Privacy policy – Navifleet Manager

Navifleet Manager is an application available in a web and a mobile version (hereinafter the “App").

Besides the application itself, there are also separate websites presenting the offer, the features and the capabilities of the application (hereinafter the “Websites").

The Application and the Websites are operated by NAVIFLEET Spółka z ograniczoną odpowiedzialnością, ul. Mogilska 43, 31-535 Kraków, Poland, VAT ID (NIP): 7372169791, company number (KRS): 0000954712, registry court: District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, share capital: PLN 60,000.00.

Your use of the Application and the Websites involves the processing of personal data and of information collected with cookies or other similar technologies. This privacy policy contains all the important information about it.

If you are reading this privacy policy as an employee, associate, contractor or subcontractor and your personal data was entered into Navifleet by the entity employing you, please note that to that extent we do not act as the controller of your personal data, but only as a processor entrusted with it. In that case this privacy policy does not apply to you in the part concerning the processing of personal data in connection with concluding and performing the contract for the use of Navifleet.

Table of contents

Who is the controller of the personal data?
Who can you contact about the processing of personal data?
For what purposes do we process personal data?
What information about you do we hold?
Where do we get information about you from?
Is the data safe?
How long do we keep personal data?
Who are the recipients of the personal data?
Do we transfer data to third countries or international organisations?
Do we use profiling?
What rights do you have?
Do we use cookies or other similar technologies, and what does that involve?
On what basis do we use cookies or other similar technologies?
Can you switch cookies or other similar technologies off?
For what purposes do we use cookies or other similar technologies?
Which third-party tools do we use?
Do we track your behaviour on the website?
Do we target advertising at you?
How can you manage your privacy?
Is there anything else you should know?
Can this privacy policy change?

Annex – list of third-party tools

# 1: Who is the controller of the personal data?

The controller of your personal data is NAVIFLEET Spółka z ograniczoną odpowiedzialnością, ul. Mogilska 43, 31-535 Kraków, Poland, VAT ID (NIP): 7372169791, company number (KRS): 0000954712, registry court: District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, share capital: PLN 60,000.00. Wherever this privacy policy says “we”, “our” and the like, it refers to that entity.

# 2: Who can you contact about the processing of personal data?

As part of implementing data protection in the company, we decided not to appoint a data protection officer (DPO), because in our situation this is not mandatory.

On matters relating to data protection and privacy in general you can contact us at [email protected].

# 3: For what purposes do we process personal data?

There is more than one purpose. Below you will find a list of them with a more detailed description. Each purpose is matched with the relevant legal basis for processing.

Concluding and performing the contract for the use of the Application

The contract is concluded by completing the registration form on the terms set out in the Application's terms and conditions, and requires providing the personal data needed for that purpose. Providing the data is a condition of concluding the contract. Concluding the contract results in a user account being created in the Application. When editing the account details you may provide further data, according to the options available in the account. Identification and contact data is entered into the CRM system. Invoicing data goes into the accounting records so that we can meet our tax obligations. After the contract is terminated or expires, the data goes into the archive for the possible establishment, pursuit or defence of claims connected with the contract.

Legal basis: Article 6(1)(b) GDPR

Handling complaints or withdrawal from the contract

If you submit a complaint or withdraw from the contract, you provide the personal data contained in the complaint or in the withdrawal statement. Providing the data is a condition of submitting a withdrawal statement or a complaint. Once the complaint or the withdrawal has been handled, the data goes into the archive for the possible establishment, pursuit or defence of claims connected with handling the withdrawal or the complaint.

Legal basis: Article 6(1)(c) GDPR in conjunction with the relevant provisions on the right of withdrawal and on conformity with the contract

Handling correspondence

When you contact us through the available channels, such as e-mail, social messengers or chat, you naturally provide the personal data contained in your messages. Providing the data is a condition of getting in touch. Correspondence may also be pulled into the CRM system. Once the exchange of correspondence ends, the data goes into the archive for the possible establishment, pursuit or defence of claims connected with it

Legal basis: Article 6(1)(f) GDPR – the controller's legitimate interest in replying to incoming messages

Accounting

In connection with performing the contract we also carry out various tax and accounting duties, in particular issuing an invoice, including it in our accounting records, storing documentation and so on. To issue an invoice we process data such as first name and surname, company name, business address and VAT ID. Providing the data required by tax law is necessary to meet those duties.

Legal basis: Article 6(1)(c) GDPR in conjunction with the relevant provisions of tax law

Archive

For the purposes of our business we may create archives, both traditional and digital. The archives hold the personal data we processed in connection with you, and its scope may differ depending on what data reached us and what is justified for archiving purposes. The archive is created for the defence, establishment or pursuit of claims and for accountability (demonstrating that we complied with data protection rules, for example by properly handling requests concerning the data we process).

Legal basis: Article 6(1)(f) GDPR – the controller's legitimate interest in securing data for the establishment, defence or pursuit of claims and for demonstrating compliance with the obligations under the GDPR (accountability)

Our own marketing

We run marketing activities, among others with third-party tools such as Facebook Ads and LinkedIn Ads. Detailed information about third-party tools can be found in the section of this privacy policy devoted to the tools we use. In addition, the e-mail address we hold in our database may be sent to a given advertising system (for example Facebook Ads or LinkedIn Ads) in order to create an audience based on that address. When this feature is used, the e-mail address is hashed before being sent to the system to create the audience. The address is used in the matching process run by that advertising system. The advertising system does not share the e-mail address with third parties or other advertisers and deletes it immediately after the matching process ends. The advertising system applies processes and procedures ensuring the confidentiality and security of the e-mail address sent to it and of the set of user identifiers forming the audience created with that address, among others through technical and physical safeguards.

Legal basis: Article 6(1)(f) GDPR – the controller's legitimate interest in creating, reviewing and analysing statistics on how users use the Application or the Websites in order to improve them further

Analytics and statistics

We carry out analytical and statistical activities using tools provided by third parties, such as Google Analytics, Amplitude and Freshsales. Detailed information about third-party tools can be found in the section of this privacy policy devoted to the tools we use.

Meeting data protection obligations

As a controller of personal data we are required to meet data protection obligations. We may therefore process your personal data where this is necessary to meet them (for example when handling your request concerning personal data). The scope of the data depends on what we need to meet the obligation and to demonstrate compliance with the GDPR.

Legal basis: Article 6(1)(c) GDPR in conjunction with the other relevant provisions of the GDPR

Meeting obligations under the Digital Services Act (DSA)

As a provider of intermediary services we are required to meet the obligations under the Digital Services Act (DSA), such as receiving and handling notices concerning stored content or information, receiving and handling appeals against decisions we have taken, providing specific information about a user upon an order issued by authorised institutions or bodies, and notifying law enforcement or judicial authorities of a suspected criminal offence threatening the life or safety of a person or persons in connection with the use of the Application or the Websites. For those purposes we process personal data to the extent necessary to meet the obligations laid down by law.

Legal basis: Article 6(1)(c) GDPR in conjunction with the relevant provisions of the DSA

# 4: What information about you do we hold?

For each of the purposes described above we may process a different scope of data – whatever is necessary for that purpose. The data includes information such as:

first name and surname,
e-mail address,
phone number,
IP address,
delivery address,
invoicing data,
bank account number,
information contained in correspondence,
information about the device used to access the Application or the Websites, such as device type, operating system and web browser,
demographic data, such as approximate location, age range and gender,
statistics on activity in the Application or on the Websites, such as link clicks and time spent on the Website or in the Application.

# 5: Where do we get information about you from?

In most cases you provide it yourself. That happens, for example, when you register a user account in the Application and enter data about vehicles, users and other objects in the system, when you submit a complaint or when you contact us.

In addition, some information about you may be collected automatically by the tools we use. Detailed information about third-party tools can be found in the annex to this privacy policy.

# 6: Is the data safe?

We take care of the security of your personal data. We analysed the risks involved in each processing operation and then implemented appropriate security and data protection measures. We continuously monitor the state of our technical infrastructure, train our staff, review our procedures and introduce the improvements needed.

# 7: How long do we keep personal data?

We keep your personal data for as long as it is justified for the given processing purpose, so retention periods differ from purpose to purpose. Please note that the end of processing for one purpose does not necessarily mean your personal data is deleted or destroyed in full, because the same set of data may be processed for another purpose, for the period indicated there. Complete deletion or destruction takes place once we have completed all purposes and in the other cases set out in the GDPR.

The retention periods are set out in the table below.

Concluding and performing the contract

Until the contract has been performed.

Complaints and withdrawals from the contract

Until the complaint or the withdrawal has been handled.

Analytics and statistics

Until the information is no longer useful or until an objection to the processing is raised.

Our own marketing

Until the information is no longer useful or until an objection to the processing is raised.

Contact and correspondence

For as long as we are in contact.

Tax and accounting obligations

For the period required by law.

Archive

Until claims become time-barred.

Data protection obligations

Until the limitation period for our liability as a controller of personal data expires.

Obligations under the DSA

Until the limitation period for our liability as a provider of an intermediary service expires.

# 8: Who are the recipients of the personal data?

It is fair to say that modern business cannot do without services provided by third parties. We use such services too. Some of them involve the processing of your personal data. The external providers taking part in processing your personal data are listed in the table below.

Hosting provider

Storing data on a server.

Invoicing system provider

Issuing invoices.

Analytics system provider

Carrying out analytical and statistical activities.

Accounting office

Accounting.

CRM system provider

Project management, improving our work, our own marketing.

Technical support

Technical work on areas containing personal data.

Where necessary, your data may be disclosed to a legal adviser or attorney bound by professional secrecy. The need may arise where legal assistance requires access to your personal data.

Your personal data may also be passed to the tax authorities to the extent necessary to meet tax, settlement and accounting obligations. This concerns in particular any returns, reports, statements and other accounting documents containing your personal data.

In addition, where necessary, your personal data may be disclosed to entities, authorities or institutions entitled to access it under the law, such as the police, security services, courts and prosecutors.

The providers of the third-party tools we use (see the annex to this privacy policy) have access to the information those tools collect. They are independent controllers of that data and may share it on the terms set out in their own terms and privacy policies, which we have no influence over.

# 9: Do we transfer data to third countries or international organisations?

No, we do not transfer data to third countries or international organisations.

Only anonymous information collected with cookies or other similar technologies used by the third-party tools we use (see the annex to this privacy policy) may be transferred to third countries, in particular to the USA. Those transfers are decided independently by the providers of the tools.

# 10: Do we use profiling?

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. We do use tools that let us take certain actions depending on the information gathered by tracking mechanisms, but we believe these actions do not significantly affect you, because they do not change your situation as a customer, do not influence the terms of the contract you may conclude, and so on.

Using certain tools, we may, for example, show you personalised advertising based on what you did earlier on a given website, or suggest solutions that may interest you. This is known as behavioural advertising. We encourage you to learn more about it, in particular about the privacy aspects. Detailed information, together with the option to manage your behavioural advertising settings, can be found here.

# 11: What rights do you have?

The GDPR gives you the following potential rights in connection with the processing of your personal data:

the right to access your data and to receive a copy of it;
the right to rectify (correct) your data;
the right to erasure (if you believe there is no basis for us to process your data, you may request that we delete it);
the right to restrict processing (you may request that we limit processing to storage only or to actions agreed with you, if in your view our data is incorrect or we process it without a basis);
the right to object to processing (you may object to processing based on legitimate interest; you should indicate the particular situation that in your view justifies stopping the processing objected to; we will stop processing your data for those purposes unless we demonstrate that the grounds for processing override your rights or that your data is necessary for the establishment, pursuit or defence of claims);
the right to data portability (you have the right to receive, in a structured, commonly used, machine-readable format, the personal data you provided on the basis of a contract or your consent; you may ask for it to be transmitted directly to another entity);
the right to withdraw consent to the processing of personal data, if you gave such consent earlier;
the right to lodge a complaint with a supervisory authority (if you believe we process data unlawfully, you may complain to the President of the Personal Data Protection Office or another competent supervisory authority).

The rules for exercising the rights listed above are set out in detail in Articles 16–21 GDPR. We encourage you to read them. For our part, we think it is worth explaining that these rights are not absolute and will not apply to every processing operation concerning your personal data.

We should stress that one of the rights above always applies: if you believe that we have breached data protection law when processing your personal data, you may lodge a complaint with the supervisory authority (the President of the Personal Data Protection Office).

# 12: Do we use cookies or other similar technologies, and what does that involve?

Our Websites and the Application, like almost all other websites and applications, use cookies and other similar technologies, such as tracking codes or pixels, conversion APIs and so on.

Cookies and other similar technologies collect certain information which is then used for various purposes, from making sure particular features of the Websites or the Application work properly, through analysing user behaviour, to delivering targeted advertising.

If you want to learn more about cookies and other similar technologies, you can read, for example, these materials:

# 13: On what basis do we use cookies or other similar technologies?

We use cookies and other similar technologies on the basis of your consent, except where they are necessary to provide the services to you properly.

Cookies and other similar technologies that are not necessary for the proper provision of services stay blocked until you consent to their use.

# 14: Can you switch cookies or other similar technologies off?

Yes. You can manage cookie settings and other similar technologies in your web browser. You can block all or selected cookies and other similar technologies. You can also delete previously saved cookies and other site and plug-in data at any time.

Browsers also offer an incognito mode. You can use it if you do not want information about the pages you visit and the files you download to be saved in your browsing and download history. Cookies created in incognito mode are deleted once all windows in that mode are closed.

There are also browser plug-ins that give you control over cookies and similar technologies, such as Ghostery. Control over cookies and similar technologies may also be offered by additional software, in particular antivirus suites.

There are also tools on the internet that let you control certain types of cookies or other technologies, in particular for managing behavioural advertising settings collectively.

We also give you control over cookies and other similar technologies directly from our Websites. We have implemented a privacy mechanism that lets you block the cookies or other technologies you do not want. Please note that switching off or limiting cookies or other technologies may make some features of the Websites unusable and may cause difficulties in using the Websites, as well as many other websites that use cookies or similar technologies.

# 15: For what purposes do we use cookies or other similar technologies?

Cookies and other similar technologies are used to make sure particular mechanisms of the Websites and the Application work properly, such as keeping a session alive after logging in, submitting the forms on the Websites correctly and remembering certain choices.

Cookies and other similar technologies are also used for statistical, analytical and marketing purposes.

Cookies also store information about the cookie settings you chose in the privacy mechanism on our Websites.

Some cookies and other similar technologies relate to the third-party tools we use, and the providers of those tools may access the information collected with them. Details about third-party tools can be found in the annex to this privacy policy.

# 16: Which third-party tools do we use?

A list of the tools that require cookies or other similar technologies, together with a detailed description of them, can be found in the annex to this privacy policy.

# 17: Do we track your behaviour on the website?

Yes. We use third-party tools that collect information about your activity on the Websites or in the Application. Those tools are described in detail in the annex to this privacy policy.

# 18: Do we target advertising at you?

Yes. We use third-party tools that let us target advertising at audiences defined by criteria such as age, gender, interests, profession, job and earlier activity on the Websites or in the Application. Those tools are described in detail in the annex to this privacy policy

# 19: How can you manage your privacy?

The answer appears in several places in this privacy policy, where particular tools, behavioural advertising and so on are described. For your convenience, we have gathered that information in one place. Below is a list of ways to manage your privacy.

privacy settings in your web browser,
browser plug-ins that support privacy management, such as Ghostery,
additional privacy management software,
incognito mode in your web browser,
behavioural advertising settings, for example youronlinechoices.com,
notification settings in the Application,
the privacy mechanism available on the Websites

# 20: Is there anything else you should know?

As you can see, processing personal data, using cookies and managing privacy in general is a fairly complex subject. We have done our best to make this document as informative as possible on the matters that are important to you. If anything is unclear, if you want to know more or simply to talk about your privacy, write to us at [email protected].

# 21: Can this privacy policy change?

Yes. We may amend this privacy policy, in particular because of technological change and changes in the law. If we hold your electronic contact details and the change affects the rules for processing your personal data, we will notify you of the change.

All previous versions of the privacy policy are linked below.

Annex – list of third-party tools

Google Analytics

We use Google Analytics, provided by the American company Google LLC. To use it, a dedicated Google Analytics tracking code has been implemented in the code of the Websites. The tracking code uses cookies related to the Google Analytics service. You can block the Google Analytics tracking code at any time by installing the browser add-on provided by Google.

Google Analytics automatically collects information about your activity on the Websites. Within Google Analytics we have access only to anonymous information that does not allow us to identify you, such as: information about your operating system and web browser, the pages you view, session length, movement between pages, clicks on particular links, mouse movements, page scrolling, the source you came to the Website from, your age range, your gender, your approximate location limited to a town or city, and your interests or other preferences determined from online activity.

The information collected this way lets us analyse user behaviour on the Websites, keep related statistics and draw conclusions from them in order to design solutions that make the Websites work better.

If you are interested in the details of how Google uses data from sites and apps that use Google services, we encourage you to read this information.

Meta Pixel

We use the Meta advertising system provided by the American company Meta Platform Inc. In order to show you advertising personalised to your behaviour on the Websites, we have implemented the Meta Pixel, which automatically collects information about your activity on the Websites and sends it to the Meta advertising system.

Within the Meta advertising system we have access only to anonymous information that does not allow us to identify you, such as: information about your operating system and web browser, the pages you view, session length, movement between pages, clicks on particular links, mouse movements, page scrolling, the source you came to the Website from, your age range, your gender, your approximate location limited to a town or city, and your interests or other preferences determined from online activity.

The information collected this way lets us show you advertising in the Meta advertising system depending on your behaviour on the Websites, and measure the effectiveness of our campaigns so that we can draw conclusions and make them work better.

Meta Platform Inc. may combine the information collected with the Meta Pixel with other information about you gathered when you use the services it runs (including Facebook and Instagram) and use it for its own purposes, including marketing. Those activities are beyond our control, and you can find information about them directly in Meta's privacy policy. You can also manage your privacy settings from your Facebook account. Here you will find useful information on this.

LinkedIn Insight Tag

We use the advertising features available on LinkedIn, provided by LinkedIn Ireland Unlimited Company. In order to show you advertising personalised to your behaviour on the Websites, we have implemented the LinkedIn Insight Tag, which automatically collects information about your activity on the Websites and sends it to the LinkedIn advertising system.

Within the LinkedIn advertising system we have access only to anonymous information that does not allow us to identify you, such as: information about your operating system and web browser, the pages you view, session length, movement between pages, clicks on particular links, mouse movements, page scrolling, the source you came to the Website from, your age range, your gender, your approximate location limited to a town or city, and your interests or other preferences determined from online activity.

The information collected this way lets us show you advertising in the LinkedIn advertising system depending on your behaviour on the Websites, and measure the effectiveness of our campaigns so that we can draw conclusions and make them work better. LinkedIn also uses the information it collects to deliver advertising and reporting, to improve security on LinkedIn and for research and product development.

This information is also used to generate aggregated and anonymous measurements of the use of the LinkedIn advertising service, for example to calculate the total number of conversions made through LinkedIn. The details are described in LinkedIn's privacy policy.

You can manage your privacy settings on LinkedIn here.

Amplitude

We use the Amplitude analytics system, provided by the American company Amplitude, Inc. Through its integration with the Application, it automatically collects statistical information about your activity in the Application, such as button clicks. The statistical information is not accompanied by personal data. We use the information collected to make the Application as useful as possible for its users.

Freshsales

We use the Freshsales CRM system, provided by the American company Freshworks, Inc. Through a tracking script installed on the Websites, it automatically collects statistical information about your activity on the Websites, such as link clicks. The statistical information is accompanied by personal data (phone number, organisation name, first name and surname, e-mail address) and technical data such as operating system, device type and browser. We use the information collected to segment users, personalise marketing communication and improve the user experience on the Websites.

The provider of Freshsales is a processor with which we have a data processing agreement, and it does not process the information collected for its own purposes.

Annex 3 – list of sub-processors

Centuria S.A
Amazon Web Services Inc.
Sprint S.A.
Hostersi Sp. z o.o.