Data Processing Agreement (DPA)

1. Roles

For vehicle and driver data processed on the Veturo platform, the customer — the fleet operator or employer — is the controller. Veturo (Gradac Trade Mirjana Plazinić PR, Vukašina Ignjatovića 14/2, 32000 Čačak, Serbia) is the processor and processes this data only to provide the contracted service, on the customer's documented instructions.

For enquiries through the veturo.io website and for its own business records (contracts, invoicing, support contacts), Veturo acts as an independent controller, as described in the Privacy Policy.

2. Subject matter and duration

The processing consists of operating the Veturo fleet tracking service: receiving data from the devices installed in the customer's vehicles, storing it, and presenting it on the platform as live views, history, alerts and reports. It lasts for the duration of the service agreement.

3. Data and data subjects

Categories of data: vehicle position, routes, speed, direction, ignition status and related telemetry; vehicle and device identifiers; and the name, work email and sign-in records of the platform users created by the customer.

Data subjects: drivers and other staff who use the customer's vehicles, and the customer's employees with platform accounts.

4. Customer obligations

The customer warrants that it has a lawful basis for tracking its vehicles and that drivers and other affected staff are informed before tracking begins, as required by the GDPR, local data protection law (the ZZPL in Serbia, ZVOP-2 in Slovenia) and applicable labour law. Veturo provides a ready-made employee notification template during onboarding.

Covert tracking of individuals is not a permitted use of the Veturo service.

5. Veturo's obligations

Veturo processes personal data only on documented instructions from the customer, ensures that everyone authorised to process it is bound by confidentiality, and applies appropriate technical and organisational measures, including encrypted transmission, access control and regular backups.

6. Sub-processors

Veturo uses a small number of sub-processors for hosting, backup and email infrastructure. By accepting these terms the customer gives general authorisation for their use. The current list is shared during onboarding and is available at any time at info@veturo.io. We give prior notice before adding or replacing a sub-processor, and the customer may object on reasonable grounds.

7. Data subject requests

Requests from drivers or other data subjects concerning data processed on the platform are addressed to the customer as controller. If a data subject contacts Veturo directly, we forward the request to the customer without undue delay and assist the customer in responding.

8. Data breaches

Veturo notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, and provides the information the customer needs to meet its own notification obligations.

9. Where data is stored

Platform data is processed and stored with providers in the EU/EEA. Any transfer outside the EU/EEA would take place only with the safeguards provided for in Chapter V GDPR, such as standard contractual clauses.

10. Deletion and return

When the service agreement ends, Veturo returns or deletes the customer's personal data, at the customer's choice, unless a legal obligation requires further storage. Copies in backups are removed in the regular backup rotation.

11. Audit

Veturo makes available to the customer the information necessary to demonstrate compliance with these terms and allows audits, agreed in advance and carried out at reasonable intervals without disrupting the service.

12. Governing law and contact

These terms follow the law governing the service agreement with the customer. Questions about this document: info@veturo.io.