Privacy Policy

When a user account is created, the following information is collected and stored:

• Full name, username, and employee role (driver, helper, staff, secretary, admin)
• Email address and contact number
• Hashed login credentials (passwords are never stored in plain text)
• Date and time of account creation and last login

The system collects GPS location data from driver and helper mobile devices during active service routes. This includes geographic coordinates, timestamps, route path history, and duration of presence within service areas.

All operational activities performed within the system are recorded, including parts requests and approvals, trip logs and delivery records, vehicle assignments, maintenance events, and inventory transactions.

GPS and location data collected by the system is used exclusively for:

• Real-time monitoring of vehicle and personnel positions during service operations
• Verification of route adherence and trip completion
• Operational reporting and post-trip analysis by management
• Safety monitoring and emergency response coordination

Location data collection is active only during assigned service routes. The system does not continuously track drivers or helpers outside of work hours or assigned operational periods, except where required for safety in emergencies.

Location history is retained for the duration required for operational review and compliance. Historical location records may be reviewed by management for performance evaluation, dispute resolution, or safety investigations.

The system maintains comprehensive activity logs for all user actions. This includes login and logout events, data entries and edits, approvals and rejections, report generation, and file uploads. Logs are timestamped and linked to the acting user account.

Operational monitoring is conducted strictly for the following purposes:

• Ensuring system integrity, data accuracy, and operational accountability
• Detecting unauthorized access attempts or suspicious activity
• Supporting audits, reviews, and management reporting
• Providing evidence in the event of disputes, errors, or compliance reviews

Activity logs are accessible only to users with Administrator-level privileges. Standard users and staff do not have access to view logs outside their own records.

The ITCPRS system employs the following security practices to protect stored data:

• Passwords are stored using industry-standard hashing algorithms (bcrypt)
• Session tokens are regenerated upon login and invalidated upon logout
• CSRF tokens are applied to all state-changing form submissions
• Access to sensitive modules is restricted by user role

Data access is governed by a role-based access control (RBAC) model. Each user role — Admin, Secretary, Staff, and Driver — is granted access only to the modules and information necessary for their operational function.

Data collected and stored by the ITCPRS system is used exclusively for internal operational purposes. Personal data, location history, and activity logs are never sold, shared, or disclosed to any third party except where required by law or a lawful order from a competent authority.

The system may collect and store files submitted by users, including:

• Driver and staff profile photos for identity management
• Proof-of-delivery images and trip documentation
• Parts request receipts and supporting documents
• Maintenance records and vehicle inspection photos

Uploaded files are stored on the company's internal server infrastructure. Access is restricted to authorized users with the appropriate role permissions. Uploaded files are used exclusively for the operational purpose for which they were submitted.

Users are responsible for ensuring that any photos or documents they upload are accurate, relevant, and free from inappropriate or malicious content. Uploading misleading or falsified documentation constitutes a disciplinary violation.

Aggregated, anonymized operational data may be used internally for performance analysis, fleet optimization, route planning improvement, and overall service quality enhancement. Individual identities are not disclosed in summary analytics reports.

Individual performance data — including trip history, response times, and compliance with system requirements — may be reviewed by management for performance evaluations, commendations, or disciplinary proceedings. Users are informed of any formal review concerning their records.

All data collected within the ITCPRS system is used solely for legitimate business operations. Data will not be used for profiling outside of operational contexts, and no advertising or commercial data monetization takes place.

Each user is solely responsible for safeguarding their system login credentials. Credentials must not be shared with any other person. Users must report suspected unauthorized access to their account to an Administrator immediately.

Users must provide accurate, truthful information when creating or updating their account profile. Providing false identity information is a violation of system policy and may result in account termination.

If a user believes their data has been accessed, disclosed, or used improperly, they should immediately report the concern to the system Administrator. All such reports will be investigated and addressed promptly.

ITCPRS reserves the right to modify this Privacy Policy at any time in response to operational changes, new legal requirements, or system enhancements. Updates will be published within the system with a revised "Last Updated" date.

For significant changes that materially affect how personal data is collected or used, ITCPRS will notify affected users through the system's notification channel prior to the change taking effect.

For questions, concerns, or requests related to your data or this Privacy Policy, contact your assigned system Administrator through the internal messaging feature or directly through your organization's management channel.