Privacy Policy.

1. Data Controller

RootPlus is operated by Hanna Pixels d.o.o. (“Hanna Pixels”, “RootPlus”, “we”, “us”, or “our”).

This Privacy Policy explains how we collect, use, store, transmit, share and otherwise process personal data in connection with the RootPlus application, websites, APIs, navigation services and related services.

By using RootPlus, you acknowledge that personal data may be processed as described in this Privacy Policy. Where applicable law requires consent, consent will be requested separately.

Nothing in this Privacy Policy limits any mandatory rights granted under applicable data-protection or consumer-protection legislation.

2. Scope

This Privacy Policy applies to personal data processed through the RootPlus mobile application, RootPlus websites and APIs, account systems, route planning, navigation, vehicle profiles, travel-cost calculations, Dashcam functionality, parking-related features, subscriptions, customer support and associated technical infrastructure.

Third-party websites, applications or services accessed through RootPlus may operate under their own terms and privacy policies and may act as independent data controllers where applicable.

3. Categories of Data We May Process

Depending on how you use RootPlus, we may process:

• Account information including email address, internal account identifier, authentication information, account status and subscription entitlement.
• Precise or approximate location data, including GPS coordinates, current position, origin, destination, waypoints, movement and navigation progress.
• Route information including routing requests, selected route, routing parameters, parking queries, toll-related information, destination searches and navigation preferences.
• Vehicle information including vehicle name, category, fuel type, fuel consumption, electricity consumption, dimensions, weight and other vehicle settings.
• Camera information where Dashcam or another camera-dependent feature is voluntarily enabled.
• Road reports you submit (type of report, position and time) and your confirmations or corrections of existing reports, stored with a pseudonymous identifier instead of your name.
• Device and technical information including device model, operating-system version, RootPlus version, IP address, network information, timestamps, diagnostics, error information and security logs.
• Information necessary for Bluetooth, audio, notifications or other device functions requested by the user.
• Transaction identifiers, product identifiers, subscription status, entitlement status, purchase date and expiration data received from authorised app-store providers.

RootPlus does not receive or store complete payment-card numbers where payments are processed by Google Play, Apple App Store or another authorised payment platform.

4. Location Data

Location processing is fundamental to many RootPlus functions.

RootPlus may access precise location while the application is in use and, where enabled by the user and permitted by the operating system, while navigation or another location-dependent feature remains active in the background.

Location may be used to determine your position, calculate or recalculate routes, provide navigation, identify relevant roads, estimate road-related charges or costs, provide parking information and display location-dependent warnings.

Disabling location permission may prevent navigation and other location-dependent functions from operating correctly.

5. Routing and Mapping Providers

To provide routing, mapping, geocoding and road-related functionality, RootPlus may transmit information necessary to perform a requested operation to external service providers.

Information transmitted may include origin, destination, waypoints, vehicle characteristics and routing options.

Providers may include mapping, routing, traffic, geocoding, toll, parking or road-data providers used by RootPlus from time to time. Routes and prices are currently calculated on the RootPlus server.

We seek to transmit only information reasonably necessary to perform the requested operation.

Where a third-party provider acts as our processor, applicable contractual and data-protection safeguards apply. Where a provider acts as an independent controller, its own privacy policy governs its independent processing.

Cameras, fuel stations, charging points and average-speed sections are served by the RootPlus server. The apps do not send your location to OpenStreetMap or other public map-data services; the RootPlus server retrieves OpenStreetMap data by map area only, without any information about you. Sources and licences are listed at rootplus.eu/map-data.html.

6. Dashcam and Camera Data

Camera access is optional and is requested only where a camera-dependent function is activated.

RootPlus Dashcam functionality may process video, timestamps, GPS coordinates and vehicle speed where those functions are enabled.

Unless RootPlus explicitly states otherwise within the application, Dashcam recordings are intended to remain stored locally on the user's device and are not intentionally uploaded to RootPlus servers.

Recordings may incidentally contain people, vehicle registration plates, buildings, private property or other information visible to the camera.

7. Purposes of Processing

We may process personal data where necessary to:

• Create, authenticate and maintain RootPlus accounts.
• Provide route planning and navigation.
• Calculate routes and estimated travel costs.
• Maintain vehicle profiles and user preferences.
• Provide parking, toll and road-related functionality.
• Provide Dashcam, camera, audio and notification features.
• Verify subscriptions and premium entitlements.
• Provide customer support.
• Detect fraud, misuse or security incidents.
• Diagnose errors and maintain service reliability.
• Protect RootPlus systems and infrastructure.
• Comply with legal obligations.
• Establish, exercise or defend legal claims.

We may use aggregated or irreversibly anonymised information for statistics, performance analysis, capacity planning and service development where such information no longer reasonably identifies an individual.

RootPlus does not sell personal data and does not intentionally use personal data for targeted behavioural advertising.

8. Legal Bases Under GDPR

Performance of a contract

Processing may be necessary to provide RootPlus functionality requested by you, including account, routing, navigation and subscription functionality.

Consent

Where applicable law requires consent for optional processing, consent will be requested separately. Consent may be withdrawn at any time without affecting the lawfulness of processing performed before withdrawal.

Legitimate interests

Processing may be based on our legitimate interests where reasonably necessary for security, fraud prevention, abuse prevention, diagnostics, service continuity, maintenance and protection or defence of legal claims, provided those interests are not overridden by your rights and freedoms.

Legal obligations

Personal data may be processed where necessary to comply with applicable legal obligations.

9. App Permissions

Depending on the features you use, RootPlus may request operating system permission for precise location, background location, camera, notifications, Bluetooth or nearby devices, media or storage, and other functionality required for specific features.

You may revoke permissions through your device settings. Features dependent on a revoked permission may cease to function correctly.

10. Google Play and Apple Services

RootPlus may be distributed through Google Play and Apple App Store.

Google and Apple may independently process information concerning installations, purchases, devices, crashes and account activity under their own privacy policies.

Payments made through an authorised application store are processed by the applicable platform provider. RootPlus may receive purchase confirmations, transaction identifiers and subscription-entitlement information but does not receive your complete payment-card information.

11. Server and Technical Logs

Our infrastructure may automatically process technical information including IP address, request time, endpoint requested, response status, RootPlus version, device information, diagnostics and security events.

This information may be used to diagnose technical problems, prevent abuse, protect RootPlus, maintain service reliability and investigate security incidents.

Relevant security records may be retained for longer periods where reasonably necessary to investigate suspected abuse, fraud, security incidents or legal claims.

12. Analytics and Advertising Identifiers

Only with your consent, RootPlus uses Google Analytics on rootplus.eu and Google Analytics for Firebase in the RootPlus Android app to understand, in aggregate, how the website and the app are used: for example which pages or screens are opened, the browser or device type, the operating system, the app version and the approximate country or city. Analytics stays off until you agree, and declining does not limit any feature.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the United States under the EU–U.S. Data Privacy Framework. RootPlus does not send your name, e-mail address, account identifier, precise location, routes or Dashcam recordings to analytics and does not use analytics data for advertising.

The legal basis is your consent (Article 6(1)(a) GDPR and the rules on storing information on your device). You can withdraw it at any time, with effect for the future: on the website under “Cookie settings” at the bottom of every page, and in the Android app under Settings → Privacy → Usage statistics. On the website, the cookies _ga and _ga_WVEM9L7EFR (up to 2 years) are set only after you accept; your choice itself is stored in your browser. Analytics data is kept for at most 14 months.

RootPlus does not intentionally use the Android Advertising ID or equivalent device identifiers for targeted advertising.

If RootPlus introduces advertising or functionality requiring an advertising identifier in the future, applicable disclosures and this Privacy Policy will be updated before such processing occurs, and consent will be obtained where legally required.

13. Sharing and Disclosure

We may disclose personal data only where reasonably necessary to provide or protect RootPlus, including to infrastructure providers, routing and mapping providers, application-store providers, payment providers, technical service providers and professional advisers.

Information may also be disclosed where required by applicable law, court order, competent regulatory authority or lawful governmental request.

We may disclose information where reasonably necessary to protect Hanna Pixels d.o.o., RootPlus, our users, property, systems or legal rights, investigate fraud or misuse, or establish, exercise or defend legal claims.

If RootPlus or relevant business assets are transferred through a merger, acquisition, restructuring or sale, personal data may form part of that transaction subject to applicable law.

Road and camera reports you submit are shown to other RootPlus users without your name or account details.

We do not sell personal data to data brokers or advertisers.

14. International Data Transfers

Some RootPlus service providers may process information outside Croatia or outside the European Economic Area.

Where GDPR requires safeguards for such transfers, we may rely on an applicable adequacy decision, Standard Contractual Clauses, another approved transfer mechanism or another lawful basis permitted under applicable law.

15. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy or where retention is required or permitted by law.

Account information may generally be retained while an account remains active.

Technical, diagnostic or routing data may be retained for shorter periods depending on operational, security and troubleshooting requirements.

Financial, tax, accounting and transaction records may be retained for periods required under applicable law.

Information necessary to prevent abuse, enforce agreements or establish, exercise or defend legal claims may be retained for the applicable limitation period where legally permitted.

Following account deletion, residual copies may remain temporarily in routine backup systems until the applicable backup is overwritten during the normal backup lifecycle.

If RootPlus is discontinued (Terms of Use, section 29), we delete accounts, vehicles, saved places, reports and other personal data within 30 days after the announced end date. Only records we must keep by law, such as accounting and tax records, are kept for the period the law requires and are then deleted.

Where information has been irreversibly anonymised so that it no longer identifies an individual, it may be retained without the limitations applicable to personal data.

16. Account and Data Deletion

Users who create a RootPlus account may request deletion of the account and associated personal data.

Where available, account deletion may be initiated directly through the RootPlus application.

A deletion request may also be submitted using the account-deletion procedure published on the RootPlus website or by contacting:

Following a valid request, personal data associated with the account will be deleted or irreversibly anonymised unless retention is required or legally permitted for accounting, tax, security, fraud-prevention, dispute-resolution, contractual or legal-claim purposes.

Account deletion does not necessarily cancel an active subscription billed through Google Play or Apple App Store. Store subscriptions may need to be separately cancelled through the applicable platform.

17. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, disclosure or misuse.

Measures may include authentication, restricted administrative access, encrypted network transport where appropriate, backups, security monitoring and software-maintenance procedures.

To the maximum extent permitted by applicable law, we do not guarantee that the Service will be immune from every security incident, interruption, loss or unauthorised access. Nothing in this statement excludes obligations or liability that cannot legally be excluded.

18. User Responsibilities

You are responsible for maintaining the security of your device, RootPlus account credentials and information stored locally on your device.

You should not disclose your account credentials to unauthorised persons.

If you believe your RootPlus account has been compromised, contact us at privacy@rootplus.eu .

19. Driving, Safety and Navigation Data

RootPlus provides informational, route-planning and navigation-assistance functionality.

Routing, traffic, mapping, parking, toll, road restriction, speed-limit, warning, camera and other driving-related information may be incomplete, delayed, outdated or inaccurate.

Processing of location or related information does not create any guarantee regarding the accuracy, availability or suitability of navigation information.

Broader limitations of liability relating to driving, route calculation, tolls, parking, warnings, road restrictions and other RootPlus functions are governed by the RootPlus Terms of Use and applicable mandatory law.

20. Automated Processing

RootPlus may automatically calculate routes, estimated costs, warnings, vehicle-related information and other navigation results using user-provided information and available datasets.

Such processing is intended to provide requested RootPlus functionality and is not intended to constitute automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

21. Your Data-Protection Rights

Where GDPR applies, you may have the right to:

• Request access to personal data concerning you.
• Request correction of inaccurate personal data.
• Request deletion of personal data.
• Request restriction of processing.
• Object to certain processing based on legitimate interests.
• Request applicable data portability.
• Withdraw consent where processing is based on consent.

Requests may be submitted to privacy@rootplus.eu .

We may reasonably verify your identity before acting on a request where necessary to protect your account or personal data.

We may decline or limit a request where permitted by applicable law, including where a request is manifestly unfounded or excessive or where continued retention is legally required.

You also have the right to lodge a complaint with a competent supervisory authority. In Croatia, the competent supervisory authority is the Croatian Personal Data Protection Agency (AZOP).

22. Children's Privacy

RootPlus is not specifically designed or directed at children.

We do not knowingly seek to process personal data from children in circumstances where parental or guardian authorisation is legally required without the required authorisation.

If you believe personal data relating to a child has been processed contrary to applicable law, contact privacy@rootplus.eu .

23. Third-Party Links and Services

RootPlus may contain links to or integrations with external websites, applications, platforms or services.

We are not responsible for the privacy practices of independent third parties. Users should review the applicable privacy policies of those services.

This provision does not limit our responsibilities where a third-party provider processes personal data on our behalf as our processor.

24. Service Changes and New Features

RootPlus is under active development.

Features, service providers, categories of processed data and purposes of processing may change over time.

Where a change materially affects how personal data is processed, this Privacy Policy will be updated as required by applicable law.

If a new processing activity legally requires consent, consent will be requested separately.

25. Changes to This Privacy Policy

We may modify this Privacy Policy to reflect changes in RootPlus, applicable law, application-store requirements, service providers or our data-processing practices.

The current version will be published on the RootPlus website.

The “Last updated” date shown at the top of this page identifies the latest revision.

Where required by applicable law, users will receive additional notice of material changes.

Continued use of RootPlus does not constitute consent where applicable law requires separate affirmative consent.

26. No Waiver of Mandatory Rights

Nothing in this Privacy Policy is intended to exclude, restrict or waive any right, remedy, obligation or liability that cannot lawfully be excluded or restricted under GDPR, Croatian law, applicable EU consumer law or other mandatory legislation.

If any provision of this Privacy Policy is found invalid, unenforceable or inapplicable, the remaining provisions remain effective to the maximum extent permitted by applicable law.

27. Contact

For privacy questions, data-protection requests, account deletion requests or concerns regarding the processing of personal data: