Privacy Policy
How Manoova SARL collects, uses, protects and transfers your personal data — in full compliance with GDPR and applicable international regulations.
Last updated: 6 April 2026 · Effective date: 6 April 2026
1. Data Controller
Manoova SARL
Registered office: II J 173 B Ivandry, Antananarivo, Madagascar
Share capital: MGA 1,000,000,000 (1 billion Malagasy Ariary)
Contact: contact@sobber.io
Hosting: Vercel Inc., 440 N. Barranca Ave #4133, Covina, CA 91723, United States — vercel.com
Manoova SARL ("Sobber", "we", "us") operates the sobber.app platform and the AF-50AD breathalyzer ecosystem. In the context of our relationship with corporate clients (employers), Sobber acts as a data processor on behalf of the employer (data controller) for employee test data. For our own operational data (account management, billing, website), Sobber acts as data controller.
Contact: contact@sobber.io
2. Data We Collect
| Category | Data | Source |
|---|---|---|
| Identity | Full name, employee ID, job role | Employer / enrolment |
| Biometric | Facial photograph, biometric template derived from facial scan | Sobber mobile app |
| Health | Blood Alcohol Content (BAC) results, test timestamps | AF-50AD device |
| Location | GPS coordinates at time of test | Mobile device |
| Device | Smartphone model, OS version, Bluetooth pairing ID | Mobile app |
| Account | Email address, password hash, role, login history | sobber.app registration |
| Usage | Dashboard access logs, report exports, alert views | sobber.app platform |
3. Special Category Data
Sobber processes two categories of special category data under GDPR Article 9:
- Biometric data (facial images and derived biometric templates) used for identity verification.
- Health data (BAC results) relating to a worker's physiological state at the time of testing.
Such data is processed exclusively under the following legal bases: explicit consent of the data subject (Article 9(2)(a)), or the employer's obligations in the field of employment, occupational safety and social protection law (Article 9(2)(b)), or for reasons of substantial public interest (Article 9(2)(g)) where applicable under national law.
Biometric templates are stored separately and encrypted from BAC results. Access to biometric data is restricted to designated HR or compliance officers via role-based access controls.
4. Legal Basis for Processing
| Processing activity | Legal basis |
|---|---|
| Employee enrolment (biometric) | GDPR Art. 9(2)(b) — employment law obligation; or explicit consent |
| BAC testing results | GDPR Art. 9(2)(b) — occupational health & safety |
| GPS location logging | GDPR Art. 6(1)(f) — legitimate interest (workplace safety) |
| Dashboard & reporting | GDPR Art. 6(1)(b) — contract performance |
| Audit trail (immutable logs) | GDPR Art. 6(1)(c) — legal obligation |
| Marketing communications | GDPR Art. 6(1)(a) — consent |
5. How We Use Your Data
- Verifying the identity of the person performing a breath alcohol test to prevent proxy testing.
- Recording, timestamping and storing test results on behalf of the employer.
- Generating real-time alerts to designated supervisors on positive BAC results.
- Producing audit-ready compliance reports for regulatory, insurance and HR purposes.
- Maintaining the immutable audit trail required by EN 15964 and applicable employment law.
- Providing and improving the sobber.app platform and AF-50AD firmware.
We do not sell, rent, or trade personal data to third parties. We do not use BAC results or biometric data for profiling, advertising or automated decisions with legal effect outside the scope of the employer's compliance programme.
6. Data Retention
| Data type | Retention period |
|---|---|
| BAC test results | As configured by the employer (default 5 years for audit compliance) |
| Biometric templates | Duration of employment relationship + 30 days |
| GPS location | Linked to the associated test record retention period |
| Account & login data | Duration of service contract + 90 days |
| Audit logs | Minimum 5 years (regulatory requirement) |
Data is deleted or anonymised at the end of the applicable retention period using industry-standard secure deletion methods.
7. International Transfers
Sobber offers regional data residency to meet data sovereignty requirements:
- European Union — data processed within EU infrastructure, subject to GDPR.
- Africa — processed within African infrastructure. Where national law requires specific measures, Sobber implements Standard Contractual Clauses (SCCs) approved by the European Commission.
- Middle East — processed within regional infrastructure. SCCs or equivalent transfer mechanisms apply where required.
Sobber does not transfer personal data to countries without adequate protection without implementing appropriate safeguards (SCCs, binding corporate rules, or equivalent mechanisms).
8. Your Rights
Under GDPR and applicable data protection law, you have the following rights:
Request a copy of your personal data held by Sobber.
Correct inaccurate or incomplete personal data.
Request deletion of your data subject to legal retention obligations.
Restrict processing in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.
Where processing is based on consent, withdraw it at any time.
File a complaint with your national supervisory authority (e.g., CNIL in France).
To exercise your rights, contact your employer (data controller) or Sobber directly at contact@sobber.io. We respond within 30 days.
9. Security
- AES-256 encryption for all biometric data and test results at rest.
- TLS 1.3 for all data in transit between devices, app and dashboard.
- Role-based access control — supervisors see only their site data.
- Immutable audit logs — no deletion or modification possible after recording.
- Biometric/result segregation — facial data stored separately from BAC results.
- Infrastructure aligned with ISO 27001 requirements and subject to regular security audits.
10. Contact & Supervisory Authority
Manoova SARL
Email: contact@sobber.io
If you are located in the EU, you have the right to lodge a complaint with your national data protection supervisory authority. In France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.
This policy is governed by Malagasy law (droit malgache). For data subjects residing in the European Union, the GDPR applies concurrently by virtue of its extraterritorial scope (Article 3 GDPR). This policy may be updated periodically. The effective date at the top of this page indicates the most recent revision. Continued use of Sobber services after notification of changes constitutes acceptance.