Privacy and personal data protection

Responsibilities

GeoFleet is used under a data processing agreement : the customer (haulier, company, authority) is the data controller for its objects and drivers; the platform operator acts on its instructions. A data processing agreement can be provided on request.

Data processed

• Identity of account users (name, e-mail, phone); login credentials;
• Location data of the objects (positions, timestamps, speeds), registration plates, drivers;
• Fleet documents (insurance, inspection), incident reports and internal messages;
• Access and audit logs (who viewed, changed or exported what).

Legal bases and required information

Tracking a company vehicle relies on the employer's legitimate interest; drivers must be informed before installation (information notice, vehicle usage charter). Any retention beyond the necessary period is avoided.

Retention periods and rights

• Positions: kept for the period configurable by the operator (12 months by default, 3 to 36 months);
• Accounts, invoices and audit logs: statutory accounting and contractual retention period;
• Rights of access, rectification, erasure, objection and portability : the customer exercises them with the operator or, for its own employees, within its account (data export).
• Data is not sold or transferred to third parties other than necessary processors (host, SMS gateway, payment provider) and legal obligations.

Security

Transport encryption (TLS), secrets encrypted at rest, passwords stored with PBKDF2, two-step verification available for every account, strict isolation per organisation, audit log.

Transfers outside the country

Hosting is chosen by the operator; any transfer outside the territory is framed by the safeguards required by the regulations (Tunisian law No. 2004-63 and, where applicable, GDPR).

Applicable version : 2.15.0 — any change is notified in the application.