Aroute Privacy Policy
| Market: UK (aroute.co.uk)Version: 1.1 | Effective date: 4 November 2026
§1. Data Controller
The data controller is:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
VAT ID: PL9720811257
Email: office@emversa.com
§2. Definitions
- Aroute Platform - a web application (PWA) and iOS mobile application for maintaining vehicle mileage records.
- Organisation - a business entity that has entered into a service agreement with the Controller.
- Driver - a user assigned to an Organisation, recording trips.
- UK GDPR - the retained EU GDPR as incorporated into UK law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
- Data Protection Act 2018 - the UK Data Protection Act 2018, which supplements the UK GDPR.
- PECR - the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended.
§3. Roles in Data Processing
3.1. Controller as Data Controller
The Controller (Emversa) is the data controller within the meaning of UK GDPR with respect to:
- data of Organisation Administrators (management accounts),
- Organisation contact data,
- marketing data (newsletter, consents),
- contact form data.
3.2. Controller as Data Processor
The Controller (Emversa) acts as a data processor within the meaning of Art. 28 UK GDPR with respect to:
- Driver data processed on behalf of the Organisation,
- Driver trip and location data.
In this scope, the Organisation is the data controller for its Drivers' personal data, and Emversa processes data based on the Data Processing Agreement (DPA).
3.3. Organisation's Information Obligation
The Organisation, as the data controller for Drivers' personal data, is obligated to fulfil the information obligation towards Drivers pursuant to Art. 13 UK GDPR before they start using the Platform.
§4. Categories of Processed Data
4.1. User Account Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Email address | Identification, login, communication | Art. 6(1)(b) UK GDPR - contract performance | Duration of the account, at most until the end of the Organisation's grace period |
| First and last name | Identification | Art. 6(1)(b) UK GDPR | Duration of the account, at most until the end of the Organisation's grace period |
| Password (hashed) | Authentication | Art. 6(1)(b) UK GDPR | Duration of the account, at most until the end of the Organisation's grace period |
| Language preferences | Interface localisation | Art. 6(1)(f) UK GDPR - legitimate interest | Duration of the account, at most until the end of the Organisation's grace period |
| Working hours and days | Auto-trip configuration | Art. 6(1)(b) UK GDPR | Duration of the account, at most until the end of the Organisation's grace period |
For Organisation Administrator accounts the legal bases are set out in §5.1; for Driver accounts they are determined by the Organisation (§5.5).
4.2. Organisation Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Company name | Identification | Art. 6(1)(b) UK GDPR | Duration of subscription and grace period |
| UK VAT / Company Number | Invoicing | Art. 6(1)(c) UK GDPR - legal obligation | Until the tax liability is time-barred (as a rule 5 years from the end of the year in which the tax payment deadline passed; Polish tax law) |
| Registered address | Invoicing | Art. 6(1)(b) UK GDPR | Until the tax liability is time-barred (as a rule 5 years from the end of the year in which the tax payment deadline passed; Polish tax law) |
| Billing email | Invoice delivery | Art. 6(1)(b) UK GDPR | Duration of subscription and grace period |
| Currency | Billing | Art. 6(1)(b) UK GDPR | Duration of subscription and grace period |
4.3. Trip Data
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| GPS coordinates (start/end) | Route documentation | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Addresses (start/end) | Route documentation | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Timestamps | Trip time | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Odometer readings | Distance verification | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Distance | Mileage reporting | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Speed (max/average) | Analytics | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Trip type (business/private) | VAT classification | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
| Reimbursement amount | Cost settlement | Determined by the Organisation (§5.5) | Duration of subscription and grace period |
4.4. GPS Checkpoints
Highly confidential data: precise location
| Data | Purpose | Legal Basis | Retention Period |
|---|---|---|---|
| Latitude/longitude | Route recording | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| Altitude | Route accuracy | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| GPS accuracy (metres) | Data quality | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| Heading | Route analysis | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| Instantaneous speed | Speed monitoring | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| Address (geocoded) | Location identification | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
| Timestamp | Time accuracy | Determined by the Organisation (§5.5) | About one quarter after the trip ends |
When GPS points are collected:
- At trip start
- Every 5 minutes during active trip
- Every 250 metres of movement
- At trip end
- Backbuffer (up to 5 minutes before trip confirmation in auto-trip mode)
Note: GPS points are NOT collected in manual entry mode.
A Driver who does not confirm location recording in the app can record trips in manual entry mode (where the Organisation allows it); no GPS points are collected in that mode.
The fleet map shows current location only to the Organisation's Administrators and only for company vehicles; private vehicles are not shown on the fleet map. Current speed is shown only if the Organisation has enabled speed display.
We keep the detailed GPS route points for about one quarter after the trip ends. After that we delete them; the trip keeps only its start and end point, addresses, distance and odometer readings.
§5. Purposes and Legal Bases for Processing
5.1. Performance of the contract with the Organisation (Art. 6(1)(b) UK GDPR; for persons acting for the Organisation, Art. 6(1)(f) UK GDPR)
- Creating Organisation and Administrator accounts, managing the subscription
- Customer support
- Sending authentication and invitation emails
Where the Administrator is a party to the contract (a sole trader), the basis is Art. 6(1)(b) UK GDPR. Otherwise we process Administrators' data on the basis of our legitimate interest in performing the contract with the Organisation and communicating with its representatives (Art. 6(1)(f) UK GDPR).
5.2. Legal Obligation (Art. 6(1)(c) UK GDPR)
- Tax documentation (UK VAT, Company Number)
- Invoice data retention (until the tax liability is time-barred (Polish tax law)). Customers keep their own copies of invoices for as long as their tax law requires.
- VAT verification data retention
5.3. Legitimate Interest (Art. 6(1)(f) UK GDPR)
- Abandoned registration recovery (lead capture)
- Service improvement and analytics
- Security monitoring and fraud prevention
5.4. Consent (Art. 6(1)(a) UK GDPR, PECR compliant)
- Marketing email communication (optional checkbox)
- Analytics cookies (cookie banner)
- Contact form processing
Consent to location recording in the app is not consent given to us; see §5.5.
5.5. Driver data processed on behalf of the Organisation
For Driver, trip, location, private vehicle and reimbursement data (§3.2) we act as a processor. The Organisation, as controller, determines the purposes and legal bases of this processing and informs Drivers about them (Art. 13 UK GDPR). These may include in particular: an obligation or right under employment law in conjunction with Art. 6(1)(c) or (f) UK GDPR, the contract between the Organisation and the Driver (Art. 6(1)(b) UK GDPR), the Organisation's legitimate interest, e.g. settling vehicle costs (Art. 6(1)(f) UK GDPR), or the Driver's consent collected in the app on the Organisation's behalf (Art. 6(1)(a) UK GDPR). On the Organisation's instructions we provide: trip recording and the mileage log, vehicle and Driver management, reports and exports, reimbursement claims, the fleet map, speed analytics, gap detection and automatic trip detection (auto-trip). Drivers can contact the Organisation about this data; requests sent to us are forwarded to the Organisation.
§6. Data Processors (Sub-processors)
The Controller uses the following data processors:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Supabase | Supabase Inc. | Database hosting, authentication, RLS | USA (company); data stored in the EU (Frankfurt) |
| Stripe | Stripe Payments Europe, Ltd. | Payments and payment confirmations | Ireland (EU) |
| Vercel | Vercel Inc. | Application hosting, CDN | USA (company); application servers in Frankfurt (EU); content delivery via a global network |
| Resend | Resend, Inc. | Transactional email delivery | USA |
| Google Analytics | Google LLC | Website analytics (with consent) | USA |
| Apple Maps (MapKit) | Apple Inc. | Maps and address search in the iOS app (MapKit, CLGeocoder on the device) | USA |
| Google Maps Platform | Google LLC | Maps in the Android app (Google Maps SDK on the device) and address search (Google Places through our server) | USA |
| OpenStreetMap Nominatim | OpenStreetMap Foundation | Geocoding (coordinates → addresses) | United Kingdom |
| OpenStreetMap map tiles | OpenStreetMap Foundation | Map display (browser IP address, visible map area) | United Kingdom |
| OSRM | FOSSGIS | Route distance calculation | Europe |
| WeatherAPI | Zoomash Ltd (WeatherAPI.com) | Weather conditions during trips | United Kingdom |
| Companies House | UK Government | Company verification | UK |
§7. International Data Transfers
Some data processors may transfer data outside the United Kingdom:
| Service | Location | Transfer Mechanism |
|---|---|---|
| Supabase | USA (company); data stored in the EU (Frankfurt), support access from third countries | EU/EEA: UK adequacy regulations; US access: UK Addendum to the SCCs |
| Stripe | Ireland (EU) | Permitted under UK adequacy regulations |
| Vercel | USA (company); Frankfurt (EU) and a global content delivery network | UK Addendum to the SCCs or IDTA, and UK Extension to the Data Privacy Framework where applicable |
| Resend | USA | UK International Data Transfer Agreement (IDTA) |
| Google Analytics | USA | IDTA + UK Extension to EU-US Data Privacy Framework |
| OpenStreetMap (geocoding, map tiles), WeatherAPI (Zoomash Ltd) | United Kingdom | No restricted transfer |
| Apple Maps (iOS app) | USA | UK Addendum to the SCCs or IDTA + UK Extension to the Data Privacy Framework |
| Google Maps Platform (Android app) | USA | UK Addendum to the SCCs or IDTA + UK Extension to the Data Privacy Framework |
For every provider established in the USA we use the UK Addendum to the Standard Contractual Clauses or the International Data Transfer Agreement; where the provider is certified under the UK Extension to the EU-US Data Privacy Framework, this is an additional safeguard, and if the UK-US data bridge ceases to apply, transfers continue on the basis of the UK Addendum or IDTA. We have carried out a transfer risk assessment for each such provider. A copy of the safeguards is available from office@emversa.com.
§8. Data Retention Periods
8.1. Active Accounts
| Data Category | Retention Period |
|---|---|
| User account data | Duration of the account, at most until the end of the Organisation's grace period |
| Organisation data | Duration of subscription and grace period |
| Trip data | Duration of subscription and grace period |
| GPS route points | About one quarter after the trip ends (never longer than the trip data) |
| Vehicle data | Duration of subscription and grace period |
| Reimbursement claims | Duration of subscription and grace period |
| Invoice data (VAT, Company Number, address) | Until the tax liability is time-barred (as a rule 5 years from the end of the year in which the tax payment deadline passed; Polish tax law) |
| Marketing subscriber data | Until unsubscribe |
8.2. After Subscription End
Voluntary cancellation:
- Grace period: 90 days from end of paid period
- During grace period: All data preserved, export available
- After the grace period: the Organisation is deactivated and its data (user accounts, trips, GPS points, vehicles, claims) is permanently deleted. We keep only billing data (data on invoices issued by Emversa and payment records), for the period tax law requires. Export the data you want to keep before the grace period ends.
- The Platform is not an archive: the Organisation downloads its reports and data and keeps them in its own files for as long as the tax law that applies to it requires (Terms, 7.5 and 7.6).
Non-payment:
- Immediate access suspension
- Data preserved for 30 days
- After 30 days: the Organisation is deactivated and its data is permanently deleted as above.
8.3. Deletion of an Administrator or Organisation account (UK GDPR right to erasure)
- Personal data: Deleted
- Trip and GPS data: Deleted
- Invoice data: Retained until the tax liability is time-barred (Polish tax law). Customers keep their own copies of invoices for as long as their tax law requires.
When a Driver leaves the Organisation or is removed by it, their trips remain with the Organisation, which as controller keeps them for its tax records. Requests to erase this data should be sent to the Organisation.
8.4. Registration Leads
- Completed registrations: Converted to user account
- Abandoned registrations: 30 days, then soft delete
8.5. Contact Inquiries
- Active: Until inquiry resolution
- Resolved: Deleted after resolution
§9. Data Subject Rights
Under UK GDPR, you have the following rights:
9.1. Rights Implemented in Platform
| Right | Implementation |
|---|---|
| Right of access | Users can view all their data in the app; Excel export available |
| Right to rectification | Users can update profile; Drivers submit trip edit requests |
| Right to data portability | Excel/PDF reports and a full Organisation data export in CSV and JSON (Settings, "Your data") |
| Right to withdraw consent | Cookie settings reset; marketing unsubscribe via profile settings; location consent withdrawal |
9.2. Rights Requiring Manual Process
| Right | Process |
|---|---|
| Right to erasure | Contact: office@emversa.com; Administrator can deactivate users |
| Right to restriction of processing | Contact: office@emversa.com |
| Right to object | Contact: office@emversa.com |
9.3. Special Notes
- Invoice data: Retained until the tax liability is time-barred (Polish tax law), even after an account deletion request. Customers keep their own copies of invoices for as long as their tax law requires.
- Anonymisation: Preferred over deletion when legal retention is required
- Response time: We will respond to your request within one month
§10. Data Security
10.1. Technical Measures
- Encryption in transit: TLS/HTTPS for all communication
- Encryption at rest: Database encryption (Supabase)
- Password hashing: bcrypt via Supabase Auth
- Data isolation: Row-Level Security (RLS) at database level
- Access control: RBAC (Driver < Administrator)
10.2. Organisational Measures
- Least privilege policy: Users have access only to necessary data
- Webhook verification: Stripe and Supabase signature verification
- Rate limiting: Implemented at edge level (Vercel)
§11. Cookies
Detailed information about cookies is contained in the Cookie Policy available at: aroute.co.uk/cookies.
§12. Data Breach
12.1. Supervisory Authority Notification
In case of a personal data breach that may pose a risk to the rights and freedoms of individuals, the Controller will notify the Information Commissioner's Office (ICO) within 72 hours of breach detection.
12.2. Data Subject Notification
If the breach may pose a high risk to the rights and freedoms of individuals, the Controller will notify affected individuals without undue delay.
§13. Children's Data
- The Aroute Platform is intended exclusively for business users (B2B). Organisation account registration and the Administrator role requires being of legal age (18 years old).
- A Driver on the Platform may be a minor (16-17 years old) if they are legally employed by the Organisation and hold appropriate driving licences in accordance with applicable law.
- In the case of minor Drivers, the Organisation (as the data controller for its employees' personal data) is responsible for:
- obtaining all required consents from parents or legal guardians in accordance with labour law provisions,
- fulfilling the information obligation towards the minor and their legal guardians,
- ensuring data processing compliance with regulations concerning the employment of minors.
- Under UK GDPR, the age of consent for data processing is 13 years old. Emversa does not direct marketing services or direct communication to children under 13.
§14. Do Not Track Signals
The Platform does not respond to "Do Not Track" (DNT) signals sent by web browsers. Users may manage their tracking preferences through cookie settings available in the Platform and in the cookie policy.
§15. Automated Decision-Making
The Platform does not use automated decision-making, including profiling, as referred to in Article 22(1) and (4) of UK GDPR, which produces legal effects or similarly significantly affects users. All decisions regarding trip approvals, reimbursement claims, and similar matters are made by authorised users (Organisation Administrators), not by algorithms.
§16. Changes to Privacy Policy
- The Controller reserves the right to change this Privacy Policy.
- Users will be notified of changes by email at least 14 days before the changes take effect.
- The current version of the Privacy Policy is always available at: aroute.co.uk/privacy.
§17. Contact and Complaints
For personal data protection matters, please contact:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
Email: office@emversa.com
Supervisory Authority for the United Kingdom:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Tel: 0303 123 1113
Document generated: February 19, 2026