Privacy policy

Who is responsible?

Drivaro is responsible for the data we use to manage your account, customer relationship, billing and service security. For employee, vehicle and delivery records, your company decides why the data is used. Drivaro processes that data on the company’s behalf.

Data comes from you, your employer, authorised colleagues and carriers, for example through a connected complaints mailbox. For questions about your employee record, contact your employer or us; we help direct your request to the responsible party.

What data do we use?

Reminders use dates, not document contents. Drivaxo does not request copies or numbers of identity documents or driving licences, national-register numbers, or copies or contents of employment contracts. A date linked to an employee is still personal data.

• Account and contact: name, email address, language, role and protected sign-in credentials.
• Work and vehicles: employee contact details, including an address if entered, employment start and end dates, carrier-issued codes, leave and absence, vehicle details and assignments, mileage, parcel and stop counts, fuel entries and maintenance.
• Company registration and billing: business name, address, enterprise and VAT numbers for verification and administration, including information from public registers.
• Reminders: the type of deadline, its end or expiry date and the employee or vehicle concerned, for example a contract end, inspection, insurance or maintenance date.
• Complaints: case and parcel numbers, delivery addresses, messages, replies, attachments and delivery statuses.
• Security: sessions, device keys and notification identifiers, technical connection details such as IP addresses, and recorded system actions.

Why do we need it?

To manage accounts, support daily operations, handle complaints and send service messages. Required fields are necessary for the relevant feature; without those details, that feature cannot be used.

For our own processing, we rely on performing a contract, legal record-keeping obligations and our legitimate interests in customer contact, security and preventing misuse. Where processing relies on consent, you can withdraw it. Your company determines the legal basis for the employee and delivery data it enters.

Rules can match and prioritise complaints and send suitable replies. Exceptions require human review. Drivaxo does not independently decide on dismissal, pay or disciplinary action.

Camera, biometrics and notifications

• The fuel reader uses the camera only when you open it. Recognition takes place on the device. This feature does not save or upload a photograph; only the litres and amount you confirm are stored. This is separate from necessary complaint attachments, which are kept with the case.
• Face ID or Touch ID is optional and handled by your device. Drivaxo does not receive a face scan or fingerprint.
• Push notifications use technical device or installation identifiers through Firebase and, on iOS, Apple. Lock-screen messages are generic; case details are accessed after sign-in. You can turn notifications off in your device settings.

Location and maps

Drivaxo does not continuously track your trips through your phone’s location. If the charging-point feature is available and you start a nearby search, your device asks for location permission. The location is sent to Drivaxo to find charging points, not to build a route history.

The map loads through OpenFreeMap. The map service receives technical request data such as your IP address and the requested map area. If you open navigation in Google Maps, that service’s privacy rules also apply.

After confirmation, you may open a Google charging-point map: Maps Embed on the website or Maps SDK in a compatible app version. Google receives public charging-point coordinates and technical request data. This map feature does not send employee locations, vehicle movements or delivery addresses to Google.

Who can see your data?

Access is assigned by company and role. Other customer companies cannot access your workspace. Authorised support may need access to investigate a problem.

We use Google Cloud for hosting and backups, Cloudflare for connectivity and security, Resend for service email and Firebase/Apple for push notifications. For a connected mailbox, Google or Microsoft processes the necessary email data. Complaint replies go to the relevant carrier; external services you choose receive the data needed for that action.

When available, an authorised Owner or Manager may export a selected employee statement from the website to Google Sheets or an Excel file in Drive, or a registration and saved due dates to a new Google Calendar. Confirmation identifies the company and fields: employee names and counts; registration and maintenance, inspection and insurance dates. Documents and passwords are not exported.

You choose and authorise the Google account separately. Each export creates a new file or calendar without sharing by Drivaxo or reading existing files, calendars or Gmail through this connection. The temporary access token stays in browser memory; the server stores no access or refresh token. Google keeps the export until you delete it there. Revoking access does not delete earlier exports; your company remains responsible for those copies and later sharing.

We do not sell personal data or use it for advertising. Disclosure to competent authorities may be necessary when required by law.

Processing outside Europe

Our primary database and cloud backups are in the Belgian Google Cloud region. Other providers operate worldwide, so data may also be processed outside the European Economic Area. The providers page describes these services. Contact [email protected] for the countries involved, applicable safeguards, such as an adequacy decision or European standard contractual clauses, and a copy of those safeguards.

How long is data kept?

Retention depends on the purpose: account details for as long as the account is needed; business records for as long as needed for your company’s instructions, open cases or applicable legal obligations. Record-keeping and disputes may require longer retention. There is no single retention period for all data.

Automatic complaint deletion is not yet active. The intended 30-day period starts after confirmed closure of an email-sourced complaint, provided no follow-up, dispute or other retention duty remains. It does not delete the original mailbox. Manual cases and direct data from future carrier integrations are outside that rule and need their own retention assessment.

Signing out or uninstalling the app does not erase business records. Deletion requests are handled with the responsible party. Local database backups are cleaned up after roughly two weeks; cloud backups follow a 90-day deletion rule and remain recoverable for seven more days. They are not for everyday use; earlier deletions must be reapplied after a restore.

Security and cookies

We limit access through user permissions and separate company workspaces. We use encrypted connections, hashed passwords and records of important actions. No service can guarantee absolute security.

Cookies and local storage support sign-in, security and preferences such as language and appearance. We do not use advertising cookies or built-in marketing analytics. External services, such as a map you open, process their own technical request data.

The web account cookie lasts up to eight hours; the website remembers your chosen language for the browser session. Local app preferences remain until changed or cleared. Blocking cookies may prevent sign-in. The Cookies & local storage page has the details.

Your data, your rights

You can request access, correction, deletion or restriction of your data. Where applicable, you can also object, request data portability or withdraw consent. These rights have limits: legal retention duties or other people’s rights may apply.

Email [email protected] with your request and the company concerned. Do not send a password or identity-document copy. If verification is needed, we will agree on an appropriate method. For data Drivaro controls, we normally respond within one month and explain any permitted extension within that month. For work records controlled by your company, we promptly forward the request and help the company respond. You may also contact us directly.

You can also complain to the Belgian Data Protection Authority or the authority in the country where you live or work. This policy may change as the service changes; the date above identifies the latest version.