This Policy explains what personal data the Golden Sat Waker App collects, what we use it for, with whom we share it, how long we keep it and how you can exercise your rights. It complies with the Lei Geral de Proteção de Dados (Law No. 13.709/2018 – LGPD – Brazilian General Data Protection Law), the European Union General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR), the UK GDPR, the Swiss Federal Act on Data Protection and the state privacy laws of the United States.
1. Summary
| Topic | In a nutshell |
|---|---|
| Who processes the data | Golden XW Sistemas Inteligentes Ltda. For Drivers linked to a company, the company decides on the operation data and we process it on its behalf. |
| Main data | Registration details, location (including in the background), camera images during the Operation, driving events, vehicle and device data. |
| What for | To alert you to fatigue and distraction, record the Operation, generate reports, navigate with Waker Maps, charge subscriptions and comply with the law. |
| Sale of data | We do not sell your personal data. |
| Where it is stored | Servers in Brazil, with some technology providers abroad. |
| Your rights | Access, rectification, erasure, portability, objection, withdrawal of consent and review of automated decisions, by e-mail at suporte@wakerapp.com.br. |
2. Who we are and how to contact us
2.1. Controller: GOLDEN XW SISTEMAS INTELIGENTES LTDA., CNPJ (Brazilian company registration) No. 63.932.482/0001-38, Rua Haiti, nº 129, Parque das Nações, Santo André/SP, CEP 09280-390, Brazil (“Golden Sat”, “we”, “us”).
2.2. Data Protection Officer (Encarregado – DPO): GOLDEN XW SISTEMAS INTELIGENTES LTDA., contact by e-mail at suporte@wakerapp.com.br, with the subject “Privacy”.
2.3. Users in the European Union and the United Kingdom: until a representative is appointed under Art. 27 GDPR, requests may be sent directly to the e-mail address above. This Policy will be updated once the representative is appointed.
3. Role of each party
- Self-employed Driver or individual user (including of Waker Maps): Golden Sat is the controller of your data.
- Driver linked to a Contracting Company (carrier, fleet or partner): the Company is the controller of the operation data and Golden Sat acts as processor, following the Company’s instructions and the contract entered into with it. Requests concerning such data may be made to the Company or to us, and we will forward them to the Company.
- Account, security, individual subscription billing and acceptance record data: Golden Sat is the controller in all cases.
4. Data we collect
| Category | Examples | Source |
|---|---|---|
| Registration and account | Name, nickname, e-mail, telephone number, CPF (Brazilian individual taxpayer number, when provided), profile photo, company and role | You, the Contracting Company or the sign-in service you choose |
| Location | Precise position, speed, heading and route, including while the app is in the background | The phone’s GPS and sensors |
| Camera images | Continuous analysis of the front camera during the Operation; front and rear photos of risk events; front photo at the start and end of the Operation and upon acceptance of these documents | The phone’s cameras |
| Driving events | Prolonged blinks, yawns, drowsiness, distraction, phone use, lens obstruction, speeding, with date, time and location | Artificial intelligence processing on the phone |
| Telemetry and sensors | Acceleration, braking, movement, activity recognition (for example, “in vehicle”) and distance travelled | The phone’s sensors |
| Operation and working hours | Start, end, breaks, stops, responses to the activation reminder (“I am a passenger”, “I am not working”, no response) | Use of the App |
| Vehicle | Licence plate, model, body type, height, length, weight, axles and load | You or the Contracting Company |
| Waker Maps | Origin, destination, saved routes, reports, text or voice contributions, approximate position shown to nearby drivers | You and use of the App |
| Voice | Spoken commands and dictation, converted into text | Microphone, when you trigger dictation |
| Device and usage | Model, operating system, App version, device identifier, IP address, access and error logs, notification token | Automatic collection |
| Payments | Plan, status, dates and subscription receipts. We do not receive your card details. | Application store or Contracting Company |
| Advertising | Device advertising identifier (Waker Maps Basic plan) | Advertising partner |
| Support | Messages and information sent to support | You |
| Acceptance record | Document version and hash, date and time, IP, device, geolocation, front photo and facial landmarks (face mesh) | You, at the time of acceptance |
4.2. Mandatory and optional data. Unless otherwise indicated, the data requested are necessary to provide the Services. Without them, some features will stop working. Where an item of data is optional, the App will indicate this at the time of collection.
4.3. Other people’s data. If you send us data relating to third parties, for example in reports, photos or contributions, you declare that you are authorised to do so and you are responsible for sending it.
5. Sensitive data and facial images
5.1. To detect fatigue, the App analyses facial landmarks (such as how open the eyes and mouth are) on the phone itself, in real time. This processing does not identify who you are and the continuous images are not sent to our servers. Only photos of risk events and photos at the start and end of the Operation are sent. When you accept the Terms of Use and this Policy, we also send a photo and the facial landmarks (face mesh), solely to evidence acceptance.
5.2. We do not use facial recognition to identify people. Even so, as facial images and signs of drowsiness may be considered sensitive data (biometric or health-related data), we apply enhanced protection to them.
5.3. The lawful basis for such data is, as the case may be: the protection of the life and physical safety of the Driver and third parties (Art. 11, II, (e), LGPD); the regular exercise of rights and compliance with a legal obligation by the Contracting Company (Art. 11, II, (a) and (d)); or your specific consent (Art. 11, I). In the European Union, we process special categories of personal data with your explicit consent (Art. 9(2)(a) GDPR) or, where applicable, for obligations in the field of employment law and safety (Art. 9(2)(b)).
5.4. We do not collect data from health apps on your phone.
6. What we use the data for and on which lawful basis
| Purpose | Lawful basis (LGPD / GDPR) |
|---|---|
| Creating and maintaining your account, authenticating access and providing the Services | Performance of a contract (Art. 7, V / Art. 6(1)(b)) |
| Detecting fatigue, drowsiness and distraction and issuing alerts | Protection of life and physical safety; performance of a contract; consent where required (Arts. 7, VII and 11, II, (e) / Arts. 6(1)(b) and 9(2)(a)) |
| Recording the Operation, events, telemetry and route and generating reports and the Driver Profile | Performance of a contract; legitimate interests of the Contracting Company in fleet safety (Art. 7, V and IX / Art. 6(1)(b) and (f)) |
| Reminding the Driver to activate the Operation when the vehicle is moving and reporting the response to the Contracting Company | Legitimate interests in road and fleet safety; performance of a contract (Art. 7, IX and V / Art. 6(1)(f) and (b)) |
| Waker Maps navigation, routes and alerts | Performance of a contract (Art. 7, V / Art. 6(1)(b)) |
| Showing nearby drivers on the map | Legitimate interests, with display without name and with approximate position (Art. 7, IX / Art. 6(1)(f)) |
| Ads in the Waker Maps Basic plan | Legitimate interests, with the option to limit the advertising identifier in your phone’s settings; consent where required by law, such as in the European Union and the United Kingdom (Art. 7, IX and I / Art. 6(1)(a)) |
| Billing, issuing invoices and tax obligations | Compliance with a legal obligation; performance of a contract (Art. 7, II and V / Art. 6(1)(c) and (b)) |
| Keeping access logs for the legal period | Compliance with a legal obligation – Marco Civil da Internet (Brazilian Internet Civil Framework), Art. 15 (Art. 7, II / Art. 6(1)(c)) |
| Recording and evidencing acceptance of the Terms and this Policy | Regular exercise of rights; compliance with a legal obligation (Art. 7, VI and II / Art. 6(1)(c) and (f)) |
| Security and prevention of fraud and misuse | Legitimate interests (Art. 7, IX / Art. 6(1)(f)) |
| Support and communications about the service | Performance of a contract; legitimate interests (Art. 7, V and IX / Art. 6(1)(b) and (f)) |
| Improving the algorithms and the service, using anonymised or statistical data | Legitimate interests (Art. 7, IX and Art. 12 / Art. 6(1)(f)) |
| Defence in judicial, administrative or arbitration proceedings | Regular exercise of rights (Art. 7, VI / Art. 6(1)(f)) |
7. Automated decisions and profiling
7.1. The indicators, the safety score and the Driver Profile are generated automatically from driving events. They serve to inform and to prevent risks.
7.2. Golden Sat does not take decisions producing legal effects concerning you based solely on these indicators. Management decisions are made by the Contracting Company.
7.3. You may request information about the criteria used and the review of decisions taken solely on the basis of automated processing (Art. 20 LGPD and Art. 22 GDPR).
8. With whom we share data
8.1. The Contracting Company and its Managers, when you are linked to it: events, event images, photos at the start and end of the Operation, routes, reports, responses to the activation reminder and vehicle data.
8.2. Monitoramento Golden (Golden Monitoring), when contracted by the Company: the monitoring centre accesses the location and events of the trip in order to follow it.
8.3. Insurers and risk management companies, only when the Contracting Company authorises the display of the reports of its trips.
8.4. Providers that process data on our behalf, under contract and subject to confidentiality and security obligations, grouped by category:
| Provider category | Service | Location |
|---|---|---|
| Cloud infrastructure and database | Database, authentication, file storage and server functions | Brazil |
| Application server hosting | Routing and map servers | Brazil or abroad, as per the hosting contract |
| Map, route planning and place imagery providers | Truck route calculation, maps, traffic and place imagery (they receive coordinates and the vehicle profile, without your name) | Abroad |
| Operating system platforms and app stores | App distribution, subscription billing, sign-in, notifications and speech recognition | Abroad |
| Advertising partner | Ads in the Waker Maps Basic plan | Abroad |
8.4.1. We require these providers to protect the data to a standard equal to or higher than that provided for in this Policy and by law.
8.4.2. For information security reasons, we do not publicly disclose the names of our providers. You may request them from the Data Protection Officer at the e-mail address in Section 2, and they will be provided once your identity has been confirmed (Art. 18, VII, LGPD and Art. 15(1)(c) GDPR).
8.5. Authorities, when required by law, court order or request from a competent authority, and to defend our rights.
8.6. Corporate transactions: in the event of a merger, acquisition or sale of assets, the data may be transferred to the successor, which will be bound by this Policy.
8.7. We do not sell personal data and do not share it for cross-context behavioural advertising, except for the advertising identifier used by the advertising partner to display ads in the Waker Maps Basic plan, which you can limit or reset in your phone’s settings.
9. International transfers
9.1. Our main servers are located in Brazil. Some technology providers process data in other countries.
9.2. These transfers are based on the standard contractual clauses approved by the ANPD (Brazilian Data Protection Authority) (Resolução CD/ANPD nº 19/2024), the European Commission’s Standard Contractual Clauses, adequacy decisions or the other grounds set out in Art. 33 LGPD and Chapter V GDPR.
9.3. For users in the European Union, the transfer of data to Brazil takes place on the basis of the Standard Contractual Clauses or, where applicable, because it is necessary for the performance of the contract with you (Art. 49(1)(b) GDPR).
10. How long we keep data
| Data | Retention period |
|---|---|
| Account and registration | While the account is active and up to 5 years after it is closed, for the defence of rights |
| Events, event images, Operation photos, routes and reports | For the term of the contract with the Contracting Company or of the individual subscription and up to 1 year after it ends, unless otherwise instructed by the Company or required by law |
| Position shown to nearby drivers | Only while you are using the map; the position is overwritten with each update and no history is kept |
| Access logs (date, time and IP) | At least 6 months, in accordance with Art. 15 of the Marco Civil da Internet |
| Tax and billing data | 5 years, in accordance with tax legislation |
| Records of acceptance of the Terms and this Policy | While the account exists and up to 5 years after it is closed, as evidence in any proceedings |
| Contributions and reports on Waker Maps | For as long as they are useful to the map; they may be kept in anonymised form |
10.2. Once the period has expired, the data are erased or anonymised, except where the law permits or requires their retention (Art. 16 LGPD).
11. Security
11.1. We adopt technical and organisational measures to protect the data, such as encryption in transit, role-based access control, security rules in the database, private storage of images and audit logs.
11.2. No system is completely secure. If a security incident occurs that may cause significant risk or harm, we will notify you and the competent authorities within the time limits set by law.
11.3. Within Golden Sat, the data are accessed only by authorised persons, such as the support, operations, systems administration and legal teams, to the extent necessary for their duties and subject to a duty of confidentiality.
12. Your rights
12.1. Under the LGPD (Brazil), you may request: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or erasure of unnecessary or excessive data or data processed in breach of the law; portability; erasure of data processed on the basis of consent; information about with whom we share data; information about the possibility of not giving consent and the consequences of refusal; withdrawal of consent; objection to unlawful processing; and review of automated decisions.
12.2. Under the GDPR (European Union, EEA and United Kingdom), you have the rights of access, rectification, erasure, restriction of processing, portability, objection (including to processing based on legitimate interests), withdrawal of consent at any time and not to be subject to decisions based solely on automated processing with significant effects.
12.3. How to exercise them: send an e-mail to suporte@wakerapp.com.br. We may ask for information to verify your identity. This service is free of charge.
12.4. Time limits: we respond immediately in simplified form or within 15 days in full (LGPD). For users in the European Union, within one month, extendable in the cases provided for in the GDPR.
12.5. Complaints: you may lodge a complaint with the Brazilian National Data Protection Authority (ANPD), with the data protection supervisory authority of your country in the European Union, with the Information Commissioner’s Office (ICO) in the United Kingdom, or with consumer protection bodies.
12.6. If you are a Driver linked to a Contracting Company, some requests depend on it, as the controller. In such cases, we will forward the request and let you know.
12.7. Exercising your rights will never result in discrimination.
12.8. When we rectify, erase or restrict data at your request, we will communicate this to the recipients with whom we have shared the data, unless this proves impossible or involves disproportionate effort. If you so request, we will tell you who those recipients are.
12.9. Deletion of the account and data. You can request deletion in three ways: in the App, under Settings › Privacy › Delete my account; through the account deletion form; or, if you only want to delete part of your data and keep the account, through the data deletion form. We also handle requests by e-mail at suporte@wakerapp.com.br, with the subject “Delete account”, sent from the e-mail address registered to your account. We will confirm the request and complete the deletion within 15 days. Only the data that the law requires or permits us to keep are retained, for the periods set out in Section 10: access logs (at least 6 months), tax data (5 years) and records of acceptance of these documents (5 years). If you are a Driver linked to a Contracting Company, its operation data follow the Company’s instructions.
13. Phone permissions
| Permission | What it is used for |
|---|---|
| Camera | Detecting fatigue and distraction, taking photos of events, of the start and end of the Operation and of acceptance |
| Location, including in the background | Recording routes and events, navigating, detecting movement without an active Operation and recording acceptance |
| Physical activity and motion sensors | Identifying that you are in a vehicle and measuring acceleration and braking |
| Microphone | Voice dictation in Waker Maps, only when you trigger it |
| Notifications | Alerts, activation reminders and service notices |
| Display over other apps, battery optimisation and screen brightness | Keeping alerts visible and monitoring active during the trip |
| App storage on the phone | Storing events, photos and routes while there is no internet connection, until they are synchronised; these files are kept in the App’s private storage area |
| Bluetooth and audio | Playing alerts through the vehicle’s sound system or connected accessories |
13.2. You may revoke permissions in your phone’s settings. Without some of them, essential features, such as fatigue detection, will stop working.
14. Cookies and similar technologies
14.1. The App does not use browser cookies, but it does use device identifiers and identifiers of third-party software components in order to function, measure crashes and, in the Waker Maps Basic plan, display ads.
14.2. You can limit or reset the advertising identifier in your phone’s privacy settings. Our legal document web pages use only strictly necessary resources.
15. Children and adolescents
The App is intended for persons over 18 years of age. We do not knowingly collect data from minors. If we identify such data, it will be erased.
16. Additional information for users in the European Union, the EEA, the United Kingdom and Switzerland
16.1. This section supplements the Policy and, for these users, prevails over any conflicting information.
16.2. The applicable lawful bases are set out in Section 6. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.
16.3. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We do not carry out direct marketing with your data; should we start doing so, you may object at any time, without giving reasons.
16.4. The data required to create the account and provide the Services are necessary for the performance of the contract. Without them, we are unable to provide the Services.
16.5. Users in Switzerland have the rights provided for in the Federal Act on Data Protection (nFADP), including access, rectification, objection, portability and the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
17. Additional information for users in the United States
17.1. This section applies to residents of states with comprehensive privacy laws, such as California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.
17.2. In the last 12 months, we have collected the categories of personal information described in Section 4: identifiers, internet or other network activity information, geolocation data, sensory information (camera images) and sensitive personal information (precise geolocation and facial data processed to detect fatigue).
17.3. We do not sell personal information. We do not share it for cross-context behavioural advertising, except for the advertising identifier used for ads in the Waker Maps Basic plan, which you can limit or reset in your phone’s settings. We use sensitive information only to provide the Services requested.
17.4. You have the right to know, access, correct, delete, obtain a portable copy, opt out of the sale or sharing of personal information and of targeted advertising, limit the use of sensitive information and not be discriminated against. We honour Global Privacy Control (GPC) signals where applicable. To exercise these rights, use the e-mail address in Section 12.
17.5. Sources: we collect this information directly from you, automatically through your use of the App, from the Contracting Company to which you are linked and from providers that help us operate the Services.
17.6. Retention periods: each category is retained for the periods set out in Section 10.
17.7. How we handle your request: we need to verify your identity before responding, and we will use the verification data only for that purpose. You may submit the request through an authorised agent, who must provide proof of the authorisation. We respond within the time limits set by the applicable law and, if we need more time, we will explain why. We do not charge for handling requests, except for manifestly unfounded or excessive requests, where the law permits.
17.8. Appeal: if we decline your request, we will explain why. In states that provide for appeals, such as Virginia, Colorado and Connecticut, you may appeal by replying to our e-mail with the subject “Appeal”. If your appeal is denied, you may lodge a complaint with your state’s Attorney General.
18. Additional information for users in Brazil
18.1. You may file a petition with the ANPD or with consumer protection bodies regarding the processing of your data.
18.2. When requesting access or confirmation, please state whether you prefer the response in electronic or printed form and whether you wish to receive an immediate simplified response or a full statement within 15 days, including the origin of the data, the criteria and the purposes, subject to our commercial and industrial secrets.
18.3. When you request correction, erasure, anonymisation or blocking, we will communicate the request to the third parties with whom we have shared the data, unless this proves impossible or involves disproportionate effort.
19. Acceptance record
19.1. When you accept the Terms of Use or this Policy, we record the version and hash of the document, the server date and time, the IP address, the device model and operating system, the App version, the geolocation, a photo from the front camera and the facial landmarks (face mesh), which confirm that a person was in front of the camera.
19.2. These data are used exclusively to evidence acceptance, are kept in a restricted-access area and are retained for the period set out in Section 10. We do not use the facial landmarks to recognise or identify people. Acceptance is only completed once a face is detected; if you deny location access, acceptance is recorded without it, with an indication of the refusal.
20. Changes to this Policy
20.1. We may update this Policy. Each version is given a number and a date. In the event of a material change, the App will display the new version and ask for your acceptance before you continue. Where the change affects processing based on consent, we will ask for your consent again.
21. Definitions
- Personal data: information relating to an identified or identifiable natural person.
- Sensitive personal data: data concerning racial or ethnic origin, religious belief, political opinion, trade union membership, health, sex life, genetic or biometric data, when linked to a natural person.
- Data subject: the natural person to whom the data relate.
- Controller: the party that makes decisions regarding the processing of personal data.
- Processor (operador under the LGPD): the party that processes personal data on behalf of the controller.
- Processing: any operation performed on personal data, such as collection, use, storage, sharing and erasure.
- Anonymisation: the use of technical means by which data lose the possibility of being associated, directly or indirectly, with a person.
- Usage data: information collected automatically through use of the App, such as IP address, date and time of access, device and operating system characteristics, App version and error logs.
- Tracker: any technology, such as unique identifiers, cookies or scripts, that makes it possible to recognise the device or the user by accessing or storing information on the device.
- Sale: under US state laws, any exchange of personal information with third parties for money or other consideration. Disclosure to providers engaged to perform services on our behalf is not a sale.
- Sharing (US): the disclosure of personal information to third parties for cross-context behavioural advertising, whether or not for monetary consideration.
- Targeted advertising: displaying ads selected on the basis of information obtained from a person’s activities on other companies’ websites or apps.
- European Union: unless otherwise indicated, includes the Member States of the European Union and of the European Economic Area.
22. Contact
Golden XW Sistemas Inteligentes Ltda. — Rua Haiti, nº 129, Parque das Nações, Santo André/SP, CEP 09280-390, Brazil — suporte@wakerapp.com.br.