Privacy Policy

Deltra is a private chauffeur company. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with and how long we keep it — across our driver application, our dispatch platform and the deltra.is website.

1. Who we are

The data controller responsible for the personal data described in this policy is:

For any question about this policy, to exercise your rights, or to make a privacy complaint, write to bokanir@deltra-taxi.is with "Privacy" in the subject line. We answer privacy requests within one month, as required by the GDPR.

We are established in Iceland and process personal data under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") as incorporated into Icelandic law by Act No. 90/2018 on Data Protection and the Processing of Personal Data.

2. Who this policy covers

3. The Deltra driver app

The Deltra app (published as Deltra on the App Store and Google Play) is a work tool for drivers and operations staff engaged by Deltra. It has no public sign-up: an account is created for you by our office, and you sign in with the credentials we issue. You must be an authorised Deltra driver or member of staff to use it.

3.1 Account and identity data

Held in our user register and shown to you in the app's profile screen:

• Email address (this is also your username) and a securely hashed password.
• Name and display name.
• Telephone number.
• Kennitala (Icelandic national identification number).
• Bank account details, used to settle payments to you.
• Taxi station and station licence number, which appear on pickup manifests.
• Profile photograph, if you upload one.
• Role assignments (for example driver, or administrator) and the date the account was created.
• An airside access flag recording whether you hold a Keflavík airside pass.

You can view and edit your own name, display name, email address, telephone number, kennitala, station, station number and profile photograph from the app's profile screen. You cannot edit another person's record.

3.2 Vehicle information

For each vehicle you register: make, model, sub-type, year, colour, passenger capacity, registration plate and a photograph of the vehicle. Vehicle registration plates identify a vehicle rather than a person, but because each vehicle is registered to a named driver we treat this information as personal data relating to you.

3.3 Photographs

The app asks for access to your camera and photo library only so that you can take or choose a profile photograph and photographs of your vehicle. Images are uploaded to our servers and stored with your driver or vehicle record. We accept JPG, PNG, WEBP and HEIC images up to 10 MB. We do not read, index or scan any other photo on your device, and we do not access your camera at any other time.

3.4 Push notifications and device data

When a journey is assigned to you we send a push notification to your device. To do that we store, against your account, the push notification token issued to your app installation by Firebase Cloud Messaging, the platform it belongs to (ios or android), and the time it was last refreshed. The notification itself carries the job reference, the journey title, the date and the flight or aircraft registration.

Signing out of the app deletes the token from your account, and the device stops receiving notifications. You can also turn notifications off in your device settings; the rest of the app continues to work.

3.5 Data stored on your own device

• Your sign-in token, held in the operating system's secure store (Keychain on iOS, Keystore on Android). It expires after 7 days and is deleted when you sign out.
• A queue of recorded trip positions awaiting upload, held in a local database so that a journey driven through an area with no signal is still complete. Each position is deleted from the queue as soon as our server confirms receipt.
• A flag recording that you have seen the permissions introduction screens.

On Android the app is excluded from cloud backup, so none of this is copied to Google Drive.

3.6 What the app does not collect

The app contains no advertising SDK, no analytics SDK and no tracking SDK. It does not collect your contacts, calendar, messages, call history, browsing activity, health data, microphone audio, or any advertising identifier. We do not track you across other companies' apps or websites, and we never sell personal data.

4. Location data, including background location

Continuous location is the core function of this app. It exists so that our operations desk can see which car is closest to a movement that has just changed, so that we can find and assist a driver who needs help, and so that every journey has a factual record rather than a recollection. Two separate things happen with location, and they are described separately below.

4.1 Live position, shown to dispatch

While you are signed in, the app sends your current position to our server approximately twice per second over an encrypted connection. Each reading contains latitude, longitude, direction of travel, speed, the accuracy reported by the device, and a timestamp.

• These readings are held in the server's memory only — they are not written to our database.
• They are shown on a fleet map to Deltra staff holding an administrator role. Ordinary drivers cannot see any map of other drivers, and cannot see your position.
• When you sign out or lose connection, your last known position remains on the map, marked as offline and labelled with how long ago it was recorded, for up to 7 days. After that it is discarded.

Because these readings are held only in memory, they are also lost whenever the server restarts.

4.2 Recorded journeys

When you start a journey in the app ("Hefja ferð") the app records the route until you end it ("Ljúka ferð"). A position is saved roughly every 3 seconds — and only when the vehicle has moved at least 15 metres or 30 seconds have passed — so waiting at a gate costs a handful of points rather than hundreds. Each recorded position holds latitude, longitude, speed, heading, accuracy and the time your device recorded it.

For the journey as a whole we store:

• the job it relates to and the driver who drove it;
• start and end times, taken from our server's clock;
• how the journey ended — you ended it, you cancelled it, or it was closed automatically;
• start and end coordinates, total distance, duration, average speed and maximum speed;
• the number of positions recorded and the sampling interval used;
• the registration plate of the vehicle at the time of the journey.

A journey you cancel is excluded from history and its recorded positions are deleted. A journey left open by mistake is closed automatically after 4 hours. If you never start a journey in the app, no route is recorded for it.

4.3 If you decline location access

You can refuse or later withdraw the location permission in your device settings. If you do, the app will no longer report your position or record routes, but you can still sign in, see and accept or decline the jobs assigned to you, view your journey list, and manage your profile and vehicles. Note that live position and journey records are part of how Deltra operates, so declining location access is a matter to discuss with our operations desk.

4.4 Maps

Map backgrounds in the app are supplied by Mapbox. When a map is displayed, your device requests map tiles directly from Mapbox, which necessarily reveals your device's IP address and the area of the map you are viewing to Mapbox. Mapbox does not receive your Deltra account details or your recorded journeys.

Our back-office fleet map does not use Mapbox. It draws satellite imagery from Esri (World Imagery), which on the same basis receives the IP address of the office computer displaying the map and the map area shown.

5. Booking and passenger data

Our dispatch platform holds the details necessary to carry out a transfer. In most cases the booking is made by a ground handler, airline, hotel, agency or private office rather than by the passenger, and the data reaches us from them.

5.1 What we hold about a journey

• Passenger name where one is given, and the number of people travelling;
• whether the party is passengers, crew, or both;
• pickup and destination, date and time;
• flight number, aircraft registration or call sign, and stand number;
• whether a general declaration or immigration slot is required, and its time;
• free-text notes added by the booker or our office;
• the client's booking reference, the price, VAT, payment method and invoice status;
• which drivers were assigned, whether they accepted, and any recorded journey.

5.2 What we hold about the person or company who books

• Contact name, telephone number and email address;
• company name, registration number (kennitala), address, postcode and city;
• the person responsible for the account and the address invoices are sent to.

We keep a record of changes to an order, and of who deleted an order and when, as an audit trail.

5.3 Calendar synchronisation

Confirmed journeys are written to Deltra's own Microsoft 365 booking calendar, and some correspondence is sent from our Microsoft 365 mailbox. This means booking details are also processed by Microsoft as our provider of email and calendar services.

6. The deltra.is website and cookies

deltra.is hosts our public pages and our staff back-office. You can read this policy, our Terms of Use and our public pages without signing in and without accepting any cookie.

6.1 Server logs

Like any web server, ours records technical information about requests it receives: the IP address, the time, the page requested, the response, and the browser's user-agent string. These logs exist to keep the service running and secure. They are written to daily files and older files are discarded automatically, so a log entry is normally retained for about 31 days.

6.2 Cookies

We use only strictly necessary cookies. We do not use advertising cookies, analytics cookies, social-media pixels or any other tracking technology, and there is therefore no consent banner.

6.3 Enquiry and quote forms

If you send us an enquiry or request a quote — by email, or through an enquiry or quote form on our website — we receive whatever you choose to tell us, typically your name, email address, telephone number and the details of the journey you want. We use it to answer you and, if you go on to book, to carry out the booking. Where a form is used we also record the IP address of the submitting device for a short period, solely to limit automated abuse of that form.

7. Legal bases for processing

7.1 Our balancing test for location data

We rely on legitimate interests rather than consent for location data, because consent given by a person to their employer is rarely freely given and could not be withdrawn without consequence — which would make it invalid. We consider it more honest to name the real basis and to accept the obligations that come with it. In reaching that conclusion we took the following into account, and we invite you to challenge any of it:

• Necessity. A dispatch operation cannot send the nearest car to a changed movement without knowing where the cars are, and a journey record cannot be produced after the fact.
• Proportionality. Live positions are held in memory only and are not written to our database. Only the last known position survives a disconnection, and only for 7 days.
• Limited audience. The fleet map is restricted to administrators. One driver cannot see another driver's position.
• No hidden collection. Collection begins when you sign in and stops when you sign out. Android shows a permanent notification while location is being reported; iOS shows the system location indicator.
• No secondary use. We do not use location for advertising, we do not sell it, and we do not use it to make automated decisions about you.
• Your right to object. You may object at any time under Article 21 — see section 12.

A written summary of this assessment is available from bokanir@deltra-taxi.is on request.

7.2 Electronic monitoring (rafræn vöktun)

Tracking the position of a vehicle driven by a named person is electronic monitoring under Article 14 of Act No. 90/2018 and the Rules on Electronic Monitoring No. 50/2023 (as amended by Rules No. 1329/2025). We therefore also observe the additional duties those rules impose:

• monitoring is carried out for a stated, lawful purpose — dispatch, driver safety and accurate journey records — and not for any other purpose;
• you are told clearly, before monitoring begins, that it takes place, why, who sees the data and how long it is kept — that is the purpose of this policy and of the notices shown in the app when you first grant location access;
• the data is not used to monitor your work performance or productivity;
• recordings are not disclosed to third parties except as set out in section 8, or to the police in the investigation of a criminal offence or an accident;
• you may ask to see the data recorded about you.

Monitoring takes place only while you are signed in to the app, and only through a device you hold. It stops when you sign out. Deltra does not monitor privately owned vehicles outside working time. If you use a vehicle that carries the Deltra app for private journeys, sign out of the app before you do.

8. Who we share data with

We do not sell personal data and we do not share it with advertising networks or data brokers. We share it only with the recipients below, and with public authorities where the law requires it.

Where a recipient processes personal data on our instructions — our hosting, email and calendar provider and our push notification provider — it does so as our processor under a written data processing agreement, and is not permitted to use the data for its own purposes. The map and imagery providers are contacted directly by the device displaying the map and receive only the technical request data described in section 4.4; they act as independent controllers under their own terms. Our accountant and auditors act under their own statutory duties.

Each third party with whom we share personal data is required, by contract or by its own binding terms, to provide the same or equivalent protection of that data as is set out in this Privacy Policy and as required by the GDPR. We review that commitment before adding any provider, and we do not share personal data with a provider that will not give it.

Clients who book with us are told which driver will collect their party, and the driver is given the details of the journey they are assigned. Where a client account requires it, a driver's name may appear on a pickup manifest.

9. International transfers

Our servers and database are located within the European Economic Area (Microsoft's West Europe region). Some of the providers named above are established in the United States and may process limited data there or in other countries. Where that happens we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses together with any additional safeguards required. You can ask us for a copy of the safeguards that apply to a particular transfer.

10. How long we keep data

11. How we protect data

• All traffic between the app, the website and our servers is encrypted with TLS (HTTPS and WSS). The app will not connect over an unencrypted channel.
• Passwords are stored only as salted hashes, using the standard ASP.NET Core Identity implementation. Nobody at Deltra can read your password.
• The app authenticates with a signed token that expires after 7 days and is held in the device's hardware-backed secure store.
• Access is controlled by role. The fleet map, the driver roster and drivers' telephone numbers are restricted to administrators; a driver sees only their own data and the jobs assigned to them.
• Uploaded images are restricted by type and size and are re-encoded on upload.
• Our database and application are hosted on Microsoft Azure with encryption at rest and access limited to named administrators.
• Web forms are protected against cross-site request forgery, and public form submissions are rate-limited per client.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Persónuvernd within 72 hours and inform you directly where the law requires it.

12. Your rights

Under the GDPR you have the right to:

• Be informed — which is the purpose of this document.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data where we no longer have a valid reason to keep it.
• Restriction of processing while a dispute about accuracy or legitimate interests is resolved.
• Data portability — to receive data you provided to us in a machine-readable format, or have it sent to another controller.
• Object, at any time and on grounds relating to your particular situation, to processing we carry out on the basis of legitimate interests — which includes location tracking and journey recording. If you object, we must stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent at any time, where we have relied on consent.
• Complain to a supervisory authority — see section 17.

To exercise any of these rights, write to bokanir@deltra-taxi.is. We will respond within one month, and will tell you if we need longer because a request is complex. There is no charge. We may ask you to confirm your identity before we release personal data.

13. Stopping collection and deleting data

13.1 Stopping location collection

You can stop the app collecting your location in any of these ways:

• Sign out of the app. Reporting stops immediately, and your push notification token is deleted from your account.
• Withdraw the location permission in your device settings — on iOS, Settings › Privacy & Security › Location Services › Deltra; on Android, Settings › Apps › Deltra › Permissions › Location.
• Uninstall the app. This removes everything the app stored on your device.

Uninstalling the app does not delete the data already held on our servers. To have that deleted, use the process below.

13.2 Deleting your account and data

Deltra accounts are created and administered by our office; you cannot create one yourself from within the app. To have your account and the personal data associated with it deleted, send a request from your registered email address to bokanir@deltra-taxi.is with the subject "Account deletion", or ask our operations desk.

We will confirm receipt, verify that the request comes from you, and complete the deletion within 30 days. We will confirm in writing when it is done. Deleting your account removes your profile, your vehicle records, your photographs, your push notification token and your recorded journeys.

We must keep a limited set of records after deletion where the law requires it — principally invoices and settlement records, which the Bookkeeping Act requires us to hold for seven years, and any record needed to establish or defend a legal claim. We will tell you specifically what has been retained and why.

14. Automated decisions and profiling

We do not make decisions about you that produce legal or similarly significant effects on the basis of automated processing alone.

Our dispatch system does rank available drivers by distance to a pickup, as an aid to the person on the desk. A human being decides who is assigned each job, and can and does depart from the suggested order. We do not use location data or journey records to assess or score driver performance automatically.

15. Children

The Deltra app is a professional tool for licensed drivers and is not directed at children. We do not knowingly collect personal data from anyone under 18 through the app. Passengers travelling with us may of course be children; in that case we hold only the booking details that the booker provides, and nothing more.

16. Changes to this policy

We may update this policy as our service changes or the law develops. The date it was last changed is shown at the top of this page, and the current version always lives at https://deltra.is/privacy. If a change materially affects how we use your personal data, we will notify drivers and staff directly through the app or by email before it takes effect.

17. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at bokanir@deltra-taxi.is — we would rather put it right. You also have the right to lodge a complaint at any time with the Icelandic Data Protection Authority: