Data Classification & Handling Policy

Document ID: PLCY-DATA-001
Effective Date: December 22, 2025
Last Review: December 22, 2025
Owner: Hop And Haul Team

---

CONFIDENTIAL

This document is CONFIDENTIAL and for internal use only. Do not distribute outside the organization.

1. Purpose

This policy defines how Hop And Haul classifies, handles, stores, and disposes of data to ensure compliance with SOC II Trust Service Criteria for Confidentiality and Privacy.

---

2. Data Classification Levels

2.1 Classification Tiers

Level	Description	Examples	Handling Requirements
Restricted	Highly sensitive, limited access	N/A - Hop And Haul does not handle this tier	N/A
Confidential	PII requiring protection	Driver ID, name, email, phone	Encrypted, masked, access-logged
Internal	Operational data	GPS traces, routes, ride metadata	Encrypted, role-based access
Public	Non-sensitive	System documentation	No restrictions

---

3. Data Elements by Classification

3.1 Confidential (Moderate PII)

Data Element	Collection Purpose	Masking Applied	Retention
Driver ID	Internal identification	Never exposed externally	24 months
First name + last initial	Display to matched driver	Full name never shown	24 months
Company email	Authentication, notifications	Truncated in logs	24 months
Employee ID	HR system linkage	Internal only	24 months
Phone number	Contact during ride	Masked after match	24 months

3.2 Internal (Operational)

Data Element	Collection Purpose	Retention
Pickup location (lat/long)	Route matching	6-12 months
Drop-off location	Route matching	6-12 months
Time window	Scheduling	6-12 months
Reason code	Operations tracking	24 months
GPS traces	Route monitoring	6-12 months
Route deviations	Safety monitoring	12 months
Unplanned stops	Safety monitoring	12 months

3.3 Transactional

Data Element	Collection Purpose	Retention
Acceptance logs	Audit trail	24 months
Ride metadata	Operations record	24 months
Payment records	Financial reconciliation	24 months

3.4 Quality Metrics

Data Element	Collection Purpose	Retention
Cleanliness ratings	Operational quality	Employment + 1 year
Conduct ratings	Operational quality	Employment + 1 year
Safety ratings	Operational quality	Employment + 1 year
Communication ratings	Operational quality	Employment + 1 year

---

4. Data Minimization Principles

4.1 Collect Only What Is Necessary

Hop And Haul adheres to minimum necessary data collection:

Collected:

• Driver ID (internal, NOT SSN)
• First name + last initial (NOT full name)
• Company email / employee ID
• Phone (masked after match)
• Pickup/drop-off as lat/long (NOT free text addresses)
• Reason codes (standardized list)

Explicitly NOT Collected:

• Social Security Numbers
• Medical data
• Exact DOT logs (HOS verified via API, not stored)
• Disciplinary history
• Personal addresses
• Biometric data
• Health conditions
• Religious or political affiliations

4.2 Compliance Basis

All collected data falls under legitimate business purpose:

• Operational necessity for driver transport
• DOT/FMCSA compliance verification
• Company authorization documentation
• Financial reconciliation

---

5. Data Masking Requirements

5.1 Masking Rules

Data Element	Pre-Match Display	Post-Match Display	In Logs
Driver name	Not shown	First + Last Initial	Tokenized
Phone number	Not shown	Masked (XXX-XXX-1234)	Hashed
Location	Fuzzed (1-2 mi radius)	Precise (for pickup)	Lat/long only
Drop-off	Direction only (city)	Precise	Lat/long only

5.2 Location Fuzzification

Before match acceptance:

• Pickup shown as approximate radius (1-2 miles)
• Drop-off shown as direction/region only
• Full routes NEVER exposed to requesting driver

After match acceptance:

• Precise pickup location provided
• Full route visible to matched parties only

---

6. Data Retention Schedule

See PLCY-RET-001 Records Retention Policy for authoritative retention schedule.

Summary of applicable retention periods:

Data Category	Retention Period	Justification	Disposal Method
Ride metadata	24 months	DOT audit coverage	Secure deletion
GPS traces	12 months	Operational disputes	Secure deletion
Acceptance logs	24 months	Insurance/legal	Secure deletion
Ratings (aggregated)	Employment + 1 year	Training follow-up	Anonymization
Payment records	24 months	IRS requirements	Secure deletion
System logs	12 months	Security monitoring	Secure deletion

6.1 Retention Justification

Refer to PLCY-RET-001 for detailed justifications. Summary:

• 24 months: Covers DOT audit windows and insurance dispute periods
• 12 months: Standard operational data retention
• Employment + 1 year: Allows remediation follow-up, then disposal

---

7. Data Handling Procedures

7.1 Collection

• Data collected only through authorized system interfaces
• No manual data entry of PII
• Validation at point of entry

7.2 Storage

• All data encrypted at rest (AES-256)
• Database access restricted by role
• No PII in log files (tokenized only)

7.3 Transmission

• TLS 1.3 for all data in transit
• No PII transmitted via email
• API tokens expire after session

7.4 Access

• Role-based access control enforced
• Access logged and auditable
• Least-privilege principle applied

7.5 Disposal

• Automated deletion per retention schedule
• Secure deletion (overwrite, not just delete)
• Disposal logged for audit

---

8. Prohibited Data Handling

The following are explicitly prohibited:

Prohibition	Rationale
Exporting PII to personal devices	Data leakage risk
Sharing driver data outside system	Privacy violation
Storing PII in unencrypted formats	Security requirement
Retaining data beyond schedule	Privacy exposure
Collecting health/medical data	Out of scope, HIPAA risk
Storing full SSN	Not required for operations

---

9. Document Control

Version	Date	Author	Changes
1.0	[DATE]	[NAME]	Initial release