Privacy and GDPR
Transpira holds personal data about drivers — from identifying details to hours-of-service records and safety events. This module carries out the right to erasure (GDPR art. 17) and data export on request, while respecting the rules that require some of that same data to be kept.
Who it's for
Only an organization administrator can request a driver's data be erased or export their data — this is an irreversible, documented data-protection decision, not a routine operational task.
Key concepts
Erasure here means anonymization, not a hard delete of rows: fields that identify the person are overwritten with a pseudonym, while rows with aggregate value (the components of a safety score, say) or a retention obligation survive as anonymized data. Data still inside a retention window (hours-of-service logs, inspection signatures, tachograph files) is marked deferred — it's only anonymized once its retention window closes or a legal hold is lifted, by a daily job.
Requesting erasure
You submit a request from the driver's own record, with an optional reason (a subject-access ticket reference, say) and a typed confirmation word — a deliberately heavy path, since the request cannot be undone. The platform immediately runs the transition for every category of data: driver identity, the account, contact details, message content, proof-of-delivery, safety events, coaching, rewards, scores and infringements are anonymized right away; notification channels (push tokens, preferences) are hard-deleted; anything under a retention obligation moves to the deferred state. Requesting again for an already-erased driver is rejected.
Tracking progress and exporting data
The privacy screen in the console lists every erasure request across the organization — for each category you can see the policy that applied, the outcome (anonymized, deleted, or deferred) and, for deferred categories, the date the retention window closes. The same driver record lets you download a full export of everything the platform holds about them — the set used to answer an access or data-portability request.
In the background
A daily job reviews deferred requests and anonymizes the categories whose retention window has just closed; a request is marked complete once its last deferred category clears. The job is idempotent, so re-running it over the same driver changes nothing.