Data processing agreement
This agreement is part of the Viametry Terms for business accounts. It applies from the moment a business account is created, or an individual account is switched to a business account, and for as long as Viametry processes personal data for that account. The person who opens the business account, or switches an account to business, accepts it on the Customer's behalf; the Service records who accepted, when, and which version.
Parties
- The Customer: the company or self-employed person that holds the Viametry business account ("Customer", the controller).
- The Provider: Kairyo Services s.r.o., Za Arielem 1548/6, Michle, 140 00 Praha 4, Czech Republic, company ID (IČO) 08898359, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 326911, contact privacy@viametry.com ("Provider", the processor).
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 (the "GDPR").
"Service" means the Viametry web application at app.viametry.com and its related features as described in the Terms.
2. Subject matter and duration
2.1 The Provider processes personal data on behalf of the Customer in order to provide the Service: reading vehicle data from the Tesla accounts the Customer connects, turning it into trips, a tax logbook, charging and cost records, and fleet information, and showing that information to the people the Customer gives access to.
2.2 This agreement lasts as long as the Customer's business account exists, and after that until the data has been deleted under section 12.
2.3 The nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.
3. The Customer's instructions and the Provider's own role
3.1 The Provider processes personal data only on the Customer's documented instructions. The instructions are:
- this agreement and the Terms;
- the Customer's settings in the Service, for example which cars are connected, who has access to which car and in which role, working hours, private-use rules, route retention, whether managers see driving speed (and with it the use of Tesla's assisted driving), and whether members may connect AI assistants;
- each connection of an AI assistant that a user makes within those settings (section 7.5);
- any further written instruction the Customer gives by email to privacy@viametry.com that the Provider can carry out within the Service.
3.2 The Provider tells the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.
3.3 If Union or Member State law requires the Provider to process or disclose the Customer's personal data other than on the Customer's instructions (for example an order of a court or authority), the Provider tells the Customer before processing, unless that law prohibits it, and discloses no more than the law requires.
3.4 The Provider does not use the Customer's personal data for its own purposes: it does not sell it, does not use it for advertising, does not use it to train artificial intelligence models, and does not use it for its own product statistics. Any such use would need a change to this agreement under section 15.2.
3.5 The Provider is a separate controller, not a processor, for the data it needs to run its own business: the sign-in and security records of every user, the billing relationship with the Customer (together with Paddle, see section 7.4), the prevention of abuse of the Service, support correspondence, and records of the contract and of the acceptance of this agreement. The Viametry privacy notice describes that processing.
4. The Customer's responsibilities
4.1 The Customer is responsible for the lawfulness of the processing, in particular for:
- having a legal basis for recording and viewing data about the people who drive its cars, especially employees;
- completing the steps that labour law requires in its country before recording starts, such as the agreement of a works council, consultation of employee representatives, or advance notice to employees. The Service shows the step its country requires in the organisation settings;
- informing drivers. The Service shows every driver a notice at their first sign-in, and the Provider supplies a printable employee information notice as a template. Where the law needs each employee's own agreement (Austria without a works council), the Service asks each driver to agree or refuse, records the choice, and stores no location of that driver's trips without agreement;
- carrying out a data protection impact assessment where one is required;
- setting up the Service in line with its policies (working hours, private use, retention, roles).
4.2 The Customer is responsible for the Tesla accounts it connects. It confirms that the holder of each Tesla account has authorised the connection.
5. Confidentiality
The Provider ensures that everyone it authorises to process the personal data is bound by confidentiality, by contract or by law.
6. Security
6.1 The Provider takes the technical and organisational measures required by Article 32 GDPR. The measures in place when this agreement is concluded are described in Annex 2.
6.2 The Provider may change the measures as technology develops, as long as the level of protection does not fall.
6.3 The Provider helps the Customer meet its own security obligations by answering the Customer's questions about the measures within 5 working days.
7. Sub-processors
7.1 The Customer gives the Provider general authorisation to engage sub-processors. The sub-processors in use when this agreement is concluded are listed in Annex 3.
7.2 The Provider tells the Customer at least 30 days before adding or replacing a sub-processor, by email to the account owner and in the Service. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the subscription before the change takes effect, and the Provider refunds any prepaid fees for the period after the end.
7.3 The Provider imposes on each sub-processor the same data protection obligations as in this agreement, by contract, and remains responsible to the Customer for the sub-processor's performance.
7.4 Tesla and Paddle are not sub-processors. The Customer (through the holder of each Tesla account) instructs the Provider to retrieve data from Tesla, which processes vehicle data under its own terms with the Tesla account holder. Paddle is the merchant of record that sells the subscription and processes payment data as an independent controller.
7.5 AI assistants that a user connects to the Service (for example Claude, ChatGPT or Grok) are not sub-processors. A connection is made by the user in the assistant and on the Service's consent screen, where the user chooses the cars and whether the assistant may only read or also make changes; account owners can always connect one, other users only when the Customer allows it in its settings. On that instruction the Provider sends the assistant, when it asks, what that user may see in the Service for the chosen cars (never more, and never vehicle identification numbers, exact coordinates or raw car data), and carries out the changes the user allowed through the same permission checks as in the Service. Logbook sign-off, locking trips, and approving or paying out expenses are never available to an assistant. Each request is recorded in the account's history, and the user or the Customer can withdraw a connection at any time. The assistant's provider receives the data under its own terms with the user or the Customer. The Customer remains responsible, as in section 4.1, for the legal basis and any labour-law steps where its employees' data is concerned, and is advised to use plans of the assistant providers that do not use the data to train models.
8. Help with data subjects' rights
8.1 The Service gives the Customer tools to respond to requests from data subjects: viewing and exporting data (including each person's own data export), correcting trip details, marking trips as private (which deletes their route and places), removing people from the account (which ends their access to the account's cars), and deleting the account.
8.2 Where these tools are not enough, the Customer can ask the Provider at privacy@viametry.com. The Provider answers within 5 working days, or within 2 working days when the Customer marks the request urgent because of a deadline running against it, and carries out what the Customer decides.
8.3 If a data subject contacts the Provider directly about data the Provider processes for the Customer, the Provider forwards the request to the Customer within 3 working days, tells the data subject it was forwarded, and does not answer it itself unless the Customer instructs it to.
9. Personal data breaches
9.1 The Provider notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data.
9.2 The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Information that is not yet available is provided as soon as it is.
9.3 The Provider helps the Customer meet its own obligations to notify the supervisory authority and the data subjects.
10. Impact assessments and prior consultation
The Provider gives the Customer the information it reasonably needs for a data protection impact assessment and for any prior consultation with a supervisory authority, including a description of how the Service processes vehicle and location data, within 10 working days of a request.
11. Information and audits
11.1 The Provider makes available the information needed to demonstrate compliance with Article 28 GDPR, first by answering written questions and providing documentation.
11.2 If that is not enough, the Customer may carry out an audit, itself or through an auditor bound by confidentiality, normally once a year, with 30 days' notice, during business hours. Further audits, and shorter notice, are possible when a supervisory authority requires it, after a personal data breach, or when the Customer has a substantiated concern that this agreement is not being kept.
11.3 Each party bears its own costs of an audit. The Customer pays the Provider's reasonable costs only for audits beyond one a year that find no material breach. An audit never gives access to other customers' data.
12. End of the service: return and deletion
12.1 At any time the Customer can export its data from the Service (the tax logbook, the reports and the account data export).
12.2 When the subscription ends, the account becomes export-only: nothing new is recorded, and the Customer can still sign in and download its records. On the Customer's instruction in the Terms, the Provider keeps the data until the end of the calendar year after the year the subscription ended, so that the records of the last tax year remain retrievable, and then deletes it.
12.3 The Customer can instead choose deletion at any time: by deleting the account in the Service (deletion follows after 14 days in which it can be cancelled, or at once if the Customer chooses so), or by writing to privacy@viametry.com. The Provider confirms the deletion when it is done.
12.4 Copies in backups expire as the backups roll over, within 40 days. If a backup ever has to be restored, deletions made after the backup was taken are carried out again before the restored data is used.
12.5 The Provider keeps only what the law requires it to keep for its own purposes (for example records of the contract, invoices handled by Paddle, and the record of the Customer's acceptance of this agreement), and only for as long as required.
13. Where the data is processed
13.1 The Provider stores and processes the personal data in the European Union, on servers in Germany (Annex 3).
13.2 The Provider does not transfer personal data outside the European Economic Area. If a transfer becomes necessary, the Provider will tell the Customer in advance under section 7.2 and will use an appropriate safeguard under Chapter V GDPR, such as the European Commission's standard contractual clauses.
13.3 Web push notifications reach a user's device through the push service of that user's browser (Apple, Google, Mozilla or Microsoft), which the user's own browser chooses and which may be outside the EEA. The content of each notification is end-to-end encrypted; these services see only a delivery address and the time. They are not sub-processors.
13.4 Data that a connected AI assistant receives (section 7.5) may be processed by the assistant's provider outside the EEA, including in the United States. It is disclosed there on the instruction of the Customer, or of the user the Customer allowed to connect the assistant, to a recipient they chose; it is not a transfer by the Provider under section 13.2.
14. Liability
Liability under this agreement follows the limitations in the Terms. This does not limit either party's liability to data subjects under Article 82 GDPR, or liability that cannot be limited by law.
15. Precedence, changes and law
15.1 If this agreement and the Terms conflict on a data protection matter, this agreement prevails.
15.2 The Provider may update this agreement to reflect changes in law or in the Service. It tells the Customer at least 30 days in advance, by email to the account owner and in the Service; changes that reduce the protection of personal data need the Customer's agreement.
15.3 This agreement is governed by the law of the Czech Republic. The courts of the Czech Republic competent for the Provider's registered office decide disputes, unless mandatory law provides otherwise.
Annex 1: Description of the processing
Data subjects
- People the Customer adds to its account: owners, managers, drivers and viewers, usually its employees or contractors.
- People who drive the Customer's cars.
- People whose addresses the Customer saves as places (for example customers or suppliers visited on business trips).
Categories of personal data
| Category | Examples |
|---|---|
| Account and sign-in data | Name, email address, role, password (stored only as a hash), sign-in records with IP address and browser, sessions |
| Vehicle data from Tesla | Vehicle identification number, model and configuration, odometer, battery and charging state, energy use, software version, tyre pressure, lock state, location and speed while driving, and, for cars where the Customer switches it on, the distance driven with Tesla's assisted driving (FSD Supervised) |
| Trips and logbook | Start and end time, start and end place, route (GPS points), distance, energy, driver, business or private, purpose, notes |
| Driver and privacy set-up | Which driver uses which car and when, working hours, private-mode periods, notices acknowledged and recording agreements given or withdrawn |
| Charging and costs | Charging sessions with place, energy and cost; expenses and reimbursement requests with amounts |
| Saved places | Name and position of places such as home, office or customer sites |
| Records of actions | Audit log of sensitive actions (who changed access, connected a car, exported data) |
| Notifications | Push notification subscriptions per device and notification preferences |
| Feedback and support | Bug reports and feedback with screenshots, and support emails |
No special categories of personal data (Article 9 GDPR) are intended. Location history can nevertheless reveal sensitive information (for example visits to a doctor), which is why drivers have a private mode (Annex 2).
Purposes
Providing the Service to the Customer: a dashboard of the Customer's cars, the tax logbook, charging and cost records, fleet management and reports, notifications, support, and the security of the Service.
Processing operations
Collection from Tesla (Fleet API and the car's telemetry stream), storage, derivation of trips and statistics, naming of places from saved places and a place list kept on the Provider's own server, display to authorised people, disclosure to AI assistants that users connect (section 7.5), export, and deletion.
Retention while the account is active
| Data | Retention |
|---|---|
| Route and GPS points of employee-driven trips | Deleted automatically after the Service's limit for employees: 90 days by default, 60 days in France, 7 days in Portugal, or sooner if the Customer sets a shorter period. These are product limits that follow national guidance, not a legal safe harbour; the Customer sets a shorter period where its purpose requires |
| Route and GPS points of other trips | Deleted automatically after 2 years, or sooner if the Customer sets a shorter period for the car; the start, end and summary of each drive stay |
| Location during private periods | Dropped when the car's raw data is processed, at most about a day after the drive, and never written to the database (private mode, outside working hours where set or required, and in Austria without the driver's agreement). A trip marked private afterwards loses its route and places at that moment |
| The telemetry receiver's raw log | Emptied every night, so at most about a day |
| Logbook records | While the account exists; the Customer exports them for its own legal retention period |
| Audit log | 730 days, deleted automatically |
| Error logs | 90 days, resolved error groups 180 days, deleted automatically |
| Feedback screenshots | Deleted when the report is closed, and after 90 days at the latest |
| Everything else | While the account exists, then section 12 |
Annex 2: Technical and organisational measures
Hosting and infrastructure
- Production runs on a dedicated server at Hetzner in Germany, separate from development. A network firewall admits only web traffic, the car telemetry connection and administrative SSH.
- Administrative access only with SSH keys, no passwords; security updates install automatically. The Service refuses to start without its own session secret.
Encryption
- All connections use HTTPS (TLS), with HTTP Strict Transport Security. The cars connect to the telemetry receiver over mutually authenticated TLS.
- Tesla access tokens are stored encrypted (AES-256-GCM). Passwords are stored only as salted scrypt hashes.
- Off-site backups are encrypted before they leave the server.
Access control and separation
- Every person has a role (owner, manager, driver, viewer), and access is granted per car. Every page and export checks both. Removing a person from the account ends their access to its cars at once.
- Each customer's data is separated by account. By design, the platform administrator has no access to customers' cars in the application. Infrastructure access (server, database, backups) is limited to the Provider's managing director, used only for operation, support the Customer asks for, and incidents.
- Sign-in attempts are rate-limited, sessions can be revoked, invitation and reset links are single-use and time-limited, and identifiers visible in the browser are random.
- Sensitive actions are written to an audit log.
- Notifications go only to active users, and only through the browsers' own push services.
Privacy by design for employees
- Drivers can switch on private mode: while it is on, no location is written to the database, only distance, time, energy and cost (the receiver's raw log, emptied every night, holds it until then). A trip marked private afterwards loses its route and places. Charging during private time shows its place only to the driver.
- Working-hours protection: outside the Customer's working hours, no location is stored for employee drivers, nor for a car with no driver assigned; in Austria, France and Spain this cannot be switched off.
- In Austria without a works council, a driver's locations are stored only after the driver agreed in the Service, and no longer after a withdrawal.
- Managers do not see a driver's speed by default; in France, Portugal, Switzerland and Estonia they cannot see it at all.
- Route traces are deleted automatically every day after the period in Annex 1.
- Every driver sees an information notice at first sign-in.
- Place names are looked up in a list on the Provider's own server; no location is sent to a map or address service.
Availability and resilience
- The database is backed up every night; copies are kept for 3 days on the server and in an encrypted off-site store (a Hetzner Storage Box in Germany) for 30 days, with the store's own snapshots for at most 10 more; backups therefore expire within 40 days. Restoring from backup has been tested.
- Disk space, errors and background jobs are monitored, with alerts to the administrators.
Organisation
- Access to production systems is limited to the Provider's managing director and bound by confidentiality.
- No analytics or advertising trackers run in the Service.
Annex 3: Sub-processors
| Sub-processor | Address | What it does | Since |
|---|---|---|---|
| Hetzner Online GmbH | Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the Service and database (Nuremberg data centre) and encrypted backups (Falkenstein) | September 2026 |
| WEDOS Internet, a.s. | Masarykova 1230, 373 41 Hluboká nad Vltavou, Czech Republic | Email mailboxes for support and privacy correspondence; domain name service | September 2026 |
| Sendinblue SAS (Brevo) | 106 boulevard Haussmann, 75008 Paris, France | Sending service emails: invitations, password resets, alerts, monthly summaries | October 2026 |
Services that are not sub-processors: Tesla (source of the vehicle data, see section 7.4), Paddle (merchant of record, see section 7.4), the browsers' push services (see section 13.3), the Czech National Bank and the European Commission (exchange rates and fuel prices; no personal data is sent), and GeoNames (a place list downloaded to the Provider's server; no data is sent). Maps are served from the Provider's own server.