INOS Navigation – Privacy Policy

This privacy policy explains how the INOS Navigation app for Android, including its Android Auto experience, collects, uses, shares and protects personal data, and the choices and rights you have. INOS Navigation is a business app for field drivers who carry out drive routes for telecom network operators and their contractors.

Contents

1. Who we are
2. Scope of this policy
3. Data we collect and why
4. How we use your data
5. Legal bases for processing
6. Who receives your data
7. No selling, no advertising
8. Security
9. How long we keep data
10. Deleting your data and your rights
11. Children
12. International transfers
13. Changes to this policy
14. Contact us

1. Who we are

INOS Navigation is provided by DIGIS SQUARED LIMITED, trading as Digis Squared (DIGIS2), D-U-N-S number 221964287 ("Digis Squared", "we", "us" or "our").

• Address: Wimbledon Business Centre, London, SW19 8YB, United Kingdom
• Email: [email protected]

We provide INOS Navigation to telecom operators and their contractors (in this policy, "your organisation") so that their drivers can carry out drive routes. Your organisation creates your account, assigns your routes and decides how the results of your drives are used.

Our role. For the account, route, drive and message data processed to provide INOS to your organisation, your organisation is usually the controller under the UK General Data Protection Regulation (UK GDPR), and we process that data on its behalf as a processor, following its instructions and our agreement with it. Your organisation's own privacy notice also applies to that data, and you can contact your organisation directly about it.

We are the controller for the device-management data described in section 3.5. The app registers every installation with our device-management service, before anyone signs in and whether or not the app is then used for an organisation, and we decide how that service works and who can use it. We are also the controller for crash reporting, for keeping the app and our servers secure and working, and for responding to your privacy requests.

2. Scope of this policy

This policy covers:

• the INOS Navigation app for Android phones and tablets, whether installed from Google Play or provided to you directly by your organisation;
• INOS Navigation on Android Auto (the car display); and
• the INOS and device-management servers the app connects to, as far as they process data from the app.

It does not cover other Digis Squared products or websites, or how your organisation uses INOS data in its own systems. Those are covered by their own privacy notices.

3. Data we collect and why

The table below summarises what the app collects. The sections that follow give the details. "Our INOS server" means the INOS server environment your organisation uses, which is selected on the app's sign-in screen.

3.1 Account and sign-in information

• To sign in, you enter the work email address and password your organisation gave you. They are sent to our INOS server to check them. The app does not store your password.
• When you sign in, our server returns your profile: your name, email address, user ID, phone number (if your organisation entered one), role, organisation account ID and a session token. The app stores these on your device so you stay signed in, shows your name, email address and phone number on the Account screen, and uses the token to authenticate its requests to our server.
• Your role and organisation account ID are stored on the device but not displayed. The app does not send your phone number, role or organisation account ID to our servers or service providers. However, device-management administrators can retrieve the file in which the app stores your profile (see section 3.5).
• If you choose a profile picture, you pick one of the app's built-in avatars. Your choice is stored only on your device.
• The app cannot create accounts. Accounts are created and managed for your organisation.
• On Android Auto you are asked to sign in on your phone. The car display never asks for your password.

3.2 Location

The app uses your device's precise location (GPS, assisted by Wi-Fi and mobile network information through Google Play services on your device). The app needs precise location permission to open: if you deny it, or allow only approximate location, you cannot use any part of the app, including signing in and messages. Two parts of the app use location: driving and guidance, and device management.

Driving and guidance

• When: only while you are driving a route, while guidance to a route's start point is running, or while a drive map screen is open. The app takes a location reading about once or twice a second.
• In the background: while a drive or guidance is in progress, it keeps running when the screen is off or you switch to another app. A notification showing the route name, progress and GPS status is displayed for as long as this continues. It stops when the drive or guidance ends.
• Path you drive: the latitude and longitude of the points you drive along a route are sent to our INOS server with the route ID and your user ID. They are saved automatically every few points during a drive and again when you stop. Speed, accuracy, heading and a time for each point are not sent with the path.
• Live position for operators: if one of your organisation's operators opens a live view of your drive in the INOS web platform, the app sends your current latitude and longitude and the route ID to our INOS server with each location update while you are driving. Once a live view has started, this applies to every drive you start until you close the drive's map screen. Our server passes these live positions to the operator's view and does not save them as a location history.
• Off-route alerts: the operator's live view shows an alert if you move away from the planned route. If that operator has linked a Telegram account to INOS, our server also sends the alert to the operator through Telegram, with your name, the route name, your distance from the route and a map link to your position (see section 6).
• Sequence map mode (if selected in Settings): the app sends your position, with the route ID, to our INOS server each time you reach the next point on the route.
• Directions and maps: to calculate guidance to a route's start point, the app sends Mapbox your current position and heading, the start point and the language for spoken instructions. It does this when guidance starts and each time the route is recalculated, which can be as often as every 10 seconds while you are away from the suggested route. Map tiles are downloaded from Mapbox for the area shown on the map. See section 6.
• On your device: drive locations are held only in the app's memory and are cleared when the drive ends. They are not saved to storage, except in the diagnostics log if you choose to export it (section 3.7).

Device management

• The device-management service (section 3.5) takes a location reading about once a minute and reports the latest location to our device-management server about every 30 seconds by default. Administrators can change these intervals.
• Android 10 and later: if you allow location access "all the time", this continues when the app is closed or not in use. Before Android shows that permission screen, the app explains the request and lets you choose "Not now"; it may ask again after 7 days. If you do not allow background location, device management receives location only while the app is open on screen or a drive or guidance is in progress.
• Android 9 and older: Android has no separate background location permission. Because the app needs location permission to open, device management reports location in the background, including when the app is closed or not in use, whenever device management is running. The app does not ask separately.
• While the app can use location in the background, Mapbox telemetry may also collect location data in the background (see section 6.1).

Your choices: on Android 10 and later you can withdraw background location at any time in Android Settings, and the rest of the app keeps working. You can also withdraw location permission completely, but the app then stops working, because it needs precise location to open. On Android 9 and older, the only ways to stop device management from reporting location are to withdraw location permission or uninstall the app.

3.3 Drive and route data

• The routes your organisation assigns to you are downloaded from our INOS server.
• When you select a route, on your phone or on Android Auto, the app tells our server which route you selected.
• For each route, the app sends your progress (percentage complete, and how many route points you have matched out of the total) and a summary of each drive session (a label, the date, the number of points recorded, the percentage, the duration and which part of the route it covered). Session summaries do not contain coordinates.
• This data is linked to your user ID and the route ID, so that you can resume routes and your organisation can see what was driven and when.
• Reset route on a route card works only for a route with a saved path. It deletes that path from our server and overwrites the route's progress and session history with empty values. If no path has been saved for the route, nothing is changed on our server.

3.4 Messages with operators

• You can exchange text messages of up to 2,000 characters with your organisation's operators. The app does not support attachments, photos or voice messages.
• Messages go through our INOS server, which stores them and their read status (when messages have been read) so both sides can see the conversation.
• On your device, the app keeps your messages (text, sender type and name, time, delivery and read status), including messages waiting to be sent, in a local database until you sign out or uninstall the app. After you sign in, the latest 50 messages are loaded.
• Message notifications show the operator's name and the message text. Whether they appear on your lock screen depends on your device settings.
• You can reply from a notification or on Android Auto. In the car, Android Auto and Google services on your phone turn your spoken reply into text; the app receives only the text. The app does not have microphone permission and never records audio.
• While you are signed in, the app keeps a live connection to our INOS server to receive messages. While it is connected, our server can see that your device is online and its IP address. Because the device-management service keeps the app running, this connection can stay open in the background.

3.5 Device management (device information, identifiers, installed apps, files and background location)

INOS Navigation includes Digis Squared's device-management service, Pulse, which we use to manage, locate, secure and support the devices the app is installed on. It works separately from your INOS account:

• The device is registered with our device-management server automatically the first time the app is opened, before you sign in and whether or not you sign in later. The app does not show a separate notice or ask for your agreement before registering the device.
• Every installation is registered to the same device-management group, which Digis Squared administers. Registration is not linked to your INOS account or your organisation.
• It keeps running in the background while a persistent "INOS device management" notification is shown, and it keeps running if you sign out. If you turn off notifications for the app, device management keeps running but the notification may not be visible. After the device restarts, device management starts again the next time you open the app's main screen or the app is updated.
• The app gives you no way to switch it off. It stops when an administrator removes the device from management, or when you uninstall the app.
• What device management sends automatically does not include your name, email address or user ID. However, administrators can retrieve files the app stores, which include your profile (see below). A work device is also usually used by one person, so device-management data can relate to you.

While device management is running, the app sends:

• Device details: manufacturer, brand, model and device code name, Android version, API level and security patch level, screen size and density, and the device-management software version.
• Device identifiers: the Android ID, and, on Android 7 devices, the hardware serial number. The device-management component can also read the IMEI on Android 9 or older if the phone permission has been granted, but INOS Navigation does not ask for that permission. It does not collect your phone number, SIM serial number or subscriber ID (IMSI).
• Location: latitude, longitude, accuracy, speed, heading, altitude, the location source and the time of the reading, as described in section 3.2.
• Battery: level, whether it is charging and from what source, temperature and voltage.
• Storage and memory: total and free internal storage, and total and available memory.
• Network: connection type (Wi-Fi, mobile, ethernet or none); when on Wi-Fi, the Wi-Fi network name and signal strength; the name and code (MCC-MNC) of the mobile network the device is connected to; and mobile signal quality measurements (for example 4G or 5G signal strength).

Our device-management server also records the IP address the device connects from. Authorised administrators can:

• ask the device to report its current location or its device details, on request or on a schedule they set;
• ask the device to list the installed apps that INOS Navigation can see (package names only, with system apps left out unless requested). On recent Android versions this is a limited set of apps;
• list and retrieve files that INOS Navigation can read. In practice this is the app's own storage, which includes your profile (name, email address, phone number, user ID, role and organisation account ID), your session token, your local message history, your settings and any exported diagnostics log. Your session token gives access to your INOS account. Retrieved files are uploaded to our device-management server;
• set up areas on a map (geofences) and record an alert each time the device enters or leaves one, based on the locations the device reports;
• have the device-management server notify other systems they set up about device events, such as the device's name, model and group, when it comes online or goes offline, low battery, and when a command or file retrieval has finished (these notifications do not include location). Depending on the address an administrator sets, these notifications may not be encrypted;
• generate reports from device-management data, such as device lists with identifiers, device status and alerts;
• make the device sound an alarm or briefly turn the screen on, to help find it;
• open an app on the device;
• change how often it reports; and
• remove the device from management.

Device management cannot take screenshots, read the system log, run commands, install or remove apps, restart, lock or reset the device, or access your contacts, SMS, call history, camera or microphone. Device-management data is sent from the app over an encrypted (HTTPS/WSS) connection to servers operated by Digis Squared, and is used only to manage, locate, secure and support the devices the app is installed on.

3.6 Crash reports and diagnostics (Bugsnag)

We use Bugsnag, a service of SmartBear Software, to find and fix problems in the app. Bugsnag starts when the app opens and sends:

• Crash and error reports when the app crashes, stops responding or hits a native error: technical error details and the state of the app's threads at the time.
• Recent app events leading up to a crash, recorded automatically: screens opened, the app moving between foreground and background, screen orientation changes, network connectivity changes, some system events (for example power or battery changes) and low-memory warnings.
• Device information: manufacturer, model and brand, Android version, language and region settings, processor type, screen size and density, memory and storage usage, battery level and charging state, whether the device is rooted or an emulator, network type, whether location services are switched on (not your location), orientation and the time.
• App information: app version and build, which screen was open, how long the app had been running, and whether it was in the foreground.
• Session information each time the app is brought to the foreground, used to calculate how often the app crashes.
• Identifiers: random identifiers that Bugsnag creates for this installation of the app and keeps on the device (one of them is also used as an anonymous user ID in reports), and the IP address the reports are sent from. These identifiers do not contain your name or contact details, but they are persistent, so they are pseudonymous personal data rather than anonymous data.

The app does not send your name, email address, user ID, location coordinates or message content to Bugsnag. Error details may occasionally include technical text returned by our servers. Reports that cannot be sent straight away are kept on the device until they are delivered.

3.7 In-app diagnostics log

• During a drive, the app keeps a temporary technical log in memory to help troubleshoot navigation. It holds up to 8,000 entries and restarts at each new drive. It contains every raw location reading (position, accuracy, speed, heading and time), navigation events, the planned route's ID, name and shape, the device manufacturer, model and Android version, the app version, and a random session ID.
• The log stays on your device unless you open Logs on the map and choose Copy all or Share as file. It then goes to your clipboard or to the app you choose (for example, email to your support contact). We only receive it if you send it to us, or if a device-management administrator retrieves the exported file (section 3.5).
• A shared file stays in the app's cache until Android clears the cache, you clear the app's data or you uninstall the app.
• The app also writes technical messages, which can include location and route IDs, to the Android system log. Other apps cannot read the system log, but it can be included in a bug report you create on the device.

3.8 Android Auto, voice guidance and notifications

• Android Auto: the car display offers the same drive features, using your phone's location and your phone's connection to our servers. The app does not read any data from your car, such as its speed, mileage or fuel level. Route details, guidance instructions and message notifications are passed to the Android Auto app on your phone so they can be shown on the car display and read aloud. Android Auto is provided by Google under Google's own terms and privacy policy.
• Voice guidance: spoken instructions are produced by the text-to-speech engine on your device, from instruction text supplied by Mapbox directions. No audio is recorded or sent. Your mute setting is stored on your device.
• Notifications: all notifications are created on your device. The app does not use a push messaging service or push token. It shows notifications for drive progress, messages, device management and, if the app was installed outside Google Play, app updates.

3.9 Settings and other data stored on your device

• Your chosen INOS server, language, map mode, map theme, dark mode, zoom level, 3D view and voice mute settings, whether you have seen the introduction screens, and when you last declined the background-location request. These stay after you sign out, until you clear the app's data or uninstall the app.
• Map data cached by the Mapbox software, and an identifier that Mapbox creates for this installation (see section 6.1).
• Device-management settings: the server address, the device's management ID and secret, and the reporting intervals.
• Bugsnag's installation identifiers and any crash reports waiting to be sent (section 3.6).
• Android backup: if backup is switched on for your device, Android may include some of this app's data in your device backup in your Google account. This can include your local message history, some settings, the device-management ID and secret, and Bugsnag's installation identifiers. Your session token and profile details are excluded from that backup. If a backup is restored to another device, that device may take over this device's device-management registration. When you move to a new device using Android's device-to-device transfer, more of the app's data may be copied, which can include your sign-in details. Backups are handled by Google under its own terms and your backup settings, and a backup copy may remain in your Google account after you uninstall the app.

3.10 App updates (only if installed outside Google Play)

If your organisation installed INOS Navigation directly rather than through Google Play, the app may check Digis Squared's update server about every six hours for a new version and download it over an encrypted connection. No account, device or location information is sent; the server sees only your IP address and standard technical request details. Downloaded update files are deleted after installation or when replaced. The Google Play version does not do this; it is updated through Google Play.

3.11 Android permissions

3.12 What the app does not collect

The app does not access your contacts, photos or media, camera, microphone, SMS or call history, calendar, accounts on the device, browsing history, financial information or health data, and it does not use the Android advertising ID. The app's software package also includes Google Firebase Analytics and Crashlytics libraries, but they are not configured or switched on and do not collect or send any data.

4. How we use your data

We use the data described above to:

• provide the app: signing you in, showing your routes, recording drives, guidance and maps, messages and Android Auto;
• let your organisation manage its drive work: see which routes were driven and how far, see your position live and receive off-route alerts when an operator opens a live view, and communicate with you;
• manage, locate, secure and support the devices the app is installed on (device management), including geofence alerts set up by administrators;
• keep the app working: find and fix crashes and troubleshoot problems;
• protect accounts, devices and our systems, and prevent and investigate fraud or misuse; and
• respond to your requests and meet our legal obligations.

We do not use your data for advertising or marketing, and we do not use it to make automated decisions that have legal or similarly significant effects on you. Your organisation may use the drive data it receives under its own policies.

5. Legal bases for processing

Under UK GDPR, each use of personal data needs a legal basis.

Separately from these legal bases, Android asks for your permission before the app can use location (including background location on Android 10 and later) or show notifications, and you can change these permissions at any time in Android Settings. Where we rely on legitimate interests, you have the right to object (see section 10).

6. Who receives your data

• Your organisation: your account details, routes driven, progress and session summaries, your live position and off-route alerts when an operator opens a live view, and your messages.
• Device-management administrators: device-management data, including files retrieved from the device, is available to authorised Digis Squared staff. Where we agree it with your organisation, its administrators may also be given access to the devices used for its work. Administrators can send device event notifications to other systems they set up (section 3.5).
• Digis Squared servers: the INOS servers and the device-management server are operated by us. They are hosted by infrastructure providers, including OVHcloud, and some of them are reached through Cloudflare's network. These providers act on our instructions.
• Bugsnag (SmartBear Software, United States): crash and error reports, as described in section 3.6. See SmartBear's privacy policy.
• Mapbox (Mapbox, Inc., United States): maps and directions. When the app shows a map, Mapbox receives requests for map tiles for the area shown (usually around you) and your IP address. During guidance to a route's start point, Mapbox receives your current position and heading, the start point and the instruction language each time the route is calculated. See Mapbox's privacy policy, and section 6.1 below for Mapbox telemetry.
• Telegram (only if an operator has linked it): if one of your organisation's operators has linked a Telegram account to INOS, our server sends that operator a Telegram message when their live view shows you have moved away from the planned route. The message contains your name, the route name, your distance from the route and a map link to your position. Telegram delivers and stores it under Telegram's privacy policy, and it stays in the operator's Telegram chat until it is deleted there.
• Google: some Android features the app relies on are provided by Google, such as location from Google Play services, Android Auto, Android backup and distribution through Google Play. Google processes data for these features under the Google Privacy Policy. The app does not send data to Google Analytics or Firebase.
• Others, where necessary: professional advisers; law enforcement, regulators or courts where the law requires it or to protect rights and safety; and a buyer or successor if our business is reorganised or sold, subject to confidentiality.

Our hosting providers, Bugsnag, and Mapbox for maps and directions may use your data only to provide their services to us. The exception is Mapbox telemetry (section 6.1), which Mapbox uses for its own purposes. Telegram and Google process data under their own terms.

6.1 Mapbox telemetry

The Mapbox software in the app currently has Mapbox's telemetry feature switched on, which is Mapbox's default setting. With telemetry on, Mapbox may collect information about map use and your device, such as an identifier Mapbox creates for this installation of the app, battery level and charging state, mobile network type, whether the app is in the foreground or background and map loading events. Because the app has location permission, Mapbox may also collect location data, which Mapbox says it de-identifies. This is not limited to drives: the device-management service keeps the app running in the background, so while the app can use location in the background (see section 3.2), Mapbox may collect location then too. Mapbox uses telemetry for its own purposes, such as improving its maps, traffic and navigation services, as described in Mapbox's privacy policy. Where the Mapbox information (i) button is shown on the phone's map, you can use it to opt out of Mapbox telemetry; it is not available on the Android Auto display. Mapbox still receives the basic usage events it needs to bill for its services when telemetry is off.

7. No selling, no advertising

• We do not sell or rent your personal data.
• The app contains no advertising and no advertising software.
• The app does not use the Android advertising ID and does not track you across other companies' apps or websites.
• We do not use your data for marketing.

8. Security

We take steps to protect your data, but we want to be clear about where it is not yet protected:

• Not yet encrypted: connections between the app and our INOS servers use unencrypted HTTP and WebSocket connections. This covers signing in (including your email address and password), your session token, location and drive data, live position and messages. Someone with access to the network between your device and our servers could read or alter this data in transit. We will update this policy when these connections are encrypted. Using mobile data or a trusted Wi-Fi network rather than public Wi-Fi reduces this risk but does not remove it.
• Encrypted: the app's connections to the device-management service, Mapbox, Bugsnag and our update server use encrypted HTTPS or WSS connections. Each managed device authenticates to the device-management service with its own secret.
• On your device: app data, including your session token, is kept in the app's private storage, which Android's app sandbox protects from other apps. The app does not add its own encryption to this data. Your password is never stored on the device.
• On our servers: access to data requires an authorised account, and requests to our INOS API include your session token.

No system is completely secure. If you think your account or device has been compromised, or you want to report a security concern, email [email protected].

9. How long we keep data

We may keep data for longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

10. Deleting your data and your rights

10.1 Deleting your account and data

Your INOS Navigation account is created by your organisation, so the app does not have a delete-account button. To have your account and its data deleted:

• ask your organisation's INOS administrator; or
• email [email protected] with the subject "INOS Navigation – delete my data", giving the email address you use to sign in and the organisation you drive for.

For data we process on your organisation's behalf (your account details, driven paths, progress and session records, and messages), we will pass your request to your organisation and delete the data on its instructions. For data we control, such as the device-management records for your device and crash reports we can link to it, we will delete it ourselves after verifying your request. If any data must be kept for legal reasons, we will tell you what and why.

In the app, you can also:

• Sign out: removes your account details, session token and message history from the device. It does not delete data on our servers or stop device management.
• Reset route: for a route with a saved path, deletes that path from our server and empties the route's progress and session history (section 3.3).
• Change permissions: withdraw background location or notification permission in Android Settings. Withdrawing location permission completely stops the app from working.
• Uninstall the app: stops all data collection by the app, including device management, and removes the data stored by the app on your device. A copy in your Android backup may remain in your Google account (section 3.9), and data already on our servers is kept as described in section 9 until it is deleted.

10.2 Your rights

Under UK data protection law, and similar laws in other countries, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict how your data is used;
• object to processing based on legitimate interests;
• receive data you provided in a portable format; and
• withdraw any consent you have given, without affecting earlier processing.

To exercise these rights, email [email protected]. We will need to verify your identity, and we will reply within one month (this can be extended by up to two further months for complex requests, in which case we will tell you). Where your organisation is the controller, we will pass your request to it and help it respond, and you can also contact your organisation directly.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority where you live or work. We would appreciate the chance to deal with your concern first.

11. Children

INOS Navigation is a business app for adult drivers. It is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has used the app, contact us and we will delete the data.

12. International transfers

Digis Squared is based in the United Kingdom. Depending on the INOS environment your organisation uses and the services involved, your data may be processed in:

• the United Kingdom and the European Economic Area (for example OVHcloud data centres);
• the United States (Bugsnag and Mapbox);
• the region of your organisation's INOS environment, where your organisation uses a regional environment (for example in Saudi Arabia);
• other countries where our network provider operates; and
• for off-route alerts sent through Telegram, the countries where Telegram operates.

When we transfer personal data outside the UK to our service providers, we make sure it is protected as UK law requires, for example by relying on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Telegram messages are delivered through Telegram's service under Telegram's own terms. You can ask us for more information about these safeguards.

13. Changes to this policy

We may update this policy when the app or our practices change, for example when the app's connections to our INOS servers are encrypted or when we change how the app uses third-party services. We will publish the updated policy on this page and change the date at the top. If a change is significant, we will also tell you through the app, through your organisation or by another appropriate means.

14. Contact us

For questions about this policy or your data, or to make a request, contact: