaches UAB Sistemium and ASGTRANS's technical contact.

3.4 The public download of a DeCA

• Anyone with a DeCA's QR code or link can download its PDF without identifying themselves, as the Resolution of 5 June 2026 requires so that the authorities can check it at the roadside. The issuing company shares the code or the link with the driver and the other parties to the transport.
• The link works during the service and, by default, for up to 14 days after it ends (ASGTRANS can set a period of between 7 and 30 days for each company); if the document is cancelled, it stops working at once. After that, only the company's users can consult it.
• The PDF of a goods DeCA shows the parties, the consignments, the registration plates and the history of changes; never the driver's NIF or the user who issued it. The PDF of a passenger route sheet shows the driver's name and NIF.
• We count how many times each document is downloaded and when it was last downloaded.

3.5 Technical data

• Server logs. Like any web server, the DeCA server records each request: the IP address, the date and time, the address requested without its search terms, the result and the User-Agent.
• Error reports. When ASG Mobile or the server hits an error, a technical report is sent to Sentry to diagnose it: the error, the app version, the phone's model and operating system, a random installation identifier and, for a sample of operations, how long they took. Reports do not include names, NIFs, registration plates, passwords or the content of requests, and we do not store the user's IP address. In the reports of app versions before 0.7.29, Sentry can derive an approximate location (the country or the city) from the phone's connection.
• ASG Mobile contains no analytics, advertising or tracking tools.

4. Why we process the data, and on what legal basis #

A DeCA's data is required by law: without it, the DeCA cannot be issued. An account's data is necessary to use the portal.

For the data a client company provides, the bases in the table are that company's, as controller; ASGTRANS processes the data as its processor.

No processing is based on consent. You can object to processing based on legitimate interest (section 8). We take no automated decisions about people and build no profiles.

5. Recipients and processors #

• UAB Sistemium (Lithuania), ASGTRANS's processor and, for client companies' data, sub-processor, develops, maintains and operates the service.
• Amazon Web Services hosts the service in ASGTRANS's account, in its Spain region; e-mails are sent from its Ireland region.
• Functional Software, Inc. (Sentry) receives the error reports (section 3.5) and hosts them in its European Union region, in Germany.
• The transport inspection authorities download the DeCA through its QR code. We will disclose data to other authorities or to the courts only when a law requires it.
• Apple and Google distribute the app in their stores and process the data of their own relationship with you as independent controllers, under their own policies.

Every provider that processes data on our behalf does so under a processing contract (Article 28 GDPR) that binds it to protect the data as this policy describes. We do not sell data or pass it on for advertising.

6. International transfers #

The data is hosted in the European Economic Area: in Spain (the service), Ireland (e-mail) and Germany (error reports). UAB Sistemium processes it from Lithuania. Amazon Web Services and Sentry belong to groups based in the United States; if the data were accessed from there, the transfer would rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

7. How long we keep the data #

We keep documents and other data while the client company uses the service, subject to the minimum periods the law requires. When a company leaves the service, ASGTRANS keeps the data the law requires it to keep and orders its deletion once those periods have ended.

8. Your rights #

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability with the controller of your data (section 1):

• If your data appears in a client company's documents or on its DAC platform, for example as a driver or as a party to a DeCA, contact that company. If you write to us, we will pass your request on and help it respond.
• For the data ASGTRANS processes on its own account, write to us at lopd@asgtrans.com or by post to the address in section 1, with a copy of a document proving your identity. We will reply within one month.

Some data cannot be erased while the law requires it to be kept; for example, a DeCA during its legal retention period.

On the phone you can delete your data yourself: with "Forget my details" in the DeCA look-up, by signing out of DAC, or by uninstalling the app.

If you consider that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es; C/ Jorge Juan, 6, 28001 Madrid).

9. Security #

• Communications are encrypted (HTTPS with TLS 1.2 or higher), and the data is stored encrypted on the servers.
• Passwords are kept only as irreversible cryptographic hashes.
• Each company sees only its own documents and, within it, each user what their role allows. The driver's NIF is never printed on a goods DeCA's PDF, and delivery photographs are seen only by the company's administrators and ASGTRANS's super administrator.
• On the phone, credentials are kept in the system's secure storage, and DeCA data is not included in backups.
• An audit trail records who creates or amends each document.

10. Cookies and local storage #

The DeCA portal uses a single cookie, deca_refresh, which keeps your session open for up to 30 days and is sent only to the portal itself. It also keeps four items in your browser: that you have a session open, the language, the theme (light or dark) and, for ASGTRANS staff, the company they are working in. They are technical and strictly necessary for the service you request, so they need no consent (Article 22.2 of Spanish Law 34/2002, LSSI-CE). The portal uses no analytics or advertising cookies and loads no third-party content, and neither do these pages.

ASG Mobile uses no cookies. It keeps on the phone what section 3 describes: the DAC session identifier, the installation identifier, the remembered look-up details, copies of documents and pending delivery confirmations.

11. Changes to this policy #

The top of this page shows its version and the date of its last update. If we change anything important, we will announce it in the portal and in the app.