Privacy Policy

1. Data we process

• Contact details: name or company name, email address, phone number, address, invoicing details.
• Account data: user name, hashed password, role, sign-in logs and IP address.
• Location and telematics data from devices: GPS coordinates, time, speed, heading, ignition status, distance driven, fuel and sensor data, device and SIM identifiers.
• Usage data: platform access logs, technical logs, browser and device information.
• Communication: the content of enquiries, emails and support requests.

2. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): providing the tracking service, support, hardware delivery and billing.
• Legal obligation (Art. 6(1)(c) GDPR): accounting, tax rules, mandatory retention of documentation.
• Legitimate interest (Art. 6(1)(f) GDPR): system security, abuse prevention, service improvement, debt recovery.
• Consent (Art. 6(1)(a) GDPR): optional cookies, newsletters and marketing messages. You may withdraw consent at any time.

3. The customer as controller

Where a company uses our platform to track its own fleet, the customer is the controller for the processing of its employees’ and drivers’ data, and we act as a processor under Art. 28 GDPR on the basis of a data processing agreement.

The customer is responsible for having an appropriate legal basis for monitoring vehicles and drivers, for informing drivers in writing in advance about the scope and purpose of the monitoring, and for complying with employment law and workplace privacy rules.

4. Retention periods

• Location and telematics data: as a rule 12 months from collection, unless agreed otherwise in writing with the customer or unless the data is needed to resolve a dispute.
• Invoices and accounting documents: 10 years in line with tax legislation.
• Contact enquiries: up to 24 months after the last contact.
• Access and security logs: up to 12 months.

5. Recipients and processors

We disclose data only to authorised employees and carefully selected contractual processors with whom we have data processing agreements in place: hosting and cloud infrastructure providers, an email delivery provider, a payment service provider, an accounting service and mobile network operators for device data transmission.

We do not sell data. Where data is transferred outside the EU/EEA, this takes place on the basis of an adequacy decision or the European Commission’s standard contractual clauses.

6. Your rights

• Access to your data, rectification, erasure and restriction of processing.
• Data portability and objection to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of processing before the withdrawal.
• Send your request to it@netko.it. We reply within one month at the latest.
• You may lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si).

7. Security

We use encrypted data transmission (TLS), role-based access control, separated environments, regular backups and access logging. Even so, no system is completely secure; in the event of a personal data breach we act in accordance with Art. 33 and 34 GDPR.

8. EEVY GPS Tracking mobile app

Vehicle tracking on mobile devices is available through the EEVY GPS Tracking app (Google Play: com.eevygroup.gps, App Store: id6446815943), provided by EEVY LLC. This section explains data processing in the mobile app and supplements the sections above.

• Precise location: processed to show vehicle positions, trip history, geofences and alerts, and for the basic operation of the tracking service. The legal basis is performance of a contract (Art. 6(1)(b) GDPR); for company vehicles the customer acts as controller in line with section 3.
• Background location collection: The app does not collect the device location in the background. The vehicle location is transmitted by the tracking device installed in the vehicle, not by the mobile phone. During active use, the app may access the phone location only to display your position on the map, and only if you allow it; you can revoke this permission at any time in your device settings.
• Retention of location data: the same as on the platform — as a rule 12 months from collection (section 4), unless agreed otherwise in writing with the customer.
• Crash logs and diagnostics: processed to fix errors and to keep the app stable and secure, on the basis of legitimate interest (Art. 6(1)(f) GDPR). Crash logs and diagnostic data are retained for 90 days and then deleted automatically. We use Sentry as a contractual processor for their processing.
• Encryption: all data between the app and our servers is transmitted encrypted (TLS/HTTPS).
• We do not sell app data and do not share it with third parties for their own purposes; we only use the contractual processors listed in section 5.
• Account deletion: you can request deletion of your user account and app data at https://mojgps.si/delete-account — we process every request within 30 days at the latest.
• You can withdraw permissions at any time in your device settings (location, notifications); without the location permission, tracking in the app does not work.