Data processing agreement

This document is the data processing agreement required by art. 28 of Regulation (EU) 2016/679 (GDPR). It serves as the appointment as data processor and applies to anyone using Fleetly under a licence, free or paid: accepting the Terms of service also means accepting this text, which is part of them.

1. Who is who

The data controller is you, the customer: the data you enter in Fleetly are yours, you choose them, and decisions about what to record and why remain yours.

The data processor is DNL Group, con sede legale in Cassino (FR), which processes those data only to provide the service and only according to your instructions.

This document does not cover data we collect on our own behalf — the activation request, site statistics, invoicing: for those we are the controller, and they are described in the privacy notice.

2. What we process, for whom, and for how long

Subject matter: the provision of Fleetly, i.e. recording vehicles’ administrative data, their deadlines and documents, managing users and drivers and, on plans that include it, assigning trips.

Duration: processing lasts as long as the contractual relationship. Afterwards, section 8 applies.

Categories of data subjects: the natural persons whose data end up in Fleetly as a result of your use — your employees and contractors who use the app, the drivers you assign trips to, the people named as assignees of a vehicle, and any people named in the documents you upload.

Categories of data: identification and contact data (first name, last name, email, username), vehicle assignment data, the trip declarations made by drivers (departure, stops, pauses, arrival, with the time of the action and the time it reached the server), the end-of-trip report and the content of uploaded documents.

The end-of-trip report is generated by the driver’s phone on arrival and contains: planned and driven kilometres, how much of the approved route was followed, detours expressed as stretches of the route (“from km 64 to km 80, 10 minutes”), a GPS signal quality index, and the periods of driving, stopping and rest inferred from movement, with any corrections the driver made to stops. From these periods the app calculates indicative compliance with the driving and rest times of Regulation (EC) 561/2006, including over the last 28 days of each driver. The report contains no coordinates and, once sent, cannot be changed.

We do not process special categories of data (art. 9) and the service is not designed to receive them. Uploading medical certificates or health documents to Fleetly is a use we advise against, and one for which you would remain controller in every respect.

Drivers’ location is not recorded and never reaches the company. The app uses the phone GPS to draw the map, for navigation and to fill in the end-of-trip report, on the device; on the phone app it does so also with the screen locked, while the trip is under way, with a notification always visible, and it stops on arrival. There is one exception, and it is technical: when the vehicle leaves the approved route, the phone sends its current point to the function that recalculates the route, which passes it to the routing provider and returns the new road. That point is not stored, not logged and not visible to the company or to us; recalculations are capped at 15 per trip. No feature exists that shows or forwards a driver’s location. It is a design choice, not a setting, and it is what keeps the service outside the remote monitoring governed by art. 4 of the Italian Workers’ Statute.

The end-of-trip report and the driving-time check do, however, concern the driver’s work: assess, also with your employment adviser, the obligations their use entails in your organisation. The driving-time check is indicative and does not replace the tachograph or its obligations. The duty to inform workers about the processing (art. 13 GDPR) remains yours; the app shows them a page describing in detail what it records and what it does not.

3. Our instructions

We process your data only to provide the service, for the support you ask us for, for infrastructure security and for the legal obligations we are subject to. We do not use them for our own purposes, do not analyse them to build products or profiles, do not hand them over, and do not use them to train artificial intelligence systems.

If we believe one of your instructions breaches the law, we tell you before carrying it out.

App usage statistics are a separate processing of our own, not yours: they are tied to the installed copy and not to your data subjects, contain no plates, names, amounts or documents, and app users can decline them from the banner or switch them off in Settings.

4. Confidentiality

Only those who need to, to do their job, access your data, and they are bound by confidentiality.

One point about support must be stated precisely: those who administer Fleetly can technically read the data of any fleet, because that is how a reported problem is diagnosed. It is a closed list of people, written into the code and the database rules, not a possibility open to anyone working here.

5. Security (art. 32)

The measures we apply, which you can verify in how the product behaves:

• Separation between customers. Every record carries the licence identifier, and the database rules deny by default any read or write that does not come from a member of that licence. It is not a filter applied by the app: it is the server that refuses.
• Access. Administrators sign in through Google with a verified email; drivers have their own credentials, issued by you, which do not give access to the fleet but only to the trips assigned to them. We do not keep passwords in any readable form: they live in Firebase Authentication and, if lost, are regenerated.
• Transmission and transport. All traffic is over HTTPS, with HSTS, and the app cannot be embedded in third-party sites.
• Documents. Uploaded files are accessible only to members of the licence; they are addressed by their own content, so an address cannot be guessed and reveals nothing.
• Trip log. Drivers’ declarations are append-only: nobody can edit or delete them afterwards, not the company, not us. Cancelling a trip is one more event, not a rewritten line.
• Continuity. The infrastructure is Google Cloud, with replication managed by the provider.

One thing you need to know because you decide it: if you turn on the deadlines calendar, the app publishes plates and dates at an address that the Google, Apple and Microsoft calendars must be able to download without authenticating. Anyone who knows that address can read those data. It is off by default, can be switched off whenever you want, and regenerating the link makes the previous one unusable instantly.

6. Sub-processors

You authorise us to use the providers below, each bound by obligations equivalent to these.

Provider	What it does	Where it processes data
Google Ireland Ltd. / Google LLC	Authentication, database, document storage, hosting, running functions	United States
Resend	Sending the welcome email	United States
Geoapify GmbH	Route calculation and recalculation and maps, for the Trips feature	European Union

Where the data reside. The database and documents reside on servers in the United States. The transfer relies on Google’s certification under the EU-US Data Privacy Framework and on the standard contractual clauses approved by the European Commission. If this is a constraint for you, tell us before activating: it is information we would rather give you now than have you discover after signing.

If we change or add a sub-processor we notify you at least 30 days in advance; if you do not accept it, you can withdraw without penalty from the part of the service concerned.

7. Your support to data subjects, and ours to you

Responding to people exercising their rights — access, rectification, erasure, restriction, portability, objection — is your task, as controller. The app lets you do almost all of it yourself: vehicle and driver data are corrected and deleted from the interface.

Where that is not enough, we help you: write to piersilvio.dinola@fleetly.it and we reply within 15 days, so that you stay within the 30 the Regulation gives you. On request we provide a copy of your fleet data in a machine-readable format.

If we receive a request directly from one of your data subjects, we do not answer it on the merits: we refer them to you and let you know.

Data breaches. If a breach concerns your data we notify you without undue delay and in any case within 48 hours of becoming aware of it, with what we know — what happened, which data and how many data subjects, what we are doing — so that you can assess notification to the supervisory authority within your 72 hours. Notifying the authority and the data subjects, when needed, is up to you: the decision belongs to the controller.

Within the limits of what we know, we also help with a data protection impact assessment (art. 35) concerning your use of Fleetly.

8. At the end of the relationship

When the contract ends the data stay where they are and you keep seeing them: an expired licence becomes read-only, it does not delete anything. You can delete them yourself at any time, including on an expired licence.

If you prefer us to delete them, or to return them to you before deleting them, just ask: we do so within 30 days of the request, sub-processors included, except for what we must keep by law — tax documents, which contain no data about your data subjects.

9. Audits

On request we provide the information needed to demonstrate compliance with these obligations. An on-site audit is possible once a year, agreed in advance, at your expense and without compromising the confidentiality of other customers.

10. Changes

This document may change along with the service or the law. Material changes are communicated with reasonable notice, and the app asks you to re-accept the updated documents at the next login.

In case of conflict with the Terms of service, this text prevails on matters concerning personal data. Italian law applies.