INOS Navigation – Privacy Policy

This privacy policy explains how the INOS Navigation app for Android, including its Android Auto experience, collects, uses, shares and protects personal data, and the choices and rights you have. INOS Navigation is a business app for field drivers who carry out drive routes for telecom network operators and their contractors.

Contents

1. Who we are
2. Scope of this policy
3. Data we collect and why
4. How we use your data
5. Legal bases for processing
6. Who receives your data
7. No selling, no advertising
8. Security
9. How long we keep data
10. Deleting your data and your rights
11. Children
12. International transfers
13. Changes to this policy
14. Contact us

1. Who we are

INOS Navigation is provided by DIGIS SQUARED LIMITED, trading as Digis Squared (also written Digissquared; DIGIS2), D-U-N-S number 221964287 ("Digis Squared", "we", "us" or "our").

• Address: Wimbledon Business Centre, London, SW19 8YB, United Kingdom
• Email: [email protected]

We provide INOS Navigation to telecom operators and their contractors (in this policy, "your organisation") so that their drivers can carry out drive routes. Your organisation creates your account, assigns your routes and decides how the results of your drives are used.

Our role. For the account, route, drive and message data processed to provide INOS to your organisation, your organisation is usually the controller under the UK General Data Protection Regulation (UK GDPR), and we process that data on its behalf as a processor, following its instructions and our agreement with it. Your organisation's own privacy notice also applies to that data, and you can contact your organisation directly about it.

We are the controller for the device-management data described in section 3.5. The app registers the device with our device-management service after a driver signs in and allows location, and we decide how that service works and who can use it. We are also the controller for crash reporting, for keeping the app and our servers secure and working, and for responding to your privacy requests.

2. Scope of this policy

This policy covers:

• the INOS Navigation app for Android phones and tablets, whether installed from Google Play or provided to you directly by your organisation;
• INOS Navigation on Android Auto (the car display); and
• the INOS and device-management servers the app connects to, as far as they process data from the app.

It does not cover other Digis Squared products or websites, or how your organisation uses INOS data in its own systems. Those are covered by their own privacy notices.

3. Data we collect and why

The table below summarises what the app collects. The sections that follow give the details. "Our INOS server" means the INOS server environment your organisation uses, which is selected on the app's sign-in screen.

3.1 Account and sign-in information

• To sign in, you enter the work email address and password your organisation gave you. They are sent to our INOS server to check them. The app does not store your password.
• When you sign in, our server returns your profile: your name, email address, user ID, phone number (if your organisation entered one), role, organisation account ID and a session token. The app stores these on your device so you stay signed in, shows your name, email address and phone number on the Account screen, and uses the token to authenticate its requests to our server.
• Your role and organisation account ID are stored on the device but not displayed. The app does not send your phone number, role or organisation account ID to our servers or service providers.
• If you choose a profile picture, you pick one of the app's built-in avatars. Your choice is stored only on your device.
• The app cannot create accounts. Accounts are created and managed for your organisation.
• On Android Auto you are asked to sign in on your phone. The car display never asks for your password.

3.2 Location

The app uses your device's precise location (GPS, assisted by Wi-Fi and mobile network information through Google Play services on your device). After you sign in, the app needs precise location permission: if you deny it, or allow only approximate location, you cannot use the app, including messages; you can only sign out. Two parts of the app use location: driving and guidance, and device management.

After you sign in, and before Android asks for any location permission, the app shows a screen explaining what location it uses, including in the background, why, and where it is sent. It does this on every Android version, and once more after an update from an app version without this screen, even if location is already allowed. On Android 10 and later, drivers must also allow background location (location access "all the time"). On Android 11 and later, Android takes you to the app's settings for this, where you choose "Allow all the time". The screen cannot be skipped: until you allow it, you cannot use the app, and on Android Auto the car display asks you to allow it on your phone instead of showing your routes. On Android 9 and older, Android has no separate background location permission, so location permission alone covers this.

Driving and guidance

• When: while a route is open, on your phone or on Android Auto: from when you open the route's map until you have left it with no drive in progress, or until you sign out on your phone (a route open on Android Auto stays open until you leave it there). This includes before you start driving and while guidance to the route's start point is running. The app takes a location reading about once a second while you drive. Before you start, it takes about two a second while the route's map is on screen (on your phone or the car display) or guidance is running, and about one every 15 seconds when the app is in the background or the screen is off, for up to about 10 minutes (see below).
• In the background: while a route is open, the app keeps taking location readings when the screen is off or you switch to another app. Guidance to the route's start point continues until you arrive or end it, and a drive continues until you stop it. If neither is running, readings stop about 10 minutes after the route's map leaves the screen. A notification showing the route name is displayed for as long as this continues, with progress and GPS status while you drive or follow guidance. It stops once you have left the route's map screen and no drive is in progress, or when you sign out on your phone, unless the route is still open on Android Auto.
• Path you drive: the latitude and longitude of the points you drive along a route are sent to our INOS server with the route ID and your user ID. They are saved automatically every few points during a drive and again when you stop. Speed, accuracy, heading and a time for each point are not sent with the path.
• Live position for operators: if one of your organisation's operators opens a live view of your drive in the INOS web platform, the app sends your current latitude and longitude and the route ID to our INOS server with each location update while you are driving. Once a live view has started, this applies to every drive you start until you close the drive's map screen. Our server passes these live positions to the operator's view and does not save them as a location history.
• Off-route alerts: the operator's live view shows an alert if you move away from the planned route. If that operator has linked a Telegram account to INOS, our server also sends the alert to the operator through Telegram, with your name, the route name, your distance from the route and a map link to your position (see section 6).
• Sequence map mode (if selected in Settings): the app sends your position, with the route ID, to our INOS server each time you reach the next point on the route.
• Directions and maps: to calculate guidance to a route's start point, the app sends Mapbox your current position and heading, the start point and the language for spoken instructions. It does this when guidance starts and each time the route is recalculated, which can be as often as every 10 seconds while you are away from the suggested route. Map tiles are downloaded from Mapbox for the area shown on the map. See section 6.
• On your device: drive locations are held only in the app's memory and are cleared when the drive ends. They are not saved to storage, except in the diagnostics log if you choose to export it (section 3.7).

Device management

• The device-management service (section 3.5) takes a location reading about once a minute and reports the latest location to our device-management server about every 30 seconds by default. Administrators can change these intervals.
• Device management starts reporting only after a driver has signed in, seen the explanation screen and allowed location (see above). It stops when you sign out.
• Android 10 and later: because drivers must allow location access "all the time" (see above), this continues when the app is closed or not in use. If background location is withdrawn later, device management receives location only while the app is open on screen.
• Android 9 and older: Android has no separate background location permission. Because drivers must allow location after signing in, device management reports location in the background, including when the app is closed or not in use, whenever device management is running. There is no separate request for background location; the explanation screen covers it.
• While the app can use location in the background, Mapbox telemetry may also collect location data in the background (see section 6.1).

Your choices: you can change location permissions at any time in Android Settings, but drivers need them to use the app. On Android 10 and later, if you withdraw background location, the app shows its explanation screen again when you return to it, and you cannot use the app until you allow location access "all the time" again; until then, device management receives location only while the app is open on screen. If you withdraw location permission completely, you cannot use the app until you allow it again, because it needs precise location. On Android 9 and older, the only ways to stop device management from reporting location are to withdraw location permission or uninstall the app.

3.3 Drive and route data

• The routes your organisation assigns to you are downloaded from our INOS server.
• When you select a route, on your phone or on Android Auto, the app tells our server which route you selected.
• For each route, the app sends your progress (percentage complete, and how many route points you have matched out of the total) and a summary of each drive session (a label, the date, the number of points recorded, the percentage, the duration and which part of the route it covered). Session summaries do not contain coordinates.
• This data is linked to your user ID and the route ID, so that you can resume routes and your organisation can see what was driven and when.
• Reset route on a route card works only for a route with a saved path. It deletes that path from our server and overwrites the route's progress and session history with empty values. If no path has been saved for the route, nothing is changed on our server.

3.4 Messages with operators

• You can exchange text messages of up to 2,000 characters with your organisation's operators. The app does not support attachments, photos or voice messages.
• Messages go through our INOS server, which stores them and their read status (when messages have been read) so both sides can see the conversation.
• On your device, the app keeps your messages (text, sender type and name, time, delivery and read status), including messages waiting to be sent, in a local database until you sign out or uninstall the app. After you sign in, the latest 50 messages are loaded.
• Message notifications show the operator's name and the message text. Whether they appear on your lock screen depends on your device settings.
• You can reply from a notification or on Android Auto. In the car, Android Auto and Google services on your phone turn your spoken reply into text; the app receives only the text. The app does not have microphone permission and never records audio.
• While you are signed in, the app keeps a live connection to our INOS server to receive messages. While it is connected, our server can see that your device is online and its IP address. Because the device-management service keeps the app running, this connection can stay open in the background.

3.5 Device management (device information, identifier and background location)

INOS Navigation includes Digis Squared's device-management service, Pulse, which we use to manage, locate, secure and support the devices the app is installed on. It works separately from your INOS account:

• The device is registered with our device-management server the first time a driver signs in, has seen the location explanation screen and has allowed location. Nothing is registered or sent before that.
• Digis Squared runs device management for the organisations it provides INOS to, so that the work devices drivers use can be located, supported and kept secure, including at your organisation's request (the app's explanation screen describes this as your employer locating and managing the device). Every installation is registered to the same device-management group, which Digis Squared administers; the registration itself is not linked to your INOS account.
• It starts reporting once a driver has signed in, seen the location explanation screen and allowed location (section 3.2). It then keeps running in the background, including when the app is closed, while a persistent "Device management is on" notification is shown. On Android 13 and later, the explanation screen also asks you to allow notifications, and device management runs only while notifications are allowed for the app, so its notification is visible whenever it runs. You can use INOS Navigation without allowing notifications. After the device restarts, device management starts again the next time you open the app's main screen or the app is updated.
• It stops when you sign out, and starts again when a driver next signs in. If an administrator removes the device from management, it stops until a signed-in driver next opens the app, when the device registers again. It stops for good when you uninstall the app. While you are signed in, the app gives you no other way to switch it off.
• What device management sends does not include your name, email address or user ID, and it cannot access files, messages or other apps on the device. A work device is usually used by one person, so device-management data can still relate to you.

While device management is running, the app sends:

• Device details: manufacturer, brand, model and device code name, Android version, API level and security patch level, screen size and density, and the device-management software version.
• Device identifier: the Android ID. It does not collect the IMEI, the hardware serial number, your phone number, SIM serial number or subscriber ID (IMSI).
• Location: latitude, longitude, accuracy, speed, heading, altitude, the location source and the time of the reading, as described in section 3.2.
• Battery: level, whether it is charging and from what source, temperature and voltage.
• Storage and memory: total and free internal storage, and total and available memory.
• Network: connection type (Wi-Fi, mobile, ethernet or none); when on Wi-Fi, the Wi-Fi signal strength (not the network name); the name and code (MCC-MNC) of the mobile network the device is connected to; and mobile signal quality measurements (for example 4G or 5G signal strength).

Our device-management server also records the IP address the device connects from. Authorised administrators can:

• ask the device to report its current location or its device details, on request or on a schedule they set;
• set up areas on a map (geofences) and record an alert each time the device enters or leaves one, based on the locations the device reports;
• have the device-management server notify other systems they set up about device events, such as the device's name, model and group, when it comes online or goes offline, low battery, and when a command has finished (these notifications do not include location). Depending on the address an administrator sets, these notifications may not be encrypted;
• generate reports from device-management data, such as device lists with identifiers, device status and alerts;
• make the device sound an alarm, to help find it;
• change how often it reports; and
• remove the device from management.

Device management cannot list, read or upload files, see which apps are installed, open, install or remove apps, take screenshots, read the system log, run commands, restart, lock or reset the device, or access your contacts, SMS, call history, camera or microphone. Device-management data is sent from the app over an encrypted (HTTPS/WSS) connection to servers operated by Digis Squared, and is used only to manage, locate, secure and support the devices the app is installed on.

3.6 Crash reports and diagnostics (Bugsnag)

We use Bugsnag, a service of SmartBear Software, to find and fix problems in the app. Bugsnag starts when the app opens and sends:

• Crash and error reports when the app crashes, stops responding or hits a native error: technical error details and the state of the app's threads at the time.
• Recent app events leading up to a crash, recorded automatically: screens opened, the app moving between foreground and background, screen orientation changes, network connectivity changes, some system events (for example power or battery changes) and low-memory warnings.
• Device information: manufacturer, model and brand, Android version, language and region settings, processor type, screen size and density, memory and storage usage, battery level and charging state, whether the device is rooted or an emulator, network type, whether location services are switched on (not your location), orientation and the time.
• App information: app version and build, which screen was open, how long the app had been running, and whether it was in the foreground.
• Session information each time the app is brought to the foreground, used to calculate how often the app crashes.
• Identifiers: random identifiers that Bugsnag creates for this installation of the app and keeps on the device (one of them is also used as an anonymous user ID in reports), and the IP address the reports are sent from. These identifiers do not contain your name or contact details, but they are persistent, so they are pseudonymous personal data rather than anonymous data.

The app does not send your name, email address, user ID, location coordinates or message content to Bugsnag. Error details may occasionally include technical text returned by our servers. Reports that cannot be sent straight away are kept on the device until they are delivered.

3.7 In-app diagnostics log

• During a drive, the app keeps a temporary technical log in memory to help troubleshoot navigation. It holds up to 8,000 entries and restarts at each new drive. It contains every raw location reading (position, accuracy, speed, heading and time), navigation events, the planned route's ID, name and shape, the device manufacturer, model and Android version, the app version, and a random session ID.
• The log stays on your device unless you open Logs on the map and choose Copy all or Share as file. It then goes to your clipboard or to the app you choose (for example, email to your support contact). We only receive it if you send it to us.
• A shared file stays in the app's cache until Android clears the cache, you clear the app's data or you uninstall the app.
• The app also writes technical messages, which can include location and route IDs, to the Android system log. Other apps cannot read the system log, but it can be included in a bug report you create on the device.

3.8 Android Auto, voice guidance and notifications

• Android Auto: the car display offers the same drive features, using your phone's location and your phone's connection to our servers. The app does not read any data from your car, such as its speed, mileage or fuel level. Route details, guidance instructions and message notifications are passed to the Android Auto app on your phone so they can be shown on the car display and read aloud. Android Auto is provided by Google under Google's own terms and privacy policy.
• Voice guidance: spoken instructions are produced by the text-to-speech engine on your device, from instruction text supplied by Mapbox directions. No audio is recorded or sent. Your mute setting is stored on your device.
• Notifications: all notifications are created on your device. The app does not use a push messaging service or push token. It shows notifications for drive progress, messages, device management and, if the app was installed outside Google Play, app updates.

3.9 Settings and other data stored on your device

• Your chosen INOS server, language, map mode, map theme, dark mode, zoom level, 3D view and voice mute settings, whether you have seen the introduction screens and the location explanation screen, and which location permissions the app has already asked for. These stay after you sign out, until you clear the app's data or uninstall the app.
• Map data cached by the Mapbox software, and an identifier that Mapbox creates for this installation (see section 6.1).
• Device-management settings: the server address, the device's management ID and secret, and the reporting intervals.
• Bugsnag's installation identifiers and any crash reports waiting to be sent (section 3.6).
• Android backup: if backup is switched on for your device, Android may include some of this app's data in your device backup in your Google account. This can include your local message history, some settings, the device-management ID and secret, and Bugsnag's installation identifiers. Your session token and profile details are excluded from that backup. If a backup is restored to another device, that device may take over this device's device-management registration. When you move to a new device using Android's device-to-device transfer, more of the app's data may be copied, which can include your sign-in details. Backups are handled by Google under its own terms and your backup settings, and a backup copy may remain in your Google account after you uninstall the app.

3.10 App updates (only if installed outside Google Play)

If your organisation installed INOS Navigation directly rather than through Google Play, the app may check Digis Squared's update server about every six hours for a new version and download it over an encrypted connection. No account, device or location information is sent; the server sees only your IP address and standard technical request details. Downloaded update files are deleted after installation or when replaced. The Google Play version does not do this; it is updated through Google Play.

3.11 Android permissions

3.12 What the app does not collect

The app does not access your contacts, photos or media, camera, microphone, SMS or call history, calendar, accounts on the device, browsing history, financial information or health data, and it does not use the Android advertising ID. The app's software package also includes Google Firebase Analytics and Crashlytics libraries, but they are not configured or switched on and do not collect or send any data.

4. How we use your data

We use the data described above to:

• provide the app: signing you in, showing your routes, recording drives, guidance and maps, messages and Android Auto;
• let your organisation manage its drive work: see which routes were driven and how far, see your position live and receive off-route alerts when an operator opens a live view, and communicate with you;
• manage, locate, secure and support the devices the app is installed on (device management), including geofence alerts set up by administrators;
• keep the app working: find and fix crashes and troubleshoot problems;
• protect accounts, devices and our systems, and prevent and investigate fraud or misuse; and
• respond to your requests and meet our legal obligations.

We do not use your data for advertising or marketing, and we do not use it to make automated decisions that have legal or similarly significant effects on you. Your organisation may use the drive data it receives under its own policies.

5. Legal bases for processing

Under UK GDPR, each use of personal data needs a legal basis.

Separately from these legal bases, Android asks for your permission before the app can use location (including background location on Android 10 and later) or show notifications, and you can change these permissions at any time in Android Settings. Where we rely on legitimate interests, you have the right to object (see section 10).

6. Who receives your data

• Your organisation: your account details, routes driven, progress and session summaries, your live position and off-route alerts when an operator opens a live view, and your messages.
• Device-management administrators: device-management data is available to authorised Digis Squared staff. Where we agree it with your organisation, its administrators may also be given access to the devices used for its work. Administrators can send device event notifications to other systems they set up (section 3.5).
• Digis Squared servers: the INOS servers and the device-management server are operated by us. They are hosted by infrastructure providers, including OVHcloud, and some of them are reached through Cloudflare's network. These providers act on our instructions.
• Bugsnag (SmartBear Software, United States): crash and error reports, as described in section 3.6. See SmartBear's privacy policy.
• Mapbox (Mapbox, Inc., United States): maps and directions. When the app shows a map, Mapbox receives requests for map tiles for the area shown (usually around you) and your IP address. During guidance to a route's start point, Mapbox receives your current position and heading, the start point and the instruction language each time the route is calculated. See Mapbox's privacy policy, and section 6.1 below for Mapbox telemetry.
• Telegram (only if an operator has linked it): if one of your organisation's operators has linked a Telegram account to INOS, our server sends that operator a Telegram message when their live view shows you have moved away from the planned route. The message contains your name, the route name, your distance from the route and a map link to your position. Telegram delivers and stores it under Telegram's privacy policy, and it stays in the operator's Telegram chat until it is deleted there.
• Google: some Android features the app relies on are provided by Google, such as location from Google Play services, Android Auto, Android backup and distribution through Google Play. Google processes data for these features under the Google Privacy Policy. The app does not send data to Google Analytics or Firebase.
• Others, where necessary: professional advisers; law enforcement, regulators or courts where the law requires it or to protect rights and safety; and a buyer or successor if our business is reorganised or sold, subject to confidentiality.

Our hosting providers, Bugsnag, and Mapbox for maps and directions may use your data only to provide their services to us. The exception is Mapbox telemetry (section 6.1), which Mapbox uses for its own purposes. Telegram and Google process data under their own terms.

6.1 Mapbox telemetry

The Mapbox software in the app currently has Mapbox's telemetry feature switched on, which is Mapbox's default setting. With telemetry on, Mapbox may collect information about map use and your device, such as an identifier Mapbox creates for this installation of the app, battery level and charging state, mobile network type, whether the app is in the foreground or background and map loading events. Because the app has location permission, Mapbox may also collect location data, which Mapbox says it de-identifies. This is not limited to drives: the device-management service keeps the app running in the background, so while the app can use location in the background (see section 3.2), Mapbox may collect location then too. Mapbox uses telemetry for its own purposes, such as improving its maps, traffic and navigation services, as described in Mapbox's privacy policy. Where the Mapbox information (i) button is shown on the phone's map, you can use it to opt out of Mapbox telemetry; it is not available on the Android Auto display. Mapbox still receives the basic usage events it needs to bill for its services when telemetry is off. Mapbox collects and uses this data in accordance with the Mapbox Product Terms, the Mapbox data processing addendum and Mapbox's privacy policy.

7. No selling, no advertising

• We do not sell or rent your personal data.
• The app contains no advertising and no advertising software.
• The app does not use the Android advertising ID and does not track you across other companies' apps or websites.
• We do not use your data for marketing.

8. Security

We take the following steps to protect your data:

• Encrypted in transit: the app connects to our INOS servers (signing in, including your email address and password, your session token, location and drive data, live position and messages), the device-management service, Mapbox, Bugsnag and our update server over encrypted HTTPS or WSS connections. The Google Play version cannot make unencrypted connections at all. Copies installed outside Google Play (section 3.10) can also list an internal development server on the sign-in screen that does not use encryption; it is for testing and is not used for your organisation's work. Each managed device authenticates to the device-management service with its own secret.
• On your device: app data, including your session token, is kept in the app's private storage, which Android's app sandbox protects from other apps. The app does not add its own encryption to this data. Your password is never stored on the device.
• On our servers: access to data requires an authorised account, and requests to our INOS API include your session token.

No system is completely secure. If you think your account or device has been compromised, or you want to report a security concern, email [email protected].

9. How long we keep data

We may keep data for longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

10. Deleting your data and your rights

10.1 Deleting your account and data

Your INOS Navigation account is created by your organisation, so the app does not have a delete-account button. To have your account and its data deleted:

• ask your organisation's INOS administrator; or
• email [email protected] with the subject "INOS Navigation – delete my data", giving the email address you use to sign in and the organisation you drive for.

For data we process on your organisation's behalf (your account details, driven paths, progress and session records, and messages), we will pass your request to your organisation and delete the data on its instructions. For data we control, such as the device-management records for your device and crash reports we can link to it, we will delete it ourselves after verifying your request. If any data must be kept for legal reasons, we will tell you what and why.

In the app, you can also:

• Sign out: removes your account details, session token and message history from the device. It also stops device management on the device. It does not delete data on our servers.
• Reset route: for a route with a saved path, deletes that path from our server and empties the route's progress and session history (section 3.3).
• Change permissions: withdraw notification, background location or location permission in Android Settings. Without background location (Android 10 and later), or without location permission, you cannot use the app until you allow it again.
• Uninstall the app: stops all data collection by the app, including device management, and removes the data stored by the app on your device. A copy in your Android backup may remain in your Google account (section 3.9), and data already on our servers is kept as described in section 9 until it is deleted.

10.2 Your rights

Under UK data protection law, and similar laws in other countries, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict how your data is used;
• object to processing based on legitimate interests;
• receive data you provided in a portable format; and
• withdraw any consent you have given, without affecting earlier processing.

To exercise these rights, email [email protected]. We will need to verify your identity, and we will reply within one month (this can be extended by up to two further months for complex requests, in which case we will tell you). Where your organisation is the controller, we will pass your request to it and help it respond, and you can also contact your organisation directly.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority where you live or work. We would appreciate the chance to deal with your concern first.

11. Children

INOS Navigation is a business app for adult drivers. It is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has used the app, contact us and we will delete the data.

12. International transfers

Digis Squared is based in the United Kingdom. Depending on the INOS environment your organisation uses and the services involved, your data may be processed in:

• the United Kingdom and the European Economic Area (for example OVHcloud data centres);
• the United States (Bugsnag and Mapbox);
• the region of your organisation's INOS environment, where your organisation uses a regional environment (for example in Saudi Arabia);
• other countries where our network provider operates; and
• for off-route alerts sent through Telegram, the countries where Telegram operates.

When we transfer personal data outside the UK to our service providers, we make sure it is protected as UK law requires, for example by relying on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Telegram messages are delivered through Telegram's service under Telegram's own terms. You can ask us for more information about these safeguards.

13. Changes to this policy

We may update this policy when the app or our practices change, for example when we change how the app uses third-party services. We will publish the updated policy on this page and change the date at the top. If a change is significant, we will also tell you through the app, through your organisation or by another appropriate means.

14. Contact us

For questions about this policy or your data, or to make a request, contact: