Privacy Policy
1. Controller
[company name d.o.o.], [address], registration no. [__] ("OptiRoute", "we").
Contact for personal-data questions: info@optiroute.si.
This policy explains which personal data we process as a controller: when you visit optiroute.si, send us an enquiry, or are a contact person of a customer.
Data that our customers enter into the OptiRoute application (e.g. drivers, bookings, delivery addresses) we process as a processor on the customer's instructions. That data is covered by the customer's own privacy notice and by the Data Processing Agreement we sign with the customer.
2. What we process and why
| When | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Demo form / e-mail / phone | name, company, e-mail, phone, message, number of vehicles | answering the enquiry, arranging a demo and trial | Art. 6(1)(b), steps before a contract; Art. 6(1)(f), legitimate interest in answering a business enquiry | 24 months after last contact, then deleted |
| Signed contract | name, position, e-mail, phone of the customer's contact persons; invoicing data | performing the contract, billing, support | Art. 6(1)(b) and (c) | until the contract ends; invoices 10 years (Slovenian VAT Act, ZDDV-1) |
| Free demo sign-up and upgrade request (Profile → Subscription & billing) | name, e-mail, company name and details, number of slots requested | creating the demo account, contacting you about a contract | Art. 6(1)(b), steps before a contract | demo account: until deleted or [6 months] of inactivity; request: 24 months after last contact |
| User account in the app | name, e-mail, role, login time | access to the app, security | Art. 6(1)(b) and (f) | until the account is deleted or the contract ends |
| Website visit | IP address, time, requested page, browser (server logs) | security and operation of the site | Art. 6(1)(f) | [14] days |
| Business updates (company contacts only) | name, e-mail, company | news about the Service | Art. 6(1)(f); you can unsubscribe at any time | until you unsubscribe |
The website uses no advertising or analytics cookies and loads no third-party fonts or scripts.
3. Who receives the data
We share data only with processors we need to operate, under a processing agreement:
- [hosting provider], servers in [EU country]: hosting the website and the application
- [e-mail provider]: e-mail
- [accounting firm]: accounting (invoicing data only)
We do not sell data or share it for advertising.
Address lookup (geocoding): [If the public server is used: addresses entered into the app are sent to the Nominatim service of the OpenStreetMap Foundation (United Kingdom, covered by an EU adequacy decision) to convert them into coordinates. Remove this paragraph once geocoding runs on our own server.]
Google Maps: if a user chooses "Open in Google Maps" in the app, the stop coordinates are opened at Google. This is the user's choice; Google's terms apply to processing at Google.
4. Transfers outside the EU
We do not intentionally transfer data outside the European Economic Area, except as stated in section 3.
5. Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. Send requests to info@optiroute.si; we reply within one month at the latest.
If you believe we process your data unlawfully, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec RS), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
6. Security
We protect data with encrypted connections (HTTPS), database-level separation of customers' data, access control and regular backups.
7. Changes
We announce material changes on this page and inform customers by e-mail.
Effective from: [date]