Privacy Notice

01 Who is responsible for your data

PNP SOFTWARE, with address at Cerro de Montelargo 200, Colinas de San Miguel, Culiacán, Sinaloa, Mexico, is responsible for processing your personal data, for its use and for its protection, under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

This notice covers the Enrútate mobile app, for Android and iOS, and the website www.enrutate.com.

02 What Enrútate is, and what it is not

Enrútate is a public-transport information tool: it shows you routes, helps you plan a trip and tells you where the buses are when data is available. We are not a transport operator: we do not run the service, we do not sell tickets, and we do not control schedules, fares or the routes buses actually take.

You do not need an account to use Enrútate. The app has no sign-up, asks for no password, and does not identify you by name.

03 What data we collect and what for

We collect only the following. Each point says whether you can avoid it.

So the app can work

• Precise location (GPS) — when you ask for nearby routes, plan a trip from where you are, or centre the map. You can deny the permission and pick your city and your points by hand: the app works in full.
• Name, email and phone — only if you choose to type them when reporting a problem with a route, a stop or a bus. All three fields are optional.
• Email address — if you ask us to tell you when Enrútate reaches your city. That feature is voluntary.
• The text you write — the free-text detail of a report and what you ask the assistant. Both are voluntary.

To understand how the app is used

• The city you pick — the name of your city, not your position.
• An installation identifier — it identifies the app installation, not you. It is not the advertising identifier and it cannot track you across apps.
• Usage events — which screens open and which actions are taken, without the content of what you write.
• City searches with no results — so we know where we are being asked to go.

This information cannot be turned off from within the app. If you do not want it collected, the way out is to stop using the service or to exercise your ARCO rights.

Data we do NOT collect

We do not collect photos, videos or files from your device, your contacts, your calendar, health data, financial or payment data, sensitive data as defined by article 3 of the LFPDPPP, accounts or profiles on your device, your browsing history outside the app, or your device's advertising identifier.

We send no push notifications and we show no advertising inside the app.

04 Who we share your data with

We do not sell your personal data and we do not share it with data brokers.

We share it only with the providers needed to operate:

• Amplitude, our analytics provider, in the United States: it receives the city you pick, the installation identifier, usage events and searches with no results. Never your coordinates, nor the text of your reports or your chat.
• Google Maps and Apple Maps: they receive the coordinates needed to draw the map and to turn a point into a readable address.
• Our servers, in the United States: they receive what the app needs to work.

These transfers are those necessary to provide you the service and do not require your express consent under article 37 of the LFPDPPP. No other transfers take place.

05 How long we keep your data

We keep each piece of data for as long as the purpose that justifies it requires, and no longer:

• What you write in a report is kept for as long as needed to handle it and follow up on the problem. We have no fixed automatic-deletion period today, and we would rather tell you that than promise a period we would not meet.
• The email you leave for coverage alerts is kept until Enrútate reaches your city and we tell you, or until you ask us to delete it.
• The coordinates you send when planning a trip are recorded on our servers and used in aggregate to understand which journeys are requested and where service is missing.
• Usage data is kept according to Amplitude's retention policy.

You can ask us at any time to delete what you sent, within the limits the next section explains.

06 Your ARCO rights

You have the right to access your data, rectify it if inaccurate, cancel it when you consider it is not required, and object to its processing. You may also withdraw any consent you gave us.

To exercise them, write to info@enrutate.com stating:

• Your name and a way to reply to you.
• Which right you want to exercise and over which data.
• Anything that lets us find your information: the email or phone you typed in a report, or roughly when you sent it.

We will reply within the periods the law sets: 20 business days to communicate the decision and 15 business days more to act on it.

07 How to limit the use or disclosure of your data

Besides your ARCO rights, you can:

• Deny or revoke the location permission from your phone's settings, at any time. The app will keep working.
• Uninstall the app, which stops all collection from your device.
• Not use the voluntary features: reports, the assistant and coverage alerts.

08 Minors

Enrútate is aimed at a general audience and is not designed for children under 13. We do not knowingly collect data from them. If you find that a minor gave us data, write to info@enrutate.com and we will delete it.

09 Security

Information travels encrypted between your device and our servers (HTTPS/TLS), and between our servers and the providers named above.

10 Changes to this notice, and contact

Any change will be published on this same page, with its update date. If a change substantially alters the purposes of processing, we will let you know inside the app.

For any question about this notice: PNP SOFTWARE, Cerro de Montelargo 200, Colinas de San Miguel, Culiacán, Sinaloa, Mexico · info@enrutate.com