Back to Operalytix Fleet

Data processing agreement

Version 2026-10 · Effective 26 October 2026. Under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Parties and how this agreement is made

This agreement is between the business that uses Operalytix Fleet (the "Customer", acting as controller) and Evolves EOOD ("Evolves" Ltd.), trading as Operalytix, UIC 206114078, 14 Tsar Osvoboditel Blvd, floor 6, Sredets, 1000 Sofia, Bulgaria ("Evolves", acting as processor).

It forms part of the Terms of use and is accepted together with them when the company account is created. It applies to all personal data Evolves processes on the Customer's behalf in providing the Service ("Customer Personal Data"). Where it conflicts with the Terms of use, this agreement prevails for the processing of personal data. Words defined in the GDPR have the same meaning here.

2. Who decides what

  • The Customer is the controller of Customer Personal Data: the data about its drivers, dispatchers and owners recorded in its company account — shifts, breaks, location and speed during shifts, zone events, alerts, vehicle checks, photos, driver profiles, vehicle and fleet records, and the audit log. The Customer decides what is recorded and why, sets the retention period for raw location data, and is responsible for having a lawful basis, informing its workers, adopting internal rules where the law requires them, and handling data subjects' requests.
  • Evolves is an independent controller of its own data: the account data needed to run sign-in and the contract with the Customer, the server request logs, and data used to protect the Service against misuse. That data is described in the privacy policy and is not governed by this agreement.

3. Evolves's obligations as processor

In line with Article 28(3) GDPR, Evolves:

  • (a) Instructions. Processes Customer Personal Data only on the Customer's documented instructions, including about transfers to a third country. The Terms of use, this agreement and the Customer's configuration and use of the Service (for example its zones, thresholds and retention setting) are the Customer's complete instructions. If Union or Member State law requires other processing, Evolves tells the Customer first unless that law forbids it. Evolves tells the Customer if, in its opinion, an instruction infringes data protection law.
  • (b) Confidentiality. Ensures that everyone authorised to process Customer Personal Data is bound by confidentiality and has access only as far as needed for their work.
  • (c) Security. Takes the measures required by Article 32 GDPR, described in Annex II, and keeps them under review.
  • (d) Sub-processors. Engages sub-processors only as set out in section 4.
  • (e) Data subjects' rights. Helps the Customer, by appropriate technical and organisational measures, to answer data subjects' requests. Members can delete their own accounts in the Service; owners can export all data about one driver as a file (for access and portability requests) and delete the company account. Evolves passes any request it receives directly to the Customer without undue delay and does not answer it on the Customer's behalf unless instructed.
  • (f) Assistance. Helps the Customer meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Evolves. On request, Evolves provides a description of the processing suitable for the Customer's impact assessment.
  • (g) Deletion or return. At the end of the Service, deletes Customer Personal Data as described in section 7, after the Customer has had the opportunity to export it, unless Union or Member State law requires storage.
  • (h) Information and audits. Makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, as set out in section 8.

4. Sub-processors

  1. The Customer gives Evolves general written authorisation to engage sub-processors. The current sub-processors are listed in Annex III and are authorised.
  2. Evolves tells the owners by email at least 30 days before adding or replacing a sub-processor, and updates Annex III. The Customer may object on reasonable data protection grounds within those 30 days. If the parties cannot resolve the objection, the Customer may end the Terms of use by deleting its company account.
  3. Evolves imposes on each sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Customer for its sub-processors' performance.

5. Personal data breaches

Evolves notifies the Customer's owners of a personal data breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Evolves supplies further information as it becomes available, takes reasonable steps to contain the breach, and helps the Customer notify the supervisory authority and data subjects where required.

6. International transfers

The Service is hosted in a data centre in Dallas, Texas, USA (Annex III), so Customer Personal Data is transferred outside the European Economic Area. These transfers are made under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914):

  • Module 3 (processor to processor) between Evolves and the hosting provider, for Customer Personal Data;
  • Module 2 (controller to processor) between Evolves and the hosting provider, for the data Evolves controls;
  • where the Customer is established outside the EEA, Module 4 (processor to controller) is incorporated into this agreement by reference, to the extent required.

Where the Standard Contractual Clauses apply, Annexes I to III of this agreement complete their annexes, clause 9 option 2 (general authorisation, 30 days) applies, and clauses 17 and 18 select the law and courts of Bulgaria. If they conflict with this agreement, the Standard Contractual Clauses prevail. Evolves has assessed the transfer and applies the supplementary measures in Annex II, in particular encryption in transit, administrative access to the server restricted to Evolves personnel, and encryption of the backup archives, which protects every copy of a backup kept outside the server. The backup key is kept on the server only in a separately restricted folder, so backup encryption is not relied on against a compromise of the server itself.

7. Duration, return and deletion

This agreement lasts as long as Evolves processes Customer Personal Data. The Customer can export its reports at any time. When the company account is deleted (Terms of use, section 11), Evolves deletes Customer Personal Data, including stored photos and documents, immediately; encrypted backups containing it are overwritten within a further 14 days. Retention while the Service is in use is described in Annex I.

8. Audits

Evolves answers the Customer's reasonable written questions about its compliance and provides the documentation needed to demonstrate it. If that is not enough, the Customer may carry out, or mandate an independent auditor bound by confidentiality to carry out, an audit or inspection on at least 30 days' notice, during business hours, no more than once in any 12 months unless a supervisory authority requires it or a breach has occurred, and without access to other customers' data. Each party bears its own costs.

9. Liability, law and changes

Liability under this agreement is subject to the limits in the Terms of use, except where the GDPR or the Standard Contractual Clauses do not allow it to be limited. This agreement is governed by Bulgarian law and the courts of Sofia have jurisdiction. Evolves's lead supervisory authority is the Bulgarian Commission for Personal Data Protection. Evolves may update this agreement on the same notice as the Terms of use; changes required by law, or that do not reduce the protection of Customer Personal Data, may take effect sooner.

Annex I — Details of the processing

  • Controller (data exporter): the Customer; contact: its owners, at the email addresses registered in the Service.
  • Processor (data importer): Evolves EOOD, as above; contact: privacy@operalytix.com.
  • Data subjects: the Customer's drivers, dispatchers and owners; people it invites.
  • Categories of personal data:
    • identity and contact: name, email, phone, profile photo, role, language, Apple Account identifier where Sign in with Apple is used;
    • driver profile: driving licence number and expiry date;
    • shifts: clock-in and clock-out times, breaks, vehicle used, odometer and fuel readings, damage photos and notes, corrections with their author, the app-generated identifier of the phone the shift runs on, automatic end after the maximum shift length;
    • location during shifts only: position, accuracy, speed, heading, altitude, time, phone battery level;
    • derived data: distance, driving and idle time, top speed, status, zone entries and exits, speeding, idle and offline alerts, acknowledgements and notes;
    • vehicle and fleet records linked to a person: assigned driver, fuel records entered by a driver, records' authors;
    • device and security: push tokens and web push subscriptions, device type and name, app version, sign-in sessions, IP address, audit log entries (including views of a driver's location history).
  • Special categories: none are intended. The Customer must not use free-text fields or attachments for special categories of data.
  • Sensitive processing: systematic monitoring of workers' location during working time. Restricted to clocked-in time; raw positions deleted after the retention period; every view of a driver's history logged.
  • Nature and purpose: hosting, storage, computation and display of location, shift and fleet data so the Customer can organise its deliveries, see its vehicles and drivers during working time, receive and handle alerts, keep working-time and fleet records and produce reports; sending notifications and emails; backups.
  • Frequency: continuous, for as long as the Customer uses the Service.
  • Retention: raw location points: the period set by the Customer (default 90 days, 7–730 days); shift, alert, zone-event, fleet and audit records: for the term of the Service unless deleted earlier by the Customer; unattached uploads: 24 hours; sign-in sessions: up to 60 days after last use; encrypted backups: 14 days, including any off-host copy. Everything is deleted when the company account is deleted (section 7).
  • Competent supervisory authority: the Bulgarian Commission for Personal Data Protection, or the authority competent for the Customer where the Standard Contractual Clauses so require.

Annex II — Technical and organisational measures

  • Encryption in transit: all traffic between the apps, browsers and servers uses TLS (HTTPS, secure WebSockets).
  • Backups: a nightly database backup and a weekly backup of the uploaded files, as 7-Zip archives encrypted with AES-256 (file names included) and tested after writing; between the weekly archives the uploaded files are also mirrored nightly to a folder on the same server that only administrators can read. The archive passphrase is stored on the server in a separate folder that only administrators can read, never inside the archives, and a copy is kept by Evolves outside the server. Where an off-host backup location is configured, only the encrypted archives are copied there, verified by checksum and deleted after the same 14 days.
  • Passwords and sessions: passwords stored only as argon2id hashes; password reset links single-use and valid 30 minutes; access tokens valid 15 minutes; single-use rotating refresh tokens with reuse detection; tokens on iPhone kept in the Keychain; each user sees their signed-in devices and can sign them out; optional Face ID or passcode lock of the iPhone app, evaluated by iOS on the device.
  • Tenant isolation: every request is scoped to the user's own company; another company's records are treated as non-existent.
  • Least privilege: role-based permissions (owner, dispatcher, driver) within each company; drivers see only their own data; server services bound to the local machine only; administrative access to the server limited to the Evolves personnel who need it.
  • Network: host firewall admitting only the ports the Service needs; the database is not reachable from the internet; rate limiting on sign-in and invitation lookups.
  • Files: photos and documents stored outside the web root and served only through signed links that expire after 15 minutes.
  • Data minimisation: location recorded only between clock-in and clock-out, refused by the server outside shifts; automatic deletion of raw positions after the retention period; no advertising, analytics or tracking software; metadata such as the GPS position removed from uploaded images; access tokens, signed links, password reset links and invitation codes removed from web server logs; client IP addresses shortened in web server logs.
  • Accountability: audit log of sign-ins, changes, exports (including every export of a driver's data) and every view of a driver's location history.
  • Resilience: services restart automatically after a failure or reboot; documented and tested restore procedure.
  • Organisation: confidentiality obligations for everyone with access; breach response procedure with notification to customers within 48 hours.

Annex III — Sub-processors

  • CloudClusters, on the network of Psychz Networks (Dallas, Texas, USA): hosting of the servers, database, file storage and Operalytix's own mail server. All Customer Personal Data. Transfer under the Standard Contractual Clauses.
  • Apple (Apple Inc., USA, and Apple Distribution International Ltd., Ireland): push notifications to owners' and dispatchers' iPhones through APNs (push token and notification text); Sign in with Apple where members use it (Apple Account identifier); maps (Apple Maps in the iPhone app, MapKit JS in the web dashboard where enabled; map requests carry the map area, not personal data of drivers).

Not sub-processors, but recipients chosen by the user's own browser: the browser's push service (for example Apple, Google or Mozilla), which delivers end-to-end encrypted web notifications; and, when Apple maps are not used in the web dashboard, OpenFreeMap, which serves map images and receives the viewer's IP address and the map area viewed.

Data processing agreement version 2026-10 · Operalytix Fleet · Terms of use · Privacy policy · privacy@operalytix.com