DQLink Privacy Policy

DRAFT — attorney review required.

This Privacy Policy explains how Four G Holdings and Developing LLC ("DQLink", "we") handles personal information in the DQLink service at https://dqlink.pro.

1. Our role - For carrier data, we are a service provider (processor). Motor carriers ("Customers") use DQLink to collect and manage information about their drivers, applicants and staff. The Customer decides what is collected and how it is used. We process that information only on the Customer's instructions, as described in our Data Processing Addendum. If you are a driver or applicant, contact the carrier with questions about your file. - For our own business data, we are the controller. That includes contact details of Customer administrators, billing contacts and visitors who contact us.

2. Information processed - Account information: names, emails, phone numbers, roles, sign-in and two-factor data. - Driver qualification data entered by Customers or drivers: employment applications (49 CFR 391.21), addresses, license details, Social Security number, date of birth, employment history, motor vehicle records, PSP and Clearinghouse query results, road tests, annual reviews, training records, I-9/W-4/W-9 and direct-deposit details. - Restricted data: drug and alcohol testing records (49 CFR Part 40 / Part 382) and medical examiner certificates and related medical information (49 CFR 391.41-391.51). - Signature data: typed name, drawn signature image, time, IP address and browser information. - Usage and security logs: pages viewed, records accessed, downloads and audit-log events. - Billing data: handled by Stripe. We receive limited details such as card brand, last four digits and payment status; we do not store full card or bank account numbers.

3. How information is used To provide the Service; to send required notices (invites, password resets, sign-in codes, expiration and missing-document reminders); to secure the Service and investigate misuse; to bill Customers; and to comply with law. We do not sell personal information, and we do not use driver data for advertising.

4. Sharing We share information only: with the Customer that controls it; with auditors or officials the Customer authorizes through the auditor-access feature; with subprocessors that help run the Service (see section 8); with third-party data providers a Customer orders from (for example MVR providers); when required by law; or in a merger or acquisition subject to this Policy. Drug and alcohol information is released only as permitted by 49 CFR 40.321 and the Customer's instructions.

5. Security Encryption in transit (HTTPS) and field-level AES-256-GCM encryption of sensitive fields (SSN, date of birth, license number, bank details); role-based access with a separate restricted section for drug and alcohol and medical records; two-factor authentication required for administrators; account lockout and idle sign-out; and audit logging. No system is perfectly secure.

6. Retention Customers set retention under FMCSA rules (for example 49 CFR 391.51 and 382.401). After a subscription ends, Customer data is available for export for 60 days and then deleted or de-identified within 90 days, except where law requires otherwise. Consumer report information is disposed of securely (16 CFR Part 682).

7. Your choices and rights Drivers and applicants should send access, correction or deletion requests to the carrier; we will help the carrier respond. Some records cannot be deleted while federal retention rules require them. Customer administrators may contact support@dqlink.pro. Texas residents may have rights under the Texas Data Privacy and Security Act to the extent it applies.

8. Subprocessors Render (hosting and database, United States), Resend (transactional email), Stripe (payments), and data providers a Customer chooses to enable (for example SambaSafety). We will update this list before adding a new subprocessor that processes driver data.

9. HIPAA DQLink is not a HIPAA covered entity, and carriers using DQLink as employers are generally not acting as covered entities when they keep DOT medical certificates and drug-test results. Those records are protected instead by DOT confidentiality rules (49 CFR Part 40), the ADA and state law, and DQLink protects them as restricted data.

10. Children The Service is not directed to anyone under 18.

11. Changes and contact We will post changes here with a new effective date. Questions: support@dqlink.pro · Four G Holdings and Developing LLC, Texas.