Data Processing Agreement (DPA): changes marked in the text
In force from 4 November 2026 · deleted text · inserted text
Data Processing Agreement (DPA)
Version: 1.0 | Effective date: February 19, 2026 | Market: EU (aroute.eu)Version: 1.1 | Effective date: 4 November 2026. § 7.4 and § 13.1 as amended apply from 20 November 2026.
§1. Parties
This Data Processing Agreement (hereinafter: "Agreement" or "DPA") is entered into between:
Data Processor:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
VAT ID: PL9720811257
Email: office@emversa.com
(hereinafter: "Processor" or "Emversa")
and
Data Controller:
The Organization using the Aroute Platform
(hereinafter: "Controller" or "Organization")
§2. Agreement Execution
- This Agreement is automatically concluded upon acceptance of the Aroute Platform Terms of Service during the registration process.
- Acceptance of the Terms of Service (checking the required checkbox "I accept the Terms of Service") constitutes simultaneous acceptance of this Data Processing Agreement.
- The Organization represents that the person accepting the Terms of Service and this Agreement is authorized to represent the Organization and enter into obligations on its behalf.
§3. Subject Matter
- The Controller entrusts the Processor with the processing of personal data of Drivers (employees and contractors of the Controller) to the extent necessary to provide the Aroute Platform services.
- The Processor undertakes to process the entrusted personal data only for the purpose and scope specified in this Agreement and in accordance with the Controller's instructions.
- The Processor processes data on behalf of the Controller pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR).
§4. Scope of Entrusted Data
4.1. Categories of Data Subjects
- Drivers (employees and contractors of the Organization)
- Users invited by the Administrator
4.2. Categories of Processed Data
Identification data:
- First and last name
- Work email address
- Profile photo (optional)
Trip data:
- GPS coordinates (route start/end)
- GPS checkpoints containing: latitude and longitude, altitude, instantaneous speed, heading, GPS accuracy, timestamp
- Addresses (start/end)
- Timestamps (start/end)
- Trip distance
- Speed (maximum, average)
- Vehicle odometer reading
- Trip purpose
- Trip type (business/private)
Private vehicle data:
- Registration number
- Make and model
- Engine capacity
- Vehicle type
Reimbursement data:
- Reimbursement claim amounts
- Billing periods
- Approval status
Technical data:
- Working hours and days (for auto-trip feature)
- Language preferences
- Consent settings (location, marketing)
4.3. Special Categories of Data
The Processor does not process special categories of personal data within the meaning of Art. 9 of GDPR.
§5. Purpose of Processing
The Processor processes entrusted data only for the purpose of:
- Recording and documenting business and private trips
- Generating Vehicle Mileage Log reports (for company vehicles) and Reimbursement Summary reports (for private vehicles)
- Processing reimbursement claims for private vehicles
- Visualizing data on the fleet map (paid feature)
- Detecting mileage gaps and discrepancies
- Automatic trip detection (auto-trip)
Exporting data to Excel and PDF formatsExporting data to Excel, PDF, CSV and JSON formats, including the full Organization data export- Providing iOS mobile application functionality
- Sending invitations to Drivers
- Technical support and user assistance
§6. Processor Obligations
The Processor undertakes to:
6.1. Compliance with Regulations
- Process data in accordance with GDPR and other applicable EU regulations
- Process data only on documented instructions from the Controller
- Immediately inform the Controller if an instruction violates applicable law
6.2. Confidentiality
- Ensure that persons authorized to process data have committed to confidentiality
- Process data only through trained personnel
6.3. Security
Implement appropriate technical and organizational measures ensuring data security, including:
- Data encryption in transit (TLS/HTTPS)
- Data encryption at rest
- Password hashing (bcrypt)
- Row-Level Security (RLS) at database level
- Role-based access control (RBAC)
- Webhook signature verification
- Regular security updates
6.4. Sub-processing
- Use sub-processors only under conditions specified in §7
- Ensure that sub-processors meet GDPR requirements
6.5. Assistance to Controller
- Assist in fulfilling data subject rights
- Assist in ensuring compliance with Art. 32-36 GDPR (security, DPIA, consultations)
- Provide information necessary to demonstrate compliance
6.6. Data Breaches
- Promptly (no later than 24 hours) notify the Controller of any data breach
- Document breaches and remedial actions taken
§6a. Controller Obligations
- The Controller represents that it has a legal basis for the processing entrusted to the Processor and for giving the Processor instructions.
- Before starting location recording of employees, the Controller fulfils its obligations under the employment and data protection law applicable to it, including any requirement to consult or inform employee representatives and to inform employees before monitoring starts.
- For Drivers who are not employees (e.g. contractors), the Controller ensures a separate legal basis.
- The Controller gives Drivers the information required by Art. 13 GDPR before they start using the Platform, and assesses whether a data protection impact assessment is required (Art. 35 GDPR). The Processor assists under §6.5.
- The Controller decides whether to enable features that affect the scope of processing (in particular the fleet map, speed display, auto-trip and manual entry mode) and is responsible for their consistency with the monitoring purposes set under point 2.
§7. Sub-processors (Further Entrustment)
7.1. Consent to Sub-processing
The Controller grants general consent for the Processor to use sub-processors listed in §7.3.
7.2. Obligations Towards Sub-processors
The Processor undertakes to:
- Enter into a data processing agreement with each sub-processor
- Ensure that sub-processors meet requirements no less than those specified in this Agreement
- Bear full responsibility for sub-processor actions
7.3. List of Sub-processors
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Supabase Inc. | Database hosting, authentication, Edge Functions | All user, trip, checkpoint data | |
| Stripe Payments Europe, Ltd. | Ireland (EU) | Organization billing data | |
| Vercel Inc. | Application hosting, CDN | Request logs, IP addresses | |
| Resend, Inc. | Transactional email delivery | USA | Email addresses, names, invitation tokens |
| Google LLC | Google Analytics (with consent) | USA | Anonymized analytics data |
| Apple Inc. | Maps and address search in the iOS app (MapKit, CLGeocoder on the device) | USA | Search text typed and trip coordinates |
| Google LLC | Maps in the Android app (Google Maps SDK on the device) and address search (Google Places through the Processor's server) | USA | Search text typed and the user's location as the centre of a 50 km search area (Places); device IP address and visible map area (Maps SDK) |
| OpenStreetMap Foundation | Geocoding (reverse geocoding) | GPS coordinates (no personal data) | |
| OpenStreetMap Foundation | Map tiles (map display in the browser) | United Kingdom | Browser IP address, visible map area |
| Distance calculation | GPS coordinates (no personal data) | ||
| Weather conditions | |||
7.4. Changes to Sub-processor List
- The Processor will notify the Controller of the intention to add or change a sub-processor
with 30 days' advance noticeby email to the Organization's billing address.with 14 days' advance notice - The Controller may object to a new sub-processor
within 14 days of notification. Lack of objection means acceptance.before that notice period ends - In case of justified objection, the parties will negotiate to find a solution. If no solution is reached, the Controller may terminate the agreement effective at the end of the current billing period.
§8. Data Transfers to Third Countries
8.1. Transfers to USA
Some sub-processors process data in the USA. Transfers are secured through:
Standard Contractual Clauses (SCC) approved by the European CommissionEU-US Data Privacy Framework (where applicable)
8.2. Sub-processors in Third Countries
8.1. Principles
The Processor transfers personal data outside the European Economic Area only where one of the mechanisms in Chapter V GDPR applies. For every sub-processor established in the USA, the Processor uses the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (SCCs). Where a sub-processor is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), the certification is an additional safeguard; if that decision is annulled, suspended or expires, transfers continue on the basis of the SCCs.
8.2. Transfer impact assessment
For each sub-processor established in the USA, the Processor has carried out and documents a transfer impact assessment (TIA) covering the law of the recipient country and the supplementary measures applied (in particular encryption in transit and at rest, and access control). The Processor will provide the Controller with a summary on request.
8.3. Sub-processors transferring data outside the EEA
| Sub-processor | Established in | Data stored in | Data transferred | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | USA | EU (Frankfurt); support access from third countries | All Platform data | SCCs, supplementary measures |
| Vercel Inc. | USA | Application servers in Frankfurt (EU); content delivery via a global network | Request logs, IP addresses | SCCs (and Data Privacy Framework where applicable) |
| Resend, Inc. | USA | USA | Email addresses, names, invitation tokens | SCCs |
| Google LLC (Google Analytics) | USA | USA | Analytics data (only with cookie consent) | SCCs and Data Privacy Framework |
| Apple Inc. (MapKit, iOS app) | USA | USA | Search text typed and trip coordinates | SCCs and Data Privacy Framework |
| Google LLC (Google Maps Platform, Android app) | USA | USA | Search text typed and the user's location as the centre of a 50 km search area (Places); device IP address and visible map area (Maps SDK) | SCCs and Data Privacy Framework |
| OpenStreetMap Foundation | United Kingdom | United Kingdom | GPS coordinates without user identifiers (geocoding); browser IP address (map tiles) | Commission adequacy decision (United Kingdom) |
| Zoomash Ltd (WeatherAPI.com) | United Kingdom | United Kingdom | GPS coordinates without user identifiers; in the iOS app also the device IP address | Commission adequacy decision (United Kingdom) |
The OSRM routing server (FOSSGIS) processes data in Europe.
8.4. Updates
The list in 8.3 is updated under the procedure in §7.4.
§9. Data Subject Rights
9.1. Assistance in Fulfilling Rights
The Processor undertakes to assist the Controller in fulfilling data subject rights under Art. 15-21 GDPR:
| Right | Platform Implementation |
|---|---|
| Right of access (Art. 15 GDPR) | Data export to Excel/PDF available for Drivers |
| Right to rectification (Art. 16 GDPR) | Profile editing, trip edit requests |
| Right to erasure (Art. 17 GDPR) | Administrator can deactivate Drivers; contact Processor |
| Right to portability (Art. 20 GDPR) | |
| Right to restriction (Art. 18 GDPR) | Contact Processor |
| Right to object (Art. 21 GDPR) | Contact Processor |
9.2. Response Time
The Processor will respond to Controller requests regarding data subject rights within 10 business days.
§10. Audit and Verification
10.1. Right to Audit
The Controller has the right to verify Processor compliance with this Agreement through:
- Requesting written information and documentation
- Conducting an audit (with 30 days' advance notice, during business hours)
10.2. Audit Costs
Audit costs are borne by the Controller, unless the audit reveals significant violations - in which case costs are borne by the Processor.
10.3. Audit Confidentiality
Audit results are confidential and may not be disclosed to third parties without Processor consent.
§11. Term and Termination
11.1. Term
This Agreement remains in effect for the entire period of the Controller's use of the Aroute Platform.
11.2. Termination
The Agreement terminates:
- Upon subscription end and expiration of the grace period
(90 days for voluntary cancellation or 30 days for non-payment)(90 days for voluntary cancellation) or of the data retention period (30 days from suspension for non-payment) - Upon termination of the Terms of Service
- By mutual agreement of the parties
11.3. Data Handling After Termination
- After Agreement termination, the Processor will:
Enable data export in CSV and PDF formats during the grace periodEnable export of all data in CSV and JSON during the grace period, or during the 30-day data retention period after non-payment- Delete personal data after the grace period expires; the Processor does not archive data for the Controller, and keeping records required by law is the Controller's responsibility
Retain data required by law (e.g., invoice data - 5 years from end of tax year per Polish tax law). Customers are responsible for retaining invoices according to their local tax requirements.Retain data required by law (e.g. invoice data, until the tax liability is time-barred (Polish tax law))
- Upon Controller request, the Processor will provide a data deletion certificate.
11.4. Platform Discontinuation
- In case of Platform discontinuation by the Processor, the Controller will be notified with at least 90 days' advance notice.
- During the notice period, the Controller will be able to export all data.
- After the notice period expires, data will be permanently deleted, except for data subject to mandatory legal retention.
11.5. GPS route points
The Processor keeps detailed GPS route points for about one quarter after the trip ends and then deletes them; the trip data (start and end point, addresses, distance, odometer readings) stays until the Agreement and the grace period end.
§12. Liability
12.1. Processor Liability
The Processor is liable for damages resulting from data processing in violation of this Agreement or GDPR provisions.
12.2. Limitation of Liability
The total liability of the Processor is limited to the sum of subscription fees paid by the Controller in the 12 months preceding the event, unless the damage results from gross negligence or intentional misconduct.
12.3. Liability for Sub-processors
The Processor is liable for acts and omissions of sub-processors as for its own acts.
§13. Agreement Amendments
- The Processor may introduce changes to this Agreement
with 30 days' advance notice.with 14 days' advance notice - The Controller will be notified of changes by email.
- Continued use of the Platform after changes take effect constitutes acceptance of the amended Agreement.
- If the Controller does not accept the changes, they may terminate the agreement before the changes take effect.
§14. Final Provisions
14.1. Governing Law
This Agreement is governed by GDPR and applicable EU law. For matters not regulated by EU law, Polish law shall apply as subsidiary law.
14.2. Dispute Resolution
Any disputes arising from this Agreement shall be resolved by the court having jurisdiction over the Processor's registered office, unless mandatory provisions of the Controller's country of establishment require otherwise.
14.3. Document Hierarchy
In case of conflict between this Agreement and the Terms of Service, the provisions of this Agreement shall prevail regarding personal data protection.
14.4. Severability
If any provision of this Agreement is found to be invalid, the remaining provisions shall remain in effect.
§15. Contact
Processor (data processor):
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
Email: office@emversa.com
Supervisory Authorities:
For a list of EU Data Protection Authorities, visit the European Data Protection Board (EDPB):
https://edpb.europa.eu/about-edpb/about-edpb/members_en
Document generated: February 19, 2026