Privacy policy

As of 6 October 2026

This English version is provided for convenience only. The German version is legally binding. In case of any discrepancy, the German version prevails. Read the German version

1. Controller

FleetFeat GmbH
Bullachstraße 30
82256 Fürstenfeldbruck
Email: info@fleetfeat.de
Data protection requests: datenschutz@fleetfeat.de

2. Hosting (Vercel)

This website is hosted by Vercel Inc. (USA). When the website is accessed, technically necessary data (IP address, time, page accessed, user agent) is processed in server logs. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation). A data processing agreement is in place with Vercel. Execution of the application is fixed to the Frankfurt am Main region; the contractual partner is Vercel Inc., based in the USA, which is why there is a transfer to a third country. Data processing is based on the EU-US Data Privacy Framework. In addition, EU standard contractual clauses are in place. For part of the processing, Vercel is a controller in its own right: for service and contact data arising from the operation of the platform, Vercel processes data for its own purposes (Vercel data processing agreement, section 4.b); Vercel's privacy policy applies to this.

3. Error and stability monitoring (Sentry)

To ensure technical operational security and for error analysis, we use the Sentry service (provider: Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). If a technical error occurs in our application, error and diagnostic data is transmitted to Sentry; personal data may also be processed in this context, in particular your IP address and technical information about your browser, device and the error that occurred. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and error-free operation). As the provider is based in the USA, personal data may be transferred to a third country (Art. 44 et seq. GDPR). Functional Software, Inc. is certified under the EU-U.S. Data Privacy Framework; to that extent, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR).

4. Quote and waiting list forms

If you request a quote or put yourself on the waiting list, we process the data you provide (fleet size, vehicle type, postcode, desired services, email, optionally telephone) to handle your request. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures). The data is stored in our database (Supabase) in the EU and is not sold to third parties.

5. Sending emails (Resend)

We send confirmation and transactional emails (e.g. bookings, invoices, statements) via the Resend service. This is necessary for performing the contracts and for communicating with customers. In the process, your email address is transmitted to Resend. The legal basis is Art. 6 (1) (b) GDPR.

6. WhatsApp contact (optional)

The customer can use the WhatsApp channel to communicate with fleetfeat. Use is voluntary. All matters can alternatively be dealt with via the quote form or the waiting list. The legal basis is Art. 6 (1) (a) GDPR (consent by actively opening the chat). The privacy notices of WhatsApp Ireland Ltd. and Meta Platforms, Inc. apply (https://www.whatsapp.com/legal/de-de/privacy-policy).

7. Cookies & audience measurement (Vercel Web Analytics)

This website uses only technically necessary cookies (e.g. for the login of platform users). No marketing tools are used. In order to understand which public pages are accessed and where visitors come from, we use Vercel Web Analytics on our public pages, a service of our hosting provider Vercel Inc. (see section 2). Vercel Web Analytics does not set cookies. When a public page is accessed, the time, the address of the page (without personal parameters; only campaign parameters such as "utm_source" are retained), the referring website, the country derived from the IP address as well as browser, operating system and device type are processed. Visits are counted using an identifier (hash) formed from the request, which is discarded after 24 hours; recognition across several days or websites does not take place. Only aggregated statistics are evaluated. If you complete a registration, the event "registration completed" is additionally transmitted with the selected role (customer or service provider) and, where applicable, the campaign parameters of the registration page, without name, email address or company name. No audience measurement takes place in the customer and partner areas of the platform. With regard to the provider, the data processing agreement and the third-country transfer, what is stated in section 2 applies, with one restriction: the restriction to the Frankfurt am Main region concerns the execution of the application, not the storage location of the statistics. Vercel stores these at a location determined by Vercel; here, too, the transfer to a third country is based on the EU-US Data Privacy Framework and the EU standard contractual clauses. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimising audience measurement of our offering).

8. AI assistant (chat function)

On our website we offer an AI-supported assistant through which you can ask questions in free text. To ensure and improve the quality of the answers, we store the chat histories: the question asked, the generated answer, the time, any feedback you may give (helpful / not helpful), the technical response time, the language model used and an anonymous session identifier. The session identifier on its own does not allow any conclusions to be drawn about your person; IP addresses or platform account data are not linked to the chat. If you yourself enter personal data in the free text (e.g. name, licence plate, address or contact details), this data is also stored and processed. We ask you not to enter any personal data in the chat. Certain patterns (email addresses, telephone numbers, vehicle licence plates, IBAN) are automatically masked before storage. For the "AI assistant" function, we use providers of AI language models. The content you enter is transmitted to the respective provider and processed there. You can find out which providers we currently use in our overview of the service providers we use. The providers process your input exclusively to generate the answer. We have configured the processing so that your input is not used to train the models. The basis for this is the data processing agreement concluded with the provider, which prohibits the provider from using the data for its own purposes, in particular for training models. In addition, the processing is configured so that it takes place in the European Union and so that input and answers are deleted after the answer has been given ("Zero Data Retention"). Some of the service providers mentioned are based in the USA. Insofar as personal data is transferred to the USA in this context, we base this transfer on the standard contractual clauses of the European Commission and, insofar as the respective provider is certified under the EU-US Data Privacy Framework, additionally on the corresponding adequacy decision. You can obtain a copy of the agreed safeguards at info@fleetfeat.de. The legal basis for the processing is Art. 6 (1) (f) GDPR (legitimate interest in improving and assuring the quality of our offering). The chat data is stored in our database (Supabase, EU) and automatically deleted after 90 days. You have the data subject rights described under "Your rights", in particular access, erasure and objection.

9. Platform accounts

For customer and service provider accounts, we process registration data (name, email, company name, role) as well as the data recorded in the course of use (e.g. vehicles, orders, documents, photo records) for the performance of the contract (Art. 6 (1) (b) GDPR). The storage location is Supabase (EU). Processing on behalf. Insofar as customer companies process data of their employees and drivers in the platform (e.g. driver assignments, driving licence records, logbook, fine assignments, photo records), they do so as controllers within the meaning of Art. 4 No. 7 GDPR; FleetFeat GmbH processes this data as a processor pursuant to Art. 28 GDPR on the basis of the data processing agreement (fleetfeat.de/avv). If you are an employee or driver of a customer company, please contact that company to exercise your data subject rights; FleetFeat GmbH supports it in doing so. The data is deleted no later than 30 days after the end of the contract with the customer company, unless statutory retention obligations prevent this.

10. Log and access data (audit log)

To ensure IT and data security, to make data access and data outflows traceable and to detect and investigate misuse, we log security-relevant access and actions within the platform in an access and activity log ("audit log"). In particular, the acting user ID, the time, the type of action (e.g. access, view, download or export of data) and the data record concerned or its scope are recorded. This also includes logging the fact that employees of a customer company access or download their own usage and vehicle data stored with us — for example in the context of a self-service access request pursuant to Art. 15 GDPR. The responsible administrator of the respective customer company can be informed of such access and can view the log. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in IT security, the traceability of data access and data outflows, the detection and investigation of misuse and the fulfilment of our accountability obligation pursuant to Art. 5 (2) GDPR. The log data is used exclusively for these purposes and is not evaluated for general monitoring of the behaviour or performance of employees. Insofar as a customer company uses such functions, any participation and co-determination rights under works constitution law (in particular pursuant to Section 87 (1) No. 6 BetrVG, German Works Constitution Act) remain its responsibility. Recipients of the log data are the authorised administrators of the respective customer company (separated by organisation) and — to the extent technically necessary — our hosting service provider (Vercel Inc., USA — see section 2) and our database service provider (Supabase, EU). The log data is stored for a period of six months and then deleted, unless it is still needed to investigate a specific security or misuse incident.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority. To do so, please contact datenschutz@fleetfeat.de. Please note: if employees of a customer company access or export their own stored data themselves via the platform, this process is logged for security and evidence reasons (see section 10). This serves to make data outflows traceable, not to monitor behaviour or performance.

12. Data protection officer

No data protection officer has been appointed, as the statutory thresholds (Section 37 (1) BDSG: more than 20 employees with automated data processing or more than 20 employees with manual data processing; Section 38 (1) BDSG: 20 employees with manual data processing) are currently not reached. The contact for data protection questions is FleetFeat GmbH at datenschutz@fleetfeat.de.

13. Maps and address resolution (Google Maps)

For displaying maps and converting addresses into coordinates, we use the Google Maps Platform (provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland). The service is used in two ways. Firstly, we resolve addresses into coordinates on our servers so that service locations, distances and service areas can be calculated. Secondly, pages with map or address fields load Google's map and address autocomplete interfaces directly in the browser of your device. In this second way, your input and your IP address go directly from your device to Google, without this data passing through our servers. The legal basis is Art. 6 (1) (b) GDPR (performance of the contract and implementation of pre-contractual measures): the map and address function is part of the booking and fleet functions and not a separately activatable additional service. Google is a controller in its own right for this processing and not our processor (Google Controller-Controller Data Protection Terms, section 4.1). A data processing agreement therefore does not exist for Google Maps and is not provided for under these terms. Google's privacy policy (policies.google.com/privacy) applies to the processing that Google carries out for its own purposes. Third-country transfer: Yes. No safeguard pursuant to Art. 46 GDPR by fleetfeat, because there is no processing on behalf: the recipient is the Irish company in the EEA, and Google itself is responsible for the further processing (Controller-Controller Data Protection Terms, sections 4.1 and 5.3). Google's privacy policy applies to it. There is no assurance towards us regarding the data location: Google processes as a controller in its own right on its own worldwide infrastructure. Information on this and on all other providers we use can be found at fleetfeat.de/dienstleister.

14. Transfer of claim data to a law firm

If a customer (fleet administrator) hands over a claim recorded in the software to a law firm cooperating with us, we transfer the data stored for this claim to the law firm selected by the customer, currently BISTER BRUNKE Rechtsanwälte PartGmbB, Rosastr. 42, 45130 Essen, Germany. The following data is transferred: the customer's company data, the name and contact details of the administrator handing over the claim, vehicle data (licence plate, vehicle identification number, vehicle type, leasing or financing status), the name and, where applicable, the telephone number of the driver, information on the other party to the accident (licence plate, name, address, insurer), the course of the accident, photos and supporting documents and, in the case of a mandate, the power of attorney signed by the customer. The transfer takes place exclusively at the express request of the customer. The legal basis is Art. 6 (1) (b) GDPR (performance of the contract with the customer or initiation of the mandate) and, with regard to the data of drivers, other parties to the accident and witnesses, Art. 6 (1) (f) GDPR (legitimate interest in asserting claims for damages). The law firm is independently responsible under data protection law for the further processing and is bound by legal professional secrecy; there is no processing on our behalf.