Privacy policy

Controller and EU representative

DS Prime is business software for delivery service providers. We are the controller for website visitor and customer account data. For driver, employee and vehicle data entered by customers, including KFZ Prime, we act as a processor on the customer’s instructions. The data processing agreement applies.

EU representative under Article 27 GDPR: details are awaiting completion by the operator.

Data processed and purposes

Necessary server logs (IP address, time and browser) provide delivery and security: Article 6(1)(f) GDPR. Optional first-party visitor statistics use a random browser identifier only with consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn in Cookie settings.

Account data includes name, email, a password hash, company name/address, role and profile picture for contract performance under Article 6(1)(b) GDPR. Optional Google sign-in provides name, email and profile picture.

Customer data includes driver contacts and personnel numbers, leave/illness status, working time and performance metrics; vehicle registrations, VIN, mileage, fuel and locations; photos, documents and payroll analyses.

Stripe Payments Europe, Ltd., Ireland processes billing and payment details under Article 6(1)(b) and (c) GDPR. Only Stripe processes card details. Contact/sales information is processed under Article 6(1)(b) or (f) GDPR. Transactional emails and change/error logs support service delivery, traceability and security.

Required information

Name, email, company name/address and billing details are necessary to enter a contract and use the service. An account cannot be created without them. Other information is voluntary or depends on the features used.

KFZ Prime and Community

KFZ Prime records driver identity, vehicle registration/VIN, photographs, mileage, condition and timestamps. The browser camera is used with permission; images upload only on submission. The employer is the controller and we are the processor.

Community is restricted to verified customer-company owners. Profiles, posts, comments, reactions and private messages are processed. Posts are visible to verified owners; messages only to participants. Users may delete their content, which is also removed on account deletion: Article 6(1)(b) GDPR.

Recipients, storage and international transfers

Database and files are stored with Supabase in Frankfurt am Main, Germany, region eu-central-1. Providers include Supabase (database, authentication, storage and functions), Lovable (hosting and transactional email), Stripe (payments), Google (optional sign-in and Gemini analyses through Lovable AI Gateway), Mapbox (maps), GeoTab (connected telematics) and Kenjo (connected HR/attendance). Integrations activate only when connected by a customer.

The operator is established in the UAE, for which the European Commission has issued no adequacy decision. Transfers use EU Standard Contractual Clauses under Article 46(2)(c) GDPR; copies are available on request. US providers use the EU-US Data Privacy Framework where certified, or Standard Contractual Clauses.

AI features

Analyses such as summaries are sent to an AI model at the user’s request. No automated decisions with legal effect under Article 22 GDPR are made.

Retention

Server logs: 30 days. Change/audit logs: contract term plus one year. Account data: contract term. Customer data: deletion 30 days after contract end under the DPA unless a retention obligation applies. Invoices/accounting records: 10 years under Section 147 AO and Section 257 HGB. Statistics are analysed anonymously.

Your rights

You have rights of access, rectification, erasure, restriction, portability and objection under Articles 15–21 GDPR, and withdrawal of consent under Article 7(3). You may complain to a supervisory authority under Article 77. Customer drivers/employees should contact their employer first.

Browser storage, service worker and app cache

Necessary browser storage includes sign-in, language and view settings. The installable PWA caches programme files through a service worker for speed and weak connections, as technically necessary under Section 25(2)(2) TDDDG. Visitor statistics identifiers require consent. No advertising or third-party trackers are used.