This clause concerns personal data that Aurea Enterprises sp. z o.o. processes as controller, in particular in connection with an account in Multiflota, contact, conclusion and performance of an agreement, customer service, settlements, security and use of the multiflota.pl website, the Multiflota system and the Multiflota mobile application. The full description is contained in the Privacy Policy.
If your data are included in data entered into Multiflota by a company or transmitted by devices in its vehicles, e.g. the location and routes of a vehicle that you drive, the controller of those data is that company, and Aurea Enterprises sp. z o.o. processes them on its behalf as a processor.
1. Data controller
The controller of your personal data is:
Aurea Enterprises sp. z o.o., ul. Plac Bankowy 2, 00-095 Warszawa, NIP: 9591956107, KRS: 0000510950, REGON: 260773108.
Contact for personal data protection matters: privacy@multiflota.pl.
We have not appointed a data protection officer - contact in data protection matters is made through the address indicated above.
2. Purposes and legal bases of processing
Account creation and handling
Account creation, authentication, management of sessions in the browser and in the mobile application, permissions and access to the company.
Legal basis: performance of an agreement or steps prior to its conclusion, Article 6(1)(b) GDPR.
Provision of the Multiflota service
Maintenance of the system, handling of functions, integrations, notifications, user settings and system communications.
Legal basis: performance of an agreement, Article 6(1)(b) GDPR.
Contact and handling of enquiries
Responding to messages, handling forms and support chat, conducting correspondence, preparing an offer.
Legal basis: our legitimate interest consisting in handling contact, Article 6(1)(f) GDPR, or steps prior to entering into an agreement, Article 6(1)(b) GDPR.
Technical support
Handling requests, diagnosing problems and communicating with the user.
Legal basis: performance of an agreement, Article 6(1)(b) GDPR, or our legitimate interest, Article 6(1)(f) GDPR.
Settlements and accounting obligations
Issuing invoices, keeping accounting records, handling payments and fulfilling tax obligations.
Legal basis: legal obligation to which the controller is subject, Article 6(1)(c) GDPR.
Security
Protecting accounts against unauthorized access, detecting abuse and bots, keeping event logs and handling incidents.
Legal basis: our legitimate interest consisting in ensuring security, Article 6(1)(f) GDPR.
Diagnostics and development of the service
Analysis of errors, including mobile application crash reports, and improvement of the stability, performance, usability and security of Multiflota.
Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
Own marketing
Informing about our services, new features and offers, insofar as permitted by law.
Legal basis: our legitimate interest, Article 6(1)(f) GDPR, and where the law requires consent - consent, Article 6(1)(a) GDPR.
Pursuit and defense of claims
Establishment, pursuit or defense against claims.
Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
3. Categories of data processed
- first name, middle name and surname,
- e-mail address and telephone number,
- companies to which you belong, and permissions granted to you in those companies,
- login data: password hash, sessions, login attempts, one-time codes in hashed form,
- account settings and consents, e.g. consent to notifications via WhatsApp,
- settlement data,
- data from contact forms, content of correspondence and support chat conversations,
- IP address and information about the browser and device,
- device name and installation identifier of the mobile application,
- mobile application crash reports, without account data,
- security event logs.
4. Data processed on behalf of the company
The company using Multiflota is the controller of data that it enters into the system or that are transmitted by devices installed in its vehicles: data on vehicles, readings from devices (including location, speed, fuel, identifiers of driver media and driving style), fuel events and reports, invoices, files, scans, calendars, content of notifications and conversations with the AI assistant.
In this respect, we process data as a processor, on the basis of a data processing agreement.
If you wish to exercise rights concerning such data, e.g. the location of a vehicle that you drive, contact that company first of all. We will help it respond to your request.
5. Recipients of data
We transfer data to suppliers who process them on our behalf to the extent necessary for the operation of a given function:
- Hetzner Online GmbH (Germany) - servers, databases and file storage,
- AfterMarket.pl (Poland) - sending e-mail messages,
- Twilio (Ireland, parent company in the USA) - sending SMS messages,
- Meta Platforms (USA) - notifications via WhatsApp,
- OpenAI (USA) - AI assistant,
- Mistral AI (France) - text recognition in scans,
- MapTiler AG (Switzerland) - maps,
- Zendesk (USA) - support chat and requests,
- Intuition Machines, hCaptcha (USA) - protection of forms and logins against bots,
- Functional Software, Sentry (data in Germany, company in the USA) - mobile application crash reports.
The detailed scope of data transferred to each supplier is described in the Privacy Policy.
Data may also be transferred to an accounting office, law firms serving the controller and to public authorities, courts and other authorized entities, if required by law.
We conclude data processing agreements with suppliers processing data on our behalf.
6. Transfers of data outside the EEA
Data are transferred outside the European Economic Area in connection with the AI assistant, support chat, protection against bots, notifications via WhatsApp and maps. This takes place exclusively with the application of mechanisms provided for in the GDPR: a decision of the European Commission finding an adequate level of protection (including for Switzerland and for companies from the USA participating in the EU-U.S. Data Privacy Framework) or standard contractual clauses.
7. Data retention period
- account data: for the period of using the service, and thereafter for the period necessary for settlements, handling claims or fulfilling legal obligations,
- settlement data: for the period required by tax and accounting regulations,
- contact data and requests: for the time of handling the matter, and thereafter for the period necessary to demonstrate its course or to defend against claims,
- logs of logins, sessions and security events: for the term of the agreement with the company,
- mobile application crash reports: up to 90 days,
- marketing data: until an objection is lodged, consent is withdrawn or the data cease to be useful,
- data processed on behalf of the company: in accordance with the agreement and the company's instructions.
8. Your rights
To the extent to which we are the controller of your data, you have the right to:
- access the data,
- receive a copy of the data,
- rectify the data,
- erase the data,
- restrict processing,
- data portability,
- object to processing based on our legitimate interest,
- withdraw consent, if processing is carried out on the basis of consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
To exercise your rights, contact us at: privacy@multiflota.pl.
We respond without undue delay, no later than within one month of receiving the request. In complex cases, the time limit may be extended in accordance with the GDPR.
9. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority competent for personal data protection matters if you consider that the processing of your data infringes the provisions of the GDPR.
In Poland, the supervisory authority is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
10. Voluntary provision of data
The provision of data is voluntary, but it may be necessary to create an account, conclude an agreement, use Multiflota, receive a response to an inquiry, obtain technical support or perform accounting obligations.
Failure to provide the required data may make it impossible to use the service or handle the matter.
11. Automated decision-making
We do not make decisions concerning anyone based solely on automated processing that would produce legal effects or similarly significantly affect that person.
Events calculated automatically from readings, e.g. refuelling events and fuel losses, and responses of the AI assistant are auxiliary information. Decisions are made by people in the company using Multiflota.
12. Contact
In matters concerning personal data, contact us:
Aurea Enterprises sp. z o.o., ul. Plac Bankowy 2, 00-095 Warsaw. E-mail: privacy@multiflota.pl.
Language
This document is available in Polish and English. The Polish version is the source text; in case of any discrepancy between the versions, the Polish version prevails. The English version is a translation provided for convenience only.