Terms and Conditions of Use

1. Purpose of the System

GereFrotas is a fleet management system developed by CGTech that enables the control, monitoring, and management of vehicles and related services. By using the mobile version of the system for drivers, the user declares that they are aware of and agree to the rules set forth in these Terms of Use.

2. Privacy and Personal Data Protection

GereFrotas processes personal data in accordance with the Brazilian General Personal Data Protection Law (Law No. 13.709/2018) and the ANPD Resolutions, acting as a Data Processor.

Information is collected and used solely to enable the operation of the system, ensure the security of access, and comply with legal or contractual obligations, as set forth in the Service Agreement previously signed with the Data Controller.

3. Collection and Use of Location Data

The GereFrotas Motoristas application collects real-time location data during active trips. This collection occurs even when the application is running in the background or minimized.

The location data collected includes latitude, longitude, and timestamp, and is essential for the following purposes:

• Complete recording of trip routes for auditing and fleet management purposes.
• Accurate calculation of distances traveled for operational and tax control.
• Provision of management reports to the company that contracted the system.
• Compliance with contractual and legal obligations related to corporate fleet management.

Background location data collection is enabled exclusively during trips in progress and is automatically stopped when the driver ends the trip in the application. The system uses foreground location services on Android and background location updates on iOS in order to maintain accurate tracking.

Location data is stored securely on protected servers and is accessible only to the company that contracted the system and to CGTech, as necessary for the provision of the service.

4. Other Data Collected

In addition to location data, the application collects and processes the following information:

• Registration data: full name, CPF (Brazilian individual taxpayer number), driver's license, e-mail address, telephone number, and employee ID.
• Trip data: start and end date and time, initial and final odometer readings, destination, and purpose of the trip.
• Images: photographs of the vehicle for inspection, fueling receipts, and documentation of maintenance requests.
• Technical data: device model, operating system version, application version, and error logs for technical support purposes.

Images captured by the camera are sent directly to the server and are not stored in the gallery of the user's mobile device.

5. Permissions Requested

For the application to work properly, the following permissions are requested:

On Android:

• Precise location (ACCESS_FINE_LOCATION) to obtain GPS coordinates during trips.
• Background location (ACCESS_BACKGROUND_LOCATION) to maintain tracking while the application is minimized or closed.
• Camera (CAMERA) for QR code scanning and photographic records.
• Internet (INTERNET) to synchronize data with the server.
• Notifications (POST_NOTIFICATIONS) to deliver important alerts.
• Foreground service (FOREGROUND_SERVICE_LOCATION) for continuous tracking.

On iOS:

• Location Always, for continuous tracking during trips.
• Location When In Use, for basic location features.
• Location Accuracy (full precision), to obtain accurate coordinates.
• Camera, for image capture features.

All permissions requested are strictly necessary for the proper operation of the application and for fulfilling the purposes described in these Terms.

6. Legal Basis for Data Processing

The processing of users' personal data is based on the following legal grounds set forth in the General Personal Data Protection Law:

• Performance of a contract or preliminary procedures related to a contract to which the data subject is a party, at the request of the data subject (article 7, item V, of Law No. 13.709/2018).
• Compliance with a legal or regulatory obligation by the controller (article 7, item II, of Law No. 13.709/2018).

Data is processed exclusively for purposes related to corporate fleet management and is not used for marketing or advertising purposes, nor shared with third parties unrelated to the provision of the service.

7. Data Sharing

The data collected by the application is shared with:

• The company that contracted the system, as the Data Controller, which has full access to information related to the professional use of the application.
• Cloud infrastructure providers (Amazon Web Services), for secure data storage.
• The error monitoring service (Sentry), with anonymized data and technical logs, for the continuous improvement of the application.

CGTech does not share personal data with third parties for commercial or advertising purposes, or for the resale of information.

8. Data Storage and Retention

Personal data is stored on secure servers located in certified Amazon Web Services data centers, protected by encryption and access controls.

The data retention period is determined by the Controller company in accordance with its internal policies and applicable legal obligations. Location data and other trip information is retained for as long as necessary to comply with tax, labor, and contractual obligations.

Data stored locally on the mobile device for offline operation is automatically removed after successful synchronization with the server or upon user logout.

9. Duty of Confidentiality and Security

The user is fully responsible for protecting their access credentials (login and password), and undertakes to:

• Not share their login and password with third parties.
• Use strong passwords containing letters, numbers, and symbols.
• Change their credentials periodically.
• Keep their devices and browsers up to date.
• Log out after use, especially on public or shared devices.

CGTech is not liable for damages, losses, or unauthorized access resulting from misuse or negligence in protecting this information, and may not be held liable before or by third parties for data processing violations committed exclusively by the Controller.

Should the Contracting Party (Controller) consider that CGTech acted or failed to act in compliance with privacy and data protection rules, it must present supporting evidence before any administrative or judicial liability may be established, including the termination of the main Service Agreement signed between the parties.

10. Information Security Measures

CGTech implements technical and organizational information security measures, including:

• Encryption of data in transit through the HTTPS protocol with TLS certificates.
• Secure storage of local data on the device using MMKV encryption.
• Access control based on authentication with short-lived JWT tokens.
• Continuous monitoring of access and detection of suspicious activity.
• Regular security updates and vulnerability patches.

In the event of a security incident involving personal data, CGTech will notify the Contracting Party within up to three business days so that the Controller may fulfill its duties before the ANPD, in accordance with article 6 of ANPD Board Resolution No. 15/2024.

11. Proper Use of the System

The user undertakes to use GereFrotas in a legitimate and ethical manner, refraining from:

• Accessing other users' information without authorization.
• Modifying, copying, or distributing parts of the system.
• Using the system for unlawful or fraudulent activities, or activities that harm third parties.
• Circumventing or disabling location tracking features.
• Providing false or fraudulent information.
• Using tools to spoof GPS location data (fake GPS).

Should CGTech identify misuse or suspicious activity, it may suspend the service associated with the credential under investigation and will inform the Contracting Controller so that appropriate measures may be taken. Accordingly, if the credential under investigation belongs to an employee of the Contracting Party, the latter will be informed immediately and may request further information about the violation committed.

12. Data Subject Rights

The user may exercise the rights granted by the LGPD, such as access, correction, deletion, and portability, through the official channels. To exercise data subject rights, the user must first contact the responsible department at their employer, which acts as the Data Controller. Alternatively, the user may send a request to contato@gerefrotas.com.br with the subject line "LGPD - Exercise of Rights".

Please note that the complete deletion of data may not be possible where there is a legal retention obligation, a need to perform a contract, or ongoing judicial, administrative, or arbitration proceedings. In such cases, the data will be blocked and retained only for the minimum period necessary.

13. Updates to These Terms

CGTech may amend these Terms at any time due to legal, technological, or operational changes. The updated version will always be available within the system. Continued use implies acceptance of the new terms.

Significant changes will be communicated to users through an in-app notification, the registered e-mail address, or a push notification, depending on the relevance of the change.

14. Acceptance

By clicking I Have Read and Agree to the Terms of Use and accessing the GereFrotas system, the user confirms that they have read and understood this document, assuming full responsibility for the security of their credentials and for the proper use of the system.

The user further declares that they are aware that the application collects real-time location data during active trips, including when the application is in the background or completely closed, and that this collection is essential to the operation of the fleet management system.

15. Jurisdiction

Any disputes or controversies arising from any acts performed in connection with the use of the mobile system by users, including with respect to breach of these Terms of Use or violation of the rights of CGTECH, other Users, or third parties — including intellectual property, confidentiality, and personality rights — shall be brought before the Judicial District (Comarca) of Aracaju, State of Sergipe, Brazil.