Privacy Policy — VOST TRACKER

1. Who is the data controller

The controller of your personal data is VOST Portugal – Associação de Voluntários Digitais em Situações de Emergência (VOST Portugal – Association of Digital Volunteers in Emergency Situations; "VOST Portugal", "we"), the entity that develops and provides the VOST TRACKER application.

Privacy point of contact for questions and data-subject requests: [email protected].

2. What VOST TRACKER is and who it is for

VOST TRACKER is an operational location-sharing application for civil-protection operatives and volunteers, used during events and operations coordinated by VOST Portugal. It is not intended for the general public: registration requires approval by an administrator, and position sharing is only possible while the user is assigned to an active event. The application is not intended for anyone under 18 years of age.

3. What data we collect

3.1 Account data (provided by you at registration)

• Full name — identifies you to the operation coordinators;
• Callsign (optional);
• Email address — authentication and password recovery;
• Password — used exclusively for authentication.

3.2 Operational location data (only while sharing is active)

When — and only when — you tap "Start tracking", the application sends, approximately every 5 minutes, a record containing:

• Latitude and longitude (balanced accuracy, in the order of tens to hundreds of metres);
• Estimated accuracy of the position (in metres), when available;
• Device battery percentage — lets coordinators manage the autonomy of teams in the field;
• Date and time of the fix (UTC).

Additional safeguards:

• While sharing is active, a permanent, non-dismissible notification is shown on the device;
• The application does not collect location in the background outside a sharing session you started — it does not use Android's background-location permission;
• Sharing stops immediately when you tap "Stop tracking" or revoke the location permission;
• Simulated positions (mock locations) are rejected and never sent.

3.3 Data stored locally on your device

• Authentication session (token), basic profile, server address and chosen language;
• A temporary queue of positions not yet uploaded (maximum 500 records), used when there is no Internet connection; each record is deleted as soon as it is delivered to the server.

3.4 What we do not collect

The application does not collect device identifiers (IMEI, advertising ID, serial number), contacts, photos, microphone, camera, SMS, or the list of installed apps. It integrates no analytics, advertising, third-party tracking or third-party crash-reporting services. The only third-party component used is the Google Play Services location service (Fused Location Provider), used solely, on the device itself, to obtain your position while sharing is active.

4. Purposes and legal bases (GDPR)

• Account creation and management (name, callsign, email, password) — performance of the service-use agreement (Art. 6(1)(b) GDPR);
• Position sharing during operations (location, accuracy, battery, time) — your consent (Art. 6(1)(a) GDPR), expressed by the action of starting the sharing; you may withdraw it at any time by stopping the sharing, without affecting the lawfulness of prior processing;
• Network and service security and compliance with legal obligations — legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR), where applicable.

Your data is not used for advertising or for automated decisions with legal effects.

5. Who we share the data with

• VOST Portugal coordinators and administrators — they see your name, callsign and positions on the operations map; administrators also see your email address for account management;
• Official entities responsible for coordinating the civil-protection operation you take part in — they may receive operatives' positions strictly for operational-coordination purposes;
• Public authorities, where required by law;
• Server hosting providers (processors within the meaning of the GDPR), strictly for the technical operation of the service.

We do not sell personal data, do not share it with advertisers, and do not use it for commercial purposes. No data is transferred outside the European Economic Area.

6. How long we keep the data

• GPS positions — kept only for the duration of the event/operation they relate to, and deleted when the event is closed;
• Account data — kept while the account is active; deleted when the account is deleted;
• Local data on the device — the session is cleared on sign-out; you can remove all local data by uninstalling the application or clearing the app's data in Android settings.

7. Account and data deletion

You can delete your account and all associated data at any time, in either of two ways:

• In the app itself — the "Delete account" button on the sharing screen, with confirmation; deletion is immediate;
• By email — send a request to [email protected] from the address you registered with, using the subject "Account deletion — VOST TRACKER".

Deletion covers the account and all associated personal data. If any data must be retained due to a legal obligation or for security reasons, we will inform you of the period and the grounds. Account deletion is not replaced by mere deactivation.

8. Android permissions used

9. Security

• All communication with the server uses HTTPS/TLS; unencrypted connections are blocked by the application itself;
• Access to data on the server is restricted to approved administrators, on a need-to-know basis;
• We collect only the minimum data necessary for the operational purpose (data minimisation).

10. Your rights

Under the GDPR, you have the right to:

• Access your data and obtain a copy;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time (by stopping position sharing).

To exercise any of these rights, contact [email protected]. We reply within one month at most. You also have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with your local data protection authority.

11. Changes to this policy

We may update this policy to reflect changes in the application or in legislation. Relevant changes will be communicated on this page, with an updated effective date, and, where required, within the application itself.

12. Contact

VOST Portugal – Associação de Voluntários Digitais em Situações de Emergência
Email (privacy): [email protected]
Website: vost.pt