Privacy Policy

1. Introduction

This Privacy Policy explains how OneRD Pty Ltd, an Australian company trading as OneRoad ("OneRoad", "we", "our", or "us"), collects, uses, discloses, retains, protects, and otherwise processes Personal Data when individuals access or use the OneRoad Solution, visit our websites, including https://www.oneroad-us.io/, purchase or subscribe to our products or services, communicate with us, or otherwise interact with our U.S. operations.

For purposes of this Privacy Policy, the "OneRoad Solution" includes, as applicable:

• mobile applications and web-based platforms or portals;
• Electronic Logging Device (ELD), fleet management, telematics, compliance, reporting, maintenance, mass-management, safety, and analytics functionality;
• OBx, OBD/OBD-II, telematics, sensor, and other vehicle-connected hardware supplied or approved for use with OneRoad;
• Supplier-provided OEM firmware, Bluetooth-enabled device functionality, approved peripherals, and related device-side services;
• artificial intelligence-assisted insights, predictions, analytics, recommendations, and support features;
• integrations with third-party hardware, software, cloud, telecommunications, payment, mapping, location, support, and partner systems; and
• related sales, presale, onboarding, support, account, billing, marketing, and administrative services.

This Privacy Policy is intended to provide a U.S.-wide privacy baseline. It is designed to address the Texas Data Privacy and Security Act (TDPSA), California Online Privacy Protection Act (CalOPPA), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) where applicable, and other U.S. federal and state privacy requirements that apply to OneRoad's activities from time to time.

2. Relationship with Other OneRoad Documents

This Privacy Policy should be read together with:

• the OneRoad U.S. Presale Terms and Conditions and any later U.S. Platform Terms and Conditions;
• the OneRoad End User Licence Agreement (EULA), where applicable;
• any product, module, device, subscription, order-form, support, or integration-specific terms;
• any Notice at Collection, Cookie Notice, consent, authorization, or state privacy supplement presented at or before collection; and
• any separate privacy terms agreed with an organizational customer.

If a more specific privacy notice or consent applies to a particular collection or processing activity, that notice or consent will control to the extent of any inconsistency regarding that activity.

3. Personal Data We Collect

The categories of Personal Data we collect depend on the products, modules, devices, integrations, websites, and services used; whether the individual interacts with OneRoad personally or through an employer, fleet, carrier, contractor, or other organization; and how the relevant account is configured.

3.1 Identity and Contact Information

• name, email address, telephone number, postal or billing address;
• username, account identifier, login or authentication information;
• business, employer, carrier, fleet, depot, workshop, or contractor affiliation; and
• job title, role, function, or organizational relationship.

3.2 Account, Subscription, and Commercial Information

• account registration and onboarding information;
• user role, permissions, administrator assignments, and account status;
• subscription plan, vehicle count, device allocation, order, presale, purchase, and cancellation records;
• billing contacts, invoice information, payment status, transaction references, and purchase history; and
• customer-service, sales, and account-management records.

3.3 Driver, Compliance, and Credential Information

• driver license details and identifiers;
• hours-of-service, work/rest, ELD, duty-status, certification, annotation, and compliance records;
• carrier, motor-carrier, or regulatory identifiers associated with use of the OneRoad Solution;
• training, competency, authorization, accreditation, or compliance-related records; and
• fitness-to-drive, medical certification, or other health-related information only where lawfully collected and reasonably necessary for an enabled feature or organizational workflow.

3.4 Vehicle, Telematics, Location, and Operational Information

• vehicle, trailer, equipment, and device identifiers;
• vehicle location, route, movement, speed, ignition, engine, odometer, diagnostic, and event data;
• precise geolocation and GPS/GNSS information where enabled;
• sensor, maintenance, inspection, load, mass, safety, temperature, pressure, and other operational data;
• trip, dispatch, logistics, routing, delivery, and fleet activity records; and
• data generated or transmitted through Approved Devices, Approved Peripherals, OEM Firmware, Bluetooth Functionality, and integrations.

3.5 Technical, Usage, and Diagnostic Information

• device model, operating system, browser, app version, IP address, device identifiers, and network information;
• session records, feature usage, clickstream, authentication, access, security, and audit logs;
• crash reports, error logs, diagnostics, firmware version, device status, connectivity, pairing, and support data; and
• cookie, SDK, pixel, local storage, and similar online-technology information where used.

3.6 Communications and Support Information

• support tickets, help-desk records, emails, call notes, chat messages, complaint details, and escalation records;
• feedback, survey responses, product requests, and customer communications; and
• photos, screenshots, files, or diagnostic material provided to support or investigate an issue.

3.7 Marketing and Preference Information

• communication preferences and opt-in/opt-out status;
• campaign engagement, event registration, referral, and product-interest information; and
• website or advertising interaction data where marketing technologies are used.

3.8 Information from Third Parties

• organizational customers, fleet administrators, employers, carriers, contractors, workshops, and authorized account administrators;
• device, firmware, sensor, integration, telecommunications, mapping, cloud, support, or analytics providers;
• payment processors, CRM, communications, marketing, and customer-support providers;
• regulators, auditors, professional advisers, or other lawful sources; and
• publicly available or commercially available sources where permitted by law.

4. Sensitive Personal Data

Some information processed through the OneRoad Solution may be treated as sensitive personal data or sensitive personal information under applicable law. Depending on the circumstances, this can include precise geolocation, driver license or government identifier information, account credentials, health or medical information, biometric information if ever enabled, and information about a known child.

OneRoad will process sensitive Personal Data only for disclosed, legitimate purposes and will obtain consent or provide additional notices or controls where required by applicable law. In particular, where the TDPSA applies to a Texas consumer acting in an individual or household context, OneRoad will obtain consent before processing sensitive data when required by that law.

The OneRoad Solution is not directed to children under 13, and OneRoad does not knowingly seek to collect Personal Data from children under 13. If a feature would involve a known child, OneRoad will apply any requirements of the Children's Online Privacy Protection Act (COPPA) and other applicable law.

5. How We Collect Personal Data

• directly from you when you register, order, purchase, subscribe, complete forms, upload information, communicate with us, request support, or use the OneRoad Solution;
• automatically through websites, applications, telematics devices, vehicle-connected hardware, sensors, OEM Firmware, Bluetooth Functionality, Approved Peripherals, and connected services;
• from an organizational customer, employer, carrier, fleet administrator, contractor, workshop, or other authorized representative;
• from authorized Third-Party Integrations and service providers; and
• from regulators, professional advisers, lawful public sources, or other sources where permitted or required by law.

6. Purposes for Which We Process Personal Data

• provide, operate, maintain, secure, support, and improve the OneRoad Solution;
• create and administer user, fleet, carrier, customer, and organizational accounts;
• process purchases, presales, subscriptions, device allocations, billing, payments, cancellations, returns, warranties, and support requests;
• provide ELD, compliance, fleet operations, telematics, maintenance, mass-management, safety, reporting, analytics, and related functionality;
• connect Approved Devices, Approved Peripherals, OEM Firmware, Bluetooth Functionality, and Third-Party Integrations;
• generate logs, records, alerts, reports, diagnostics, analytics, predictions, recommendations, and operational insights;
• verify identity, authorization, role, device, permissions, and account security;
• detect, investigate, prevent, and respond to fraud, misuse, security incidents, unauthorized activity, defects, and operational issues;
• provide customer support, onboarding, diagnostics, troubleshooting, updates, recalls, patches, replacement, repair, and supplier escalation;
• comply with legal, regulatory, audit, safety, record-keeping, insurance, tax, and law-enforcement obligations;
• protect OneRoad, our customers, users, suppliers, and third parties, and establish, exercise, or defend legal claims;
• perform product development, testing, benchmarking, reliability analysis, service improvement, and internal business planning using Personal Data where permitted and de-identified or aggregated information where appropriate; and
• send service communications and, where permitted by law, marketing communications.

We seek to limit Personal Data collection, use, and retention to what is reasonably necessary and proportionate for the disclosed purposes, subject to applicable legal, operational, safety, regulatory, security, and record-keeping requirements.

7. Organizational Accounts and Fleet Visibility

The OneRoad Solution is commonly used in commercial and employment settings. Where your account is created, paid for, sponsored, managed, or administered by an employer, carrier, fleet operator, customer, contractor, or other organization, that organization may control account provisioning, permissions, access, retention, export, and use of data within its environment.

• authorized administrators, managers, dispatchers, safety or compliance personnel, maintenance personnel, and other approved users may view or manage data according to role-based permissions;
• your organization may direct OneRoad to process data on its behalf or may independently determine how it uses data available through the OneRoad Solution;
• requests concerning data controlled by an organization may need to be handled by, or coordinated with, that organization; and
• state privacy rights may differ depending on whether an individual is acting in an individual/household, commercial, contractor, applicant, or employment context.

For example, the TDPSA generally does not treat an individual acting in a commercial or employment context as a "consumer." Other laws, including California law where applicable, may provide different protections.

8. How We Disclose Personal Data

We may disclose Personal Data to the following categories of recipients where reasonably necessary and permitted by law:

• organizational customers, fleet administrators, carriers, employers, contractors, and other authorized users connected to your account;
• cloud hosting, storage, cybersecurity, software development, communications, analytics, support, CRM, payment, billing, and other service providers;
• hardware manufacturers, firmware providers, device suppliers, telecommunications providers, mapping/location providers, Approved Peripheral providers, and integration partners;
• payment processors, banks, invoicing, tax, and financial administration providers;
• professional advisers, insurers, auditors, accountants, and legal counsel;
• regulators, courts, law-enforcement agencies, government bodies, and accreditation or compliance bodies where permitted or required by law;
• a purchaser, investor, lender, assignee, affiliate, or successor in connection with financing, restructuring, merger, acquisition, asset sale, or business transition, subject to appropriate protections; and
• other third parties where you direct us to disclose the information, consent to the disclosure, or the disclosure is otherwise legally authorized.

We do not sell Personal Data for money as part of our ordinary business model. Certain advertising, analytics, or website technologies can, however, be treated as a "sale," "sharing," or use for targeted advertising under some state privacy laws even when no money changes hands. Where OneRoad engages in activity that is legally treated that way, we will provide the required disclosures and opt-out mechanisms.

9. Cookies, SDKs, Analytics, Advertising, and Tracking

Our websites, applications, and related services may use cookies, pixels, SDKs, session tokens, local storage, analytics tools, and similar technologies to authenticate users, maintain sessions, remember preferences, measure performance, detect errors or misuse, understand service usage, and, where enabled, measure or deliver marketing.

On the OneRoad USA website, Google Analytics is used on the public pages of the OneRoad USA website and is held off until you allow analytics through Cookie Preferences. Our website forms use Google's reCAPTCHA service to help detect automated abuse; it is separate from analytics. Our Cookie Notice describes the current website configuration and your choices.

Third parties may collect information through these technologies where their tools are embedded in our websites or applications. Their collection and use may be governed by their own privacy terms as well as our contracts with them.

9.1 California Do Not Track and Opt-Out Preference Signals

Because there is no uniform industry standard for browser "Do Not Track" signals, our services may not respond to ordinary Do Not Track headers. Where applicable law requires OneRoad to recognize a legally valid opt-out preference signal, such as Global Privacy Control (GPC), OneRoad will treat that signal as an opt-out request for the browser or device to the extent required by law and technically applicable.

Where required, OneRoad will also make available a "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" mechanism for applicable sale, sharing, or targeted-advertising activity.

10. Artificial Intelligence, Analytics, and Profiling

The OneRoad Solution may use artificial intelligence, machine learning, rules engines, or other analytics to generate predictions, recommendations, risk indicators, operational insights, or automated assistance. Such tools are intended to support users and organizations and may depend on data supplied by users, vehicles, devices, sensors, integrations, and third parties.

Unless separately disclosed, OneRoad does not use consumer-facing automated processing to make a decision that itself produces a legal or similarly significant effect about an individual. Organizational customers may use OneRoad outputs as one input into their own operational or employment decisions and are responsible for their independent decisions.

Where applicable law provides rights concerning profiling or automated decision-making, OneRoad will provide the required notices, opt-out or access mechanisms, risk assessments, or other controls to the extent the relevant processing is subject to those requirements.

11. Data Security

OneRoad uses reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, acquisition, use, alteration, disclosure, loss, or destruction, taking into account the nature and volume of the data and the risks presented by the processing.

• role-based access and least-privilege controls;
• authentication and credential controls;
• encryption in transit and, where appropriate, at rest;
• logging, monitoring, and audit controls;
• secure hosting and infrastructure practices;
• vulnerability, patch, and security maintenance processes;
• backup, recovery, and resilience controls;
• staff and contractor access restrictions and training;
• vendor security requirements and due diligence; and
• incident response and breach-management procedures.

No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security. Users and organizations are also responsible for protecting their accounts, credentials, mobile devices, networks, vehicles, and internal access controls.

12. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, or as required or permitted by law, contract, regulatory requirements, safety obligations, audit needs, dispute management, security, fraud prevention, warranty/support processes, or legitimate business operations.

Retention periods vary based on factors including:

• the type and sensitivity of the information;
• the product, module, device, or service involved;
• ELD, transportation, regulatory, safety, tax, accounting, audit, and record-keeping requirements;
• contractual and organizational customer requirements;
• security, backup, disaster-recovery, and incident-response requirements; and
• the existence of disputes, investigations, warranty claims, or legal obligations.

When Personal Data is no longer reasonably required, we take reasonable steps to delete, destroy, anonymize, or de-identify it, subject to applicable retention requirements and technically necessary backup cycles.

13. De-Identified and Aggregated Information

OneRoad may create and use aggregated, anonymized, or de-identified information for analytics, service improvement, testing, product development, benchmarking, industry insights, safety analysis, operational planning, and other lawful purposes. Where information is maintained as de-identified data under applicable law, OneRoad will not attempt to re-identify it except as permitted for testing the effectiveness of de-identification or as otherwise allowed by law.

14. Data Transfers and Processing Locations

OneRoad may process Personal Data in the United States and in other countries where OneRoad affiliates, suppliers, cloud providers, developers, support teams, or other service providers operate. Privacy and data-protection laws in those locations may differ from the laws of your state.

Where required by applicable law or contract, OneRoad will use appropriate contractual, organizational, and security measures for cross-border or cross-jurisdictional processing.

15. Privacy Rights and Requests

Depending on your state of residence, the context in which you interact with OneRoad, and whether the relevant law applies to OneRoad, you may have rights concerning your Personal Data.

• confirm whether OneRoad is processing your Personal Data and access or obtain a copy of it;
• correct inaccurate Personal Data;
• delete certain Personal Data, subject to legal exceptions;
• obtain Personal Data in a portable format where required;
• opt out of sale, sharing, or targeted advertising where applicable;
• opt out of certain profiling or automated decision-making where applicable;
• limit certain uses or disclosures of sensitive Personal Data where applicable; and
• appeal a denial of a privacy request where the applicable state law provides an appeal right.

To submit a privacy request, email support-us@oneroad.io with the subject line "U.S. Privacy Request" or use any privacy-request mechanism made available on the OneRoad website or platform.

We may need to authenticate your identity and, where applicable, verify the authority of an authorized agent. We will respond within the time required by applicable law. We will not unlawfully discriminate against you for exercising an applicable privacy right.

If we deny a request and applicable law provides an appeal right, our response will explain how to submit an appeal. Where Texas law applies and an appeal is denied, we will provide information about how to submit a complaint to the Texas Attorney General.

16. Texas Privacy Rights

The Texas Data Privacy and Security Act applies to certain businesses that conduct business in Texas or provide products or services consumed by Texas residents. The Act generally excludes individuals acting in a commercial or employment context from its definition of "consumer" and generally exempts small businesses as defined by the U.S. Small Business Administration, subject to specific requirements concerning the sale of sensitive data.

Where the TDPSA applies to OneRoad and to your interaction with us as a Texas consumer, you may have rights to access, correct, delete, and obtain a portable copy of Personal Data, and to opt out of targeted advertising, sale of Personal Data, or certain profiling. You may also appeal certain request decisions.

OneRoad's privacy notice identifies the categories of Personal Data and sensitive data processed, processing purposes, categories of Personal Data shared, categories of recipients, and methods for exercising rights. Where required, OneRoad will obtain consent before processing sensitive data and will maintain reasonable administrative, technical, and physical data-security practices.

17. California Privacy Disclosures

California residents are entitled to the disclosures required by the California Online Privacy Protection Act (CalOPPA). If OneRoad becomes subject to the CCPA/CPRA for a relevant period, the additional CCPA/CPRA rights and obligations described in this section will apply.

17.1 Categories of California Personal Information

Depending on your interaction with OneRoad, we may collect the following California categories:

• identifiers, such as name, email, telephone number, account identifiers, IP address, device identifiers, and driver license information;
• customer-record and commercial information, such as address, subscription, order, presale, billing, and purchase history;
• internet or other electronic network activity information, such as browser, app, session, interaction, cookie, SDK, and log data;
• geolocation data, including precise vehicle or device location where enabled;
• professional or employment-related information where provided through an organizational account;
• audio, electronic, visual, or similar information where support calls, screenshots, photos, or uploaded media are used;
• inferences or analytics derived from operational, device, or usage information; and
• sensitive personal information where applicable, including driver license information, account credentials, precise geolocation, and health-related information if lawfully collected.

17.2 California Purposes, Sources, and Disclosures

We collect the categories above from the sources described in Section 5 and use them for the purposes described in Section 6. We disclose them to the categories of recipients described in Section 8. We retain them according to the criteria in Section 12.

17.3 California Sale, Sharing, and Targeted Advertising

OneRoad does not sell Personal Data for money as part of its ordinary business model. If OneRoad uses advertising or analytics technologies that constitute "sale" or "sharing" under California law, OneRoad will provide the required opt-out mechanism and honor valid opt-out preference signals where required.

17.4 CCPA/CPRA Rights Where Applicable

• right to know the categories and specific pieces of Personal Information collected, subject to applicable limitations;
• right to delete Personal Information, subject to exceptions;
• right to correct inaccurate Personal Information;
• right to opt out of sale or sharing of Personal Information;
• right to limit certain uses and disclosures of Sensitive Personal Information where the statutory right applies;
• right to information about collection, use, retention, and disclosure practices; and
• right to non-discrimination for exercising CCPA rights.

Where the CCPA applies, OneRoad will provide a Notice at Collection at or before the point of collection containing the required categories, purposes, retention information, and links. Appendix A summarizes the categories, purposes and retention approach.

18. Direct Marketing Communications

OneRoad may send service communications necessary to administer accounts, devices, subscriptions, security, support, regulatory functions, and product operations. We may also send marketing communications where permitted by law.

Purchasing a OneRoad product does not enroll you in marketing communications. Any optional website marketing choice is separate from the transactional communications we send about your order.

You may opt out of marketing emails by using the unsubscribe mechanism in the message or contacting support-us@oneroad.io. Opting out of marketing does not prevent necessary service, legal, security, billing, account, device, or regulatory communications.

19. Security Incidents and Data Breaches

If OneRoad becomes aware of a security incident involving Personal Data, we will investigate, contain, assess, and remediate the incident. Where U.S. federal or state law requires notification to affected individuals, regulators, attorneys general, consumer reporting agencies, or other authorities, OneRoad will provide the required notices within the applicable timeframes.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, products, services, technology, data practices, security practices, corporate structure, or business operations. The "Last Updated" date will identify the current version. Where legally required or appropriate for a material change, we may provide additional notice through our website, platform, app, email, or other communication channel.

21. Contact Us

For privacy questions, requests, or complaints, contact:

Privacy Officer
OneRD Pty Ltd, trading as OneRoad
821 W New Hope Drive
Bldg 1 Ste 102 PMB 1033
Cedar Park, TX 78613
United States
Email: support-us@oneroad.io

Appendix A — California Categories, Purposes and Retention

Document Details