This page is meant to be read before a purchase — by an IT department, a data protection officer or a legal team. It applies to Dadycar the same grid we advise applying to any vendor.
01Who is responsible for what
You are the data controller. It is your company that decides to collect data about its vehicles and drivers, for its own purposes. It therefore carries the main obligations: informing employees, consulting staff representatives, keeping a record of processing, establishing a legal basis.
Dadycar SAS is your processor. We process that data on your behalf and on your instructions, under the contract between us. We do not use it for other purposes, and we do not resell it.
02Where your data lives
The application, the database and the backups are hosted by OVH, in data centres located in France, as is the Dadycar public website.
No transfer outside the European Union. No provider accesses your data from a third country. Access to the production environment is restricted to Dadycar’s technical management and goes through a private tunnel, never the open internet.
03Our subprocessors
No vendor does everything itself. Here are the providers involved in your data, their role and their location. This list is kept up to date; any addition is notified to you.
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Application, database and backups | France |
| OVH SAS | Customer relationship management system | France |
| 1GLOBAL (formerly Truphone) | Mobile connectivity of the telematics devices | European Union |
04Vehicle tracking: the framework we apply
We follow the doctrine published by the French data protection authority, because it is the reference — and because you must be able to check it somewhere other than here.
The permitted purposes
- Tracking and invoicing a transport service for people or goods.
- Ensuring the safety of employees, goods or vehicles.
- Allocating resources better for work carried out in scattered locations.
- Tracking working time, as a secondary purpose.
- Complying with a legal or regulatory obligation.
- Checking that the rules on vehicle use are followed.
The forbidden uses
- Checking compliance with speed limits.
- Monitoring an employee permanently.
- Tracking an employee who is free to organise their own journeys.
- Tracking a staff representative in the exercise of their mandate.
- Collecting location outside working time.
- Calculating working time when another system already does it.
An employee must be able to switch off the collection of their location outside working time. Dadycar includes a private mode available from the app: manually, the driver turns it on; automatically, according to the rules agreed with the company. The employer can monitor how often it is used and act on abuse, but cannot take the function away from the driver.
SourceCNIL — Tracking of employees’ vehicles (in French)
Go furtherThe telematics and GDPR guide
05How long we keep your data
These are the periods the CNIL recommends for tracking employees' vehicles, and the platform applies them: past the deadline, the data is purged.
| Data | Period |
|---|---|
| Positions and journeys — general rule | 2 months |
| Route optimisation, proof that a job was done | 1 year |
| Data used to track working time | 5 years |
Other categories follow their own logic: accounting records and invoices are kept according to the applicable legal obligations; user accounts and their connection logs are deleted at the end of the contract, on the agreed terms.
06Security and incidents
All exchanges between your browser and the platform are encrypted in transit. Access to the production environment is restricted and goes through a private tunnel.
In the event of a data breach
The controller must notify the supervisory authority without undue delay and, where feasible, no later than seventy-two hours after becoming aware of it. Data subjects are informed when the risk to their rights and freedoms is high.
As a processor, we alert you without delay as soon as we become aware of an incident concerning you, with what you need for your notification. You keep the clock; we give you the means.
07Your rights and reversibility
Anyone whose data is processed has a right of access, rectification, erasure, objection, restriction and portability.
If you are an employee of a customer company, those rights are exercised with your employer, who is the controller. We assist them in answering within the deadlines.
For any question about personal data at Dadycar: dpo@dadycar.fr. Anyone may also lodge a complaint with the CNIL.
Reversibility and end of contract
Your data belongs to you. At the end of the contract you can obtain an export in a usable format, and we then delete it on the terms set out in the contract. A vendor that makes leaving difficult has already lost the argument.
Ask it before buying, of us as of any other vendor.