Privacy Policy

1. Who we are

cloudGPS ("cloudGPS", "we", "us") is a fleet telematics platform — GPS tracking, fuel monitoring, geofencing, maintenance and driver management — developed and operated by a Ukrainian–Estonian team, with production infrastructure located entirely in the European Union.

The platform operator and contracting entity is:

Oleksandr Oliinyk, sole proprietor registered in Ukraine, trading as cloudGPS.
Email: info@cloudgps.online — for all privacy matters, data subject requests and DPA signing.
Full registration details and postal address are provided on request and in signed contracts.

2. Our roles under the GDPR

cloudGPS acts in two distinct roles:

• As a processor — for fleet telematics data (vehicle positions, routes, fuel, driver identification and similar data described in section 4). Our customer — the fleet operator, dealer or partner who holds the account — is the controller of this data and decides why and how it is processed. Processing is governed by our Data Processing Agreement (DPA).
• As a controller — for account and billing data, support communications, security logs and data submitted through our websites.

Partner (white-label) portals. The platform is also offered by our partners under their own brand and domain. If you use a partner-branded portal, your contract is with the partner named in your agreement, and cloudGPS processes your data at the platform level — under the same EU-hosting and security commitments described in this policy, and under a sub-processing agreement with the partner (see the DPA, Clause 2.3). The partner may publish its own privacy notice in addition to this one and may send notifications via its own email provider.

3. Where your data is stored

• All production data — telemetry, driver, account and billing data — is stored on dedicated servers operated by Hetzner Online GmbH in Falkenstein, Germany (EU), in ISO 27001-certified data centers.
• The database runs as a replicated cluster across three nodes, all located in German data centers.
• File attachments (e.g. driver photos, invoice PDFs) and backups are stored on Hetzner storage within the EU.
• Application error monitoring (Sentry) uses the EU data region — error reports are ingested and stored in Germany.
• We do not use cloud services outside the European Union to store customer data.

4. What data we process

As a processor (fleet data, on behalf of our customers)

• Vehicle location data: GPS coordinates, speed, heading, routes, mileage, engine hours;
• Telemetry and sensor readings: ignition, fuel level, temperature, CAN-bus and other inputs from tracking devices;
• Device identifiers: IMEI, serial numbers, SIM identifiers;
• Driver identification events: iButton / RFID key IDs and the driver assignments derived from them;
• Data entered by the customer: driver names, phone numbers, photos, vehicle registration plates, geofences, notes;
• Reports and alerts generated from the above.

As a controller

• Account data: name, login, email, phone, company, language and interface preferences;
• Billing data: invoices, payment records, company requisites;
• Support communications: tickets, chat messages and related context;
• Technical and security logs: IP addresses, login history, browser/device information — kept to protect accounts and investigate abuse;
• Website enquiries: name, email, phone, company and message submitted through forms on cloudgps.online.

5. Purposes and legal bases

6. Information for drivers and employees

If your employer or contractor uses cloudGPS to monitor its vehicles, the employer is the controller of the monitoring data. It decides which vehicles are tracked, for what purposes, and for how long the data is kept. Please direct requests about your data (access, correction, erasure) to your employer first — we assist them in fulfilling such requests under the DPA.

We require our customers to inform drivers about vehicle monitoring in accordance with applicable employment and data protection law.

7. Mobile apps

cloudGPS client app (Android, iOS). The app opens the client portal and processes the same data as the portal (section 4). If you allow notifications, the app registers for push notifications with Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS). The push token of the app installation is stored with your account and used only to deliver the notifications you subscribed to.

cloudGPS Tracker (Android). The app turns a work phone into a GPS tracker of the employer's cloudGPS account. The employee installs it and connects it with a code issued by the employer's administrator. The employer is the controller of this data (section 6).

What is collected, and only while data sending is turned on:

• the phone's precise location (GPS, Wi-Fi and mobile network), including in the background when the app is closed or the screen is off; speed, heading, altitude and accuracy;
• the type of motion detected by the phone (still, walking, in a vehicle), used to save battery and to recognise stops;
• battery level and charging state, mobile signal strength and network type;
• events: data sending turned on or off, the SOS button, phone restart, location turned off in the phone settings, the app stopped by the phone's system.

When connecting, the app also sends the phone manufacturer, model and Android version, so that the administrator can help with the phone's background settings.

What is not collected: contacts, messages, call logs, photos, files or data of other apps. The camera is used only to read the connection QR code; the images are processed on the phone and are neither stored nor sent.

Control. A persistent notification is shown the whole time data sending is on. The employee can turn data sending off at any time, and no location is collected while it is off. Removing the app stops all collection.

Who receives the data. The location and the readings above are sent, encrypted, only to the employer's cloudGPS account and are visible to the users of that account. They are not used for advertising and are not sold or shared with third parties. Retention follows section 10.

Google services on the phone. Location and motion detection are provided by Google Play services on the device. QR code recognition uses Google ML Kit, which runs on the phone and sends Google technical diagnostics (device type, app version, performance metrics) that do not identify the user. The map on the main screen of the app loads map images directly from Google (section 8).

8. Sub-processors and third parties

We never sell personal data and do not share it with advertising networks. We use a small number of service providers:

Map imagery is either fetched and cached by our own EU servers (e.g. HERE) or, for Google map layers in the portal and the map in the cloudGPS Tracker app, loaded by your browser or phone directly from Google. In that case Google receives your IP address and the requested map area, but no account data or user identifiers.

The current sub-processor list for customers under a DPA is maintained in Annex III of the DPA. We give customers at least 30 days' notice before adding or replacing a sub-processor. White-label partners may configure their own SMTP server for notifications to their clients; in that case email is delivered by the provider chosen by the partner.

9. International transfers

All customer data at rest remains in the European Union (section 3). Our engineering and support team operates from the EU (Estonia) and Ukraine. Remote administrative access from Ukraine is protected by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) together with strict technical controls: multi-factor authentication, key-only SSH access, role-based access control and audit logging.

Transfers to sub-processors outside the EU/EEA (see section 8) are safeguarded by the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

10. Data retention

• Fleet telemetry and driver data — retained for the duration of the service agreement, so customers keep access to their historical routes and reports. After termination, data is deleted or returned in accordance with the DPA, no later than 90 days after termination, unless the customer requests earlier deletion.
• Account data — for the life of the account and up to 90 days after closure.
• Billing and accounting records — retained as required by applicable law (typically 3 years).
• Security and access logs — up to 12 months, unless needed longer for an ongoing investigation.

11. Security

• TLS encryption for all web, mobile and API traffic;
• EU-only infrastructure on dedicated (not shared) servers in ISO 27001-certified data centers;
• Network segmentation, firewalls and origin isolation behind dedicated load balancers;
• SSH access by cryptographic keys only; multi-factor authentication for administrative access;
• Role-based access control and per-tenant data isolation;
• Automated protection against brute-force and credential-stuffing attacks;
• Replicated three-node database cluster, regular backups and 24/7 monitoring;
• Audit logging of administrative operations and a defined incident response process.

In the event of a personal data breach we notify affected customers without undue delay and support them in meeting their obligations under Articles 33–34 GDPR.

12. Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, email info@cloudgps.online. If your data was entered into the platform by your employer (the fleet operator), we may redirect your request to them as the controller — see section 6.

You also have the right to lodge a complaint with the supervisory authority of your EU member state of residence or workplace.

13. Cookies and analytics

Marketing website (cloudgps.online)

When you first visit the site, a consent banner asks whether analytics and marketing cookies may be used. Until you accept, Google Analytics runs in denied consent mode (Google Consent Mode v2) and sets no cookies. Necessary browser storage — your language choice and form protection — works without consent, because the site cannot function without it.

You can change or withdraw your choice at any time through the Cookie settings link in the footer of any page.

Client portal (client.cloudgps.online and partner portals)

The client application uses no advertising cookies and no third-party analytics. It stores only functional data in your browser: session tokens, language and interface preferences. Error reports (Sentry, EU region) are sent only when an application error occurs.

14. Changes to this policy

We may update this policy as the service evolves. The current version with its effective date is always published at cloudgps.online/privacy/. For material changes affecting customers under a DPA, we provide notice in advance.

15. Contact

Privacy questions, data subject requests, DPA signing: info@cloudgps.online.
Postal address available on request.