Data Processing Agreement (DPA)

1. Roles

For vehicle and driver data processed on the Veturo platform, the customer, the fleet operator or employer, is the controller. Veturo (Gradac Trade Mirjana Plazinić PR, Vukašina Ignjatovića 14/2, 32000 Čačak, Serbia) is the processor and processes this data only to provide the contracted service, on the customer's documented instructions.

For enquiries through the veturo.io website and for its own business records (contracts, invoicing, support contacts), Veturo acts as an independent controller, as described in the Privacy Policy.

2. Subject matter and duration

The processing consists of operating the Veturo fleet tracking service: receiving data from the devices installed in the customer's vehicles, storing it, and presenting it on the platform as live views, history, alerts and reports. It lasts for the duration of the service agreement.

3. Data and data subjects

Categories of data: vehicle position, routes, speed, direction, ignition status and related telemetry; for vehicles on Pro and Fleet, data from the vehicle (fuel level, dashboard odometer, engine RPM and temperature, engine hours, door and driver's seat-belt status); vehicle and device identifiers; places, alerts and reminders the customer sets up; the name, work email and sign-in records of the platform users created by the customer; push-notification tokens and crash reports from the phone app.

Data subjects: drivers and other staff who use the customer's vehicles, and the customer's employees with platform accounts.

4. Customer obligations

The customer warrants that it has a lawful basis for tracking its vehicles and that drivers and other affected staff are informed before tracking begins, as required by the GDPR, local data protection law (the ZZPL in Serbia, ZVOP-2 in Slovenia) and applicable labour law. Veturo provides a ready-made employee notification template during onboarding.

Covert tracking of individuals is not a permitted use of the Veturo service.

5. Veturo's obligations

Veturo processes personal data only on documented instructions from the customer, ensures that everyone authorised to process it is bound by confidentiality, and applies appropriate technical and organisational measures, including encrypted transmission between the platform and users' browsers and apps, access control and regular backups.

6. Sub-processors

Veturo uses the following sub-processors, each only for the job named:

Hetzner Online GmbH (Germany): servers for the platform and this website, in Nuremberg (Germany) and Helsinki (Finland).

Backblaze, Inc. (USA): encrypted backups, stored in its EU Central region (Amsterdam).

Mapbox, Inc. (USA): the maps in the app.

LocationIQ (Unwired Labs): backup maps and street addresses.

Resend (Plus Five Five, Inc., USA): e-mail, sent from its region in Ireland.

1NCE GmbH (Germany): SIM cards and mobile data in the devices.

Google Firebase (Google Ireland Limited and Google LLC): push notifications and crash reports in the phone app.

OpenStreetMap Foundation (United Kingdom): address search in the Places editor.

By accepting these terms the customer gives general authorisation for their use. We give prior notice before adding or replacing a sub-processor, and the customer may object on reasonable grounds.

7. Data subject requests

Requests from drivers or other data subjects concerning data processed on the platform are addressed to the customer as controller. If a data subject contacts Veturo directly, we forward the request to the customer without undue delay and assist the customer in responding.

8. Data breaches

Veturo notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, and provides the information the customer needs to meet its own notification obligations.

9. Where data is stored

Tracking data is stored in the EU: the servers are in Germany and Finland, and backups in the EU Central region (Amsterdam).

Some sub-processors are outside the EU/EEA or have a US parent company (Mapbox, LocationIQ, Google, Backblaze, Resend); those transfers take place under the European Commission's standard contractual clauses (SCC).

Veturo itself operates from Serbia, which is outside the EU/EEA. For customers in the EU/EEA, the processing therefore takes place under the standard contractual clauses (SCC), signed together with the service agreement.

10. Deletion and return

When the service agreement ends, Veturo returns or deletes the customer's personal data, at the customer's choice, unless a legal obligation requires further storage. Copies in backups are removed in the regular backup rotation.

11. Audit

Veturo makes available to the customer the information necessary to demonstrate compliance with these terms and allows audits, agreed in advance and carried out at reasonable intervals without disrupting the service.

12. Governing law and contact

These terms follow the law governing the service agreement with the customer. Questions about this document: info@veturo.io.