SmartRoutes

GDPR overview

GDPR compliance is claimed explicitly: the privacy policy, last updated March 2026, states that SmartRoutes adheres to the principles of EU Regulation 2016/679, and lists the seven data subject rights — access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making. Requests are made by email to info@smartroutes.io, with a stated 30-day response, and the right to complain to a local supervisory authority is set out. Transfers outside the EEA are covered by Standard Contractual Clauses approved by the European Commission. Two gaps qualify this: no Data Protection Officer is named, the heading pointing to the same general mailbox; and the terms and conditions, still dated 24 February 2020, have never been aligned with the policy. As an Irish company, the publisher needs no Article 27 representative.

Who owns the data?

The terms and conditions, dated 24 February 2020, reserve the intellectual property in the Service itself to Smart Routes Ltd but say nothing about the operational data customers upload — orders, addresses, delivery proofs. No clause assigns that content, and none confirms it stays with the customer. The privacy policy, updated March 2026, is narrower but clearer: personal identification information is never sold, traded or rented to others, and Android location data is neither sold nor shared with third parties. Only aggregated, non-identifying data may reach partners and advertisers. In short, the handling of personal data is stated; contractual ownership of customer content is not.

Reuse rights

The published documents describe how SmartRoutes uses data, not how a customer may reuse it: no clause grants, restricts or conditions the reuse of the records you enter, so nothing on the site asks you to seek permission before exporting and reusing your own orders, routes or delivery reports — but that is silence rather than a written right. On the company's side, the declared purposes are improving customer service, personalising the experience, processing payments and sending periodic emails, on the legal bases of consent, performance of the contract, legal obligation and legitimate interest. Where a driver consents, device location is tracked so the system can re-optimise routes from the current position and produce planned-versus-actual reports. Email addresses, payment card details, non-identifying browsing data and cookies are collected, and Google reCAPTCHA runs on the site. Nothing anywhere states whether customer data is used to train AI models, in either direction.

Data retention & training

Hosting summary

No hosting location is declared anywhere. Neither the privacy policy, nor the terms and conditions, nor any other page names a country, a region or a data centre, and the site has no trust or security section. The only indication is indirect and comes from network checks rather than from the publisher: the domain resolves to 52.51.90.21, an AWS EC2 instance in the eu-west-1 region (Dublin, Ireland), served by Route 53 name servers. That is an inference, not a statement by Smart Routes Ltd, so no hosting country is recorded in this listing. The privacy policy does confirm that transfers outside the EEA take place and are covered by Standard Contractual Clauses approved by the European Commission: transfers exist, but the primary location is never given. On security the policy is more concrete — exchanges between the site and its users run over an SSL-secured channel, encrypted and protected with digital signatures, and passwords are never stored in the database but hashed with individual salts. No certification is published, neither ISO 27001 nor SOC 2, and no subprocessor list or data processing agreement is offered.