Privacy Policy: changes marked in the text
In force from 4 November 2026 · deleted text · inserted text
Aroute Privacy Policy
Version: 1.0 | Effective date: February 19, 2026 | Market: EU (aroute.eu)Version: 1.1 | Effective date: 4 November 2026
§1. Data Controller
The data controller is:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
VAT ID: PL9720811257
Email: office@emversa.com
§2. Definitions
- Aroute Platform - a web application (PWA) and iOS mobile application for maintaining vehicle mileage records.
- Organization - a business entity that has entered into a service agreement with the Controller.
- Driver - a user assigned to an Organization, recording trips.
- GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
§3. Roles in Data Processing
3.1. Controller as Data Controller
The Controller (Emversa) is the data controller within the meaning of GDPR with respect to:
- data of Organization Administrators (management accounts),
- Organization contact data,
- marketing data (newsletter, consents),
- contact form data.
3.2. Controller as Data Processor
The Controller (Emversa) acts as a data processor within the meaning of Art. 28 GDPR with respect to:
- Driver data processed on behalf of the Organization,
- Driver trip and location data.
In this scope, the Organization is the data controller for its Drivers' personal data, and Emversa processes data based on the Data Processing Agreement (DPA).
3.3. Organization's Information Obligation
The Organization, as the data controller for Drivers' personal data, is obligated to fulfill the information obligation towards Drivers pursuant to Art. 13 GDPR before they start using the Platform.
§4. Categories of Processed Data
4.1. User Account Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Email address | Identification, login, communication | Art. 6(1)(b) GDPR - contract performance | |
| First and last name | Identification | Art. 6(1)(b) GDPR | |
| Password (hashed) | Authentication | Art. 6(1)(b) GDPR | |
| Language preferences | Interface localization | Art. 6(1)(f) GDPR - legitimate interest | |
| Working hours and days | Auto-trip configuration | Art. 6(1)(b) GDPR |
For Organization Administrator accounts the legal bases are set out in §5.1; for Driver accounts they are determined by the Organization (§5.5).
4.2. Organization Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Company name | Identification | Art. 6(1)(b) GDPR | |
| EU VAT ID | Invoicing | Art. 6(1)(c) GDPR - legal obligation | |
| Registered address | Invoicing | Art. 6(1)(b) GDPR | |
| Billing email | Invoice delivery | Art. 6(1)(b) GDPR | |
| Currency | Billing | Art. 6(1)(b) GDPR |
4.3. Trip Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| GPS coordinates (start/end) | Route documentation | ||
| Addresses (start/end) | Route documentation | ||
| Timestamps | Trip time | ||
| Odometer readings | Distance verification | ||
| Distance | Mileage reporting | ||
| Speed (max/average) | Analytics | ||
| Trip type (business/private) | VAT classification | ||
| Reimbursement amount | Cost settlement |
4.4. GPS Checkpoints
PARTICULARLY SENSITIVE DATA - precise locationHighly confidential data: precise location
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Latitude/longitude | Route recording | ||
| Altitude | Route accuracy | ||
| GPS accuracy (meters) | Data quality | ||
| Heading | Route analysis | ||
| Instantaneous speed | Speed monitoring | ||
| Address (geocoded) | Location identification | ||
| Timestamp | Time accuracy |
When GPS points are collected:
- At trip start
- Every 5 minutes during active trip
- Every 250 meters of movement
- At trip end
- Backbuffer (up to 5 minutes before trip confirmation in auto-trip mode)
Note: GPS points are NOT collected in manual entry mode.
A Driver who does not confirm location recording in the app can record trips in manual entry mode (where the Organization allows it); no GPS points are collected in that mode.
The fleet map shows current location only to the Organization's Administrators and only for company vehicles; private vehicles are not shown on the fleet map. Current speed is shown only if the Organization has enabled speed display.
We keep the detailed GPS route points for about one quarter after the trip ends. After that we delete them; the trip keeps only its start and end point, addresses, distance and odometer readings.
§5. Purposes and Legal Bases for Processing
5.1. Contract Performance (Art. 6(1)(b) GDPR)5.1. Performance of the contract with the Organization (Art. 6(1)(b) GDPR; for persons acting for the Organization, Art. 6(1)(f) GDPR)
Creating and managing user accountsCreating Organization and Administrator accounts, managing the subscriptionRecording trips and maintaining mileage recordsManaging vehicles and driversGenerating reports (Vehicle Mileage Log, Reimbursement Summary) and exportsProcessing reimbursement claimsSubscription management- Customer support
Sending email invitationsSending authentication emailsSending authentication and invitation emails
Where the Administrator is a party to the contract (a sole trader), the basis is Art. 6(1)(b) GDPR. Otherwise we process Administrators' data on the basis of our legitimate interest in performing the contract with the Organization and communicating with its representatives (Art. 6(1)(f) GDPR).
5.2. Legal Obligation (Art. 6(1)(c) GDPR)
- Tax documentation (EU VAT ID)
Invoice data retention (5 years from end of tax year per Polish tax law). Customers are responsible for retaining invoices according to their local tax requirements.Invoice data retention (until the tax liability is time-barred (Polish tax law)). Customers keep their own copies of invoices for as long as their tax law requires.Mileage records for VAT purposes- VAT verification data retention
5.3. Legitimate Interest (Art. 6(1)(f) GDPR)
- Abandoned registration recovery (lead capture)
- Service improvement and analytics
- Security monitoring and fraud prevention
Fleet map visualization (paid feature)Speed analytics and trip statistics (paid feature)Mileage gap and discrepancy detection
5.4. Consent (Art. 6(1)(a) GDPR)
- Marketing email communication (optional checkbox)
- Analytics cookies (cookie banner)
GPS checkpoint collectionAuto-trip detection- Contact form processing
Consent to location recording in the app is not consent given to us; see §5.5.
5.5. Driver data processed on behalf of the Organization
For Driver, trip, location, private vehicle and reimbursement data (§3.2) we act as a processor. The Organization, as controller, determines the purposes and legal bases of this processing and informs Drivers about them (Art. 13 GDPR). These may include in particular: an obligation or right under employment law in conjunction with Art. 6(1)(c) or (f) GDPR, the contract between the Organization and the Driver (Art. 6(1)(b) GDPR), the Organization's legitimate interest, e.g. settling vehicle costs (Art. 6(1)(f) GDPR), or the Driver's consent collected in the app on the Organization's behalf (Art. 6(1)(a) GDPR). On the Organization's instructions we provide: trip recording and the mileage log, vehicle and Driver management, reports and exports, reimbursement claims, the fleet map, speed analytics, gap detection and automatic trip detection (auto-trip). Drivers can contact the Organization about this data; requests sent to us are forwarded to the Organization.
§6. Data Processors (Sub-processors)
The Controller uses the following data processors:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Supabase | Supabase Inc. | Database hosting, authentication, RLS | |
| Stripe | Stripe Payments Europe, Ltd. | Ireland (EU) | |
| Vercel | Vercel Inc. | Application hosting, CDN | |
| Resend | Resend, Inc. | Transactional email delivery | USA |
| Google Analytics | Google LLC | Website analytics (with consent) | USA |
| Apple Maps (MapKit) | Apple Inc. | Maps and address search in the iOS app (MapKit, CLGeocoder on the device) | USA |
| Google Maps Platform | Google LLC | Maps in the Android app (Google Maps SDK on the device) and address search (Google Places through our server) | USA |
| OpenStreetMap Nominatim | OpenStreetMap Foundation | Geocoding (coordinates → addresses) | |
| OpenStreetMap map tiles | OpenStreetMap Foundation | Map display (browser IP address, visible map area) | United Kingdom |
| OSRM | Route distance calculation | ||
| WeatherAPI | Weather conditions during trips | ||
| VIES API | European Commission | EU VAT verification | EU |
§7. Data Transfers to Third Countries
Some data processors may transfer data outside the European Economic Area:
| Service | Location | Transfer Mechanism |
|---|---|---|
| Supabase | USA (company); data stored in the EU (Frankfurt), support access from third countries | Standard Contractual Clauses (SCC), supplementary measures |
| Vercel | ||
| Resend | USA | Standard Contractual Clauses (SCC) |
| Google Analytics | USA | SCC + EU-US Data Privacy Framework |
| OpenStreetMap (geocoding, map tiles), WeatherAPI (Zoomash Ltd) | United Kingdom | Commission adequacy decision |
| Apple Maps (iOS app) | USA | SCC + EU-US Data Privacy Framework |
| Google Maps Platform (Android app) | USA | SCC + EU-US Data Privacy Framework |
In case of data transfer to third countries, appropriate safeguards are applied pursuant to Chapter V of GDPR.For every provider established in the USA we use the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914); where the provider is certified under the EU-US Data Privacy Framework, this is an additional safeguard, and if that decision ceases to have effect, transfers continue to rely on the Standard Contractual Clauses. We have carried out a transfer impact assessment for each such provider. A copy of the safeguards is available from office@emversa.com.
§8. Data Retention Periods
8.1. Active Accounts
| Data Category | Retention Period |
|---|---|
| User account data | |
| Organization data | |
| Trip data | |
| Vehicle data | |
| Reimbursement claims | |
| Invoice data (VAT ID, address) | |
| Marketing subscriber data | Until unsubscribe |
8.2. After Subscription End
Voluntary cancellation:
- Grace period: 90 days from end of paid period
- During grace period: All data preserved, export available
After grace period: Organization deactivated, data preserved per legal requirementsAfter the grace period: the Organization is deactivated and its data (user accounts, trips, GPS points, vehicles, claims) is permanently deleted. We keep only billing data (data on invoices issued by Emversa and payment records), for the period tax law requires. Export the data you want to keep before the grace period ends.- The Platform is not an archive: the Organization downloads its reports and data and keeps them in its own files for as long as the tax law that applies to it requires (Terms, 7.5 and 7.6).
Non-payment:
- Immediate access suspension
- Data preserved for 30 days
After 30 days: Organization deactivatedAfter 30 days: the Organization is deactivated and its data is permanently deleted as above.
8.3. Account Deletion (GDPR Right to Erasure)8.3. Deletion of an Administrator or Organization account (GDPR right to erasure)
- Personal data: Deleted
- Trip and GPS data: Deleted
Invoice data (VAT ID, address):Retained 5 years from end of tax year (Polish tax law). Customers are responsible for retaining invoices according to their local tax requirements.Invoice data: Retained until the tax liability is time-barred (Polish tax law). Customers keep their own copies of invoices for as long as their tax law requires.
When a Driver leaves the Organization or is removed by it, their trips remain with the Organization, which as controller keeps them for its tax records. Requests to erase this data should be sent to the Organization.
8.4. Registration Leads
- Completed registrations: Converted to user account
- Abandoned registrations: 30 days, then soft delete
8.5. Contact Inquiries
- Active: Until inquiry resolution
- Resolved: Deleted after resolution
§9. Data Subject Rights
9.1. Rights Implemented in Platform
| Right | Implementation |
|---|---|
| Right of access | Users can view all their data in the app; Excel export available |
| Right to rectification | Users can update profile; Drivers submit trip edit requests |
| Right to data portability | |
| Right to withdraw consent | Cookie settings reset; marketing unsubscribe via profile settings; location consent withdrawal |
9.2. Rights Requiring Manual Process
| Right | Process |
|---|---|
| Right to erasure | Contact: office@emversa.com; Administrator can deactivate users |
| Right to restriction of processing | Contact: office@emversa.com |
| Right to object | Contact: office@emversa.com |
9.3. Special Notes
Invoice data:Retained 5 years from end of tax year per Polish tax law, even after account deletion request. Customers are responsible for retaining invoices according to their local tax requirements.Invoice data: Retained until the tax liability is time-barred (Polish tax law), even after an account deletion request. Customers keep their own copies of invoices for as long as their tax law requires.- Anonymization: Preferred over deletion when legal retention is required
§10. Data Security
10.1. Technical Measures
- Encryption in transit: TLS/HTTPS for all communication
- Encryption at rest: Database encryption (Supabase)
- Password hashing: bcrypt via Supabase Auth
- Data isolation: Row-Level Security (RLS) at database level
- Access control: RBAC (Driver < Administrator)
10.2. Organizational Measures
- Least privilege policy: Users have access only to necessary data
- Webhook verification: Stripe and Supabase signature verification
- Rate limiting: Implemented at edge level (Vercel)
§11. Cookies
Detailed information about cookies is contained in the Cookie Policy available at: aroute.eu/cookies.
§12. Data Breach
12.1. Supervisory Authority Notification
In case of a personal data breach that may pose a risk to the rights and freedoms of natural persons, the Controller will notify the competent supervisory authority within 72 hours of breach detection.
12.2. Data Subject Notification
If the breach may pose a high risk to the rights and freedoms of natural persons, the Controller will notify affected data subjects without undue delay.
§13. Minor's Data
- The Aroute Platform is intended exclusively for business users (B2B). Organization account registration and the Administrator role requires being of legal age (18 years old).
- A Driver on the Platform may be a minor (16-17 years old) if they are legally employed by the Organization and hold appropriate driving licenses in accordance with applicable national law.
- In the case of minor Drivers, the Organization (as the data controller for its employees' personal data) is responsible for:
- obtaining all required consents from parents or legal guardians in accordance with labor law provisions,
- fulfilling the information obligation towards the minor and their legal guardians,
- ensuring data processing compliance with regulations concerning the employment of minors.
- Emversa does not direct marketing services or direct communication to minors.
§14. Do Not Track Signals
The Platform does not respond to "Do Not Track" (DNT) signals sent by web browsers. Users may manage their tracking preferences through cookie settings available in the Platform and in the cookie policy.
§15. Automated Decision-Making
The Platform does not use automated decision-making, including profiling, as referred to in Art. 22(1) and (4) of GDPR, which produces legal effects or similarly significantly affects users. All decisions regarding trip approvals, reimbursement claims, and similar matters are made by authorized users (Organization Administrators), not by algorithms.
§16. Changes to Privacy Policy
- The Controller reserves the right to change this Privacy Policy.
- Users will be notified of changes by email at least 14 days before the changes take effect.
- The current version of the Privacy Policy is always available at: aroute.eu/privacy.
§17. Contact
For personal data protection matters, please contact:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
Email: office@emversa.com
Supervisory Authorities:
You have the right to lodge a complaint with your national data protection supervisory authority. A list of EU/EEA supervisory authorities is available at: EDPB Members.
Document generated: February 19, 2026