Speedway public policy
This Privacy Policy explains how Speedway collects, uses, protects, shares, retains and deletes information across Speedway Go, Crew, Central, CrewHQ, delivery, tracking, payments, support, Google services and future payroll-related services.
Speedway Global Operations Infrastructure Limited (Business Registration No. 81104297) is the legal entity operating Speedway services and is referred to in this policy as “Speedway”. Its registered office is Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong S.A.R. Bestway and RaffsSync are trading names of Speedway. Privacy enquiries can be sent to [email protected] or [email protected].
Speedway uses location, telemetry, device and verification signals to support delivery, dispatch, attendance, field visibility, fraud prevention, safety and service quality. Workforce monitoring, biometric-style verification, 2FA, geo-location and telemetry features are enabled according to customer configuration, staff notices, consent or lawful basis, operating policies and written agreements.
Speedway lets authorised users connect Google services to their Speedway account or business. These connections are optional and are used only to provide the Speedway features the user or business chooses to enable. Speedway requests only the Google OAuth permissions needed for the connected feature.
https://www.googleapis.com/auth/business.manage scope.https://www.googleapis.com/auth/adwords scope. Campaign changes are not made merely because an account is connected; any write capability must be separately enabled and authorised.Speedway uses Google data only to provide or improve user-facing features the user or authorised merchant has chosen to enable, including authentication, linking the correct merchant-owned Google account, mapping Google locations to Speedway venues, displaying or reconciling authorised business information, reporting and operational context, reputation and discovery tools, and merchant-requested Google Ads management or reporting. Connected Google data is scoped to the authorised Speedway account or merchant and is not made available to unrelated merchants.
Google OAuth access and refresh credentials are kept in Speedway's protected server-side credential systems, encrypted at rest in Speedway's secret store, protected in transit using HTTPS/TLS, and are not intentionally exposed in client-side application responses. Where Google issues expiring access credentials, Speedway may use the authorised refresh credential to obtain a replacement access credential while the connection remains active. Speedway keeps connected account identifiers, authorised business data, reporting snapshots and audit evidence only for as long as needed to provide the connected feature, maintain security and auditability, resolve support or disputes, or meet applicable legal requirements.
Users and authorised business administrators can stop future Google API access by disconnecting the Google connection in Speedway where that control is available, by revoking Speedway in their Google account or Google business account settings, or by contacting Speedway Support. A deletion request can also be made through [email protected]. Some minimal audit, financial, security or dispute records may be retained where Speedway has a legitimate or legal obligation to keep them.
Speedway's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Speedway does not sell Google user data, disclose it to data brokers or information resellers, use it to build advertising audiences or serve targeted advertising, user advertisements, personalised advertising, retargeted advertising or interest-based advertising, use it to determine creditworthiness or lending eligibility, create unrelated databases or profiles from Google user data, or use Google user data obtained through Google APIs to develop, improve or train general-purpose or non-personalised AI or machine-learning models. Speedway does not use Google Workspace API data, if a Workspace integration is enabled in future, to develop, improve or train general-purpose or non-personalised AI or machine-learning models. Speedway does not use one merchant's connected Google data to benefit an unrelated merchant. Human access to Google user data is limited to user-authorised support, security or abuse investigation, legal compliance, or other cases permitted by Google's policy.
Speedway shares information only where needed to operate, secure, support or improve the service, or where required by law or written agreement. This can include payment providers, hosting providers, communications providers, mapping services, analytics, support tools, accounting/payroll integrations, fraud-prevention services, banks, regulators, professional advisers and authorised customer administrators.
Speedway uses technical, organisational and operational safeguards designed to protect personal data and business data. These safeguards include secure access controls, role-aware permissions, encrypted transport, monitoring, logging, account protection, operational reviews and controlled access to production systems.
Speedway keeps information for as long as needed to provide services, support users, operate the business, meet legal/accounting/tax requirements, prevent fraud, resolve disputes, enforce agreements and maintain safety and security. Users and authorised business contacts can request account deletion or privacy support by contacting [email protected] or [email protected]. Some records remain retained where required for legal, security, accounting, payroll, dispute, audit or fraud-prevention purposes.
Users can contact Speedway to request access, correction, deletion, restriction or privacy support for personal data connected to Speedway services. Business and workforce records may also be subject to employer, customer, accounting, payroll, legal, safety or contractual retention requirements. Speedway will review requests according to the applicable service role, identity verification, customer agreement and legal requirements.
Speedway is incorporated in Hong Kong S.A.R. and operates services across multiple markets, including Indonesia. Speedway services may use RaffsSync Core, a Speedway trading and technology name, together with trusted service providers. Data may be processed, stored or supported from locations outside the user’s city or country where needed to operate secure, reliable and scalable services. Speedway applies operational safeguards and provider controls appropriate to the service and agreement.
Speedway updates this Privacy Policy as the platform, workforce services, integrations, legal requirements and operating model evolve. If Speedway materially changes how it accesses, uses, stores, shares or transfers Google user data, Speedway will update this policy and provide an appropriate in-product notice before or when the change takes effect. The latest version is published at Speedway.Global/privacy.