Privacy Policy

This Policy explains what personal data NaviZone processes, why, on what legal grounds, who we share it with and how you can exercise your rights. It is prepared under the Law of Ukraine “On Personal Data Protection” and, for individuals in the European Union, the General Data Protection Regulation (GDPR), and forms an integral part of the Public Offer.

1. Who processes your data

Controller of the personal data of website, cabinet and app users: DB CONSULTING LLC (ТОВ «ДБ КОНСАЛТИНГ»), EDRPOU code 45916064, Ukraine, email info@navi.zone.

The app in the App Store and Google Play is published by the owner of the Platform, listed in the stores as the developer. Apple and Google send in-app purchase data to the owner, who uses it only to activate the subscription on the Platform under an agreement with DB CONSULTING LLC (ТОВ «ДБ КОНСАЛТИНГ»), EDRPOU code 45916064, Ukraine.

For Monitoring Data (coordinates, speed, sensors, Equipment identifiers, drivers’ and employees’ data) uploaded by our customer, the customer is the controller and NaviZone is the processor acting only on its instructions (Annex 1 to the Offer). If you are a driver or employee of a customer company, contact your employer about such data; we forward requests we receive to them.

2. What data we process

Website: form data (name, email, phone, company, number of vehicles, tracker model, message); technical data (IP address, browser type, language, pages, referrer and UTM tags).

Cabinet and app: email, name, phone and company name (if provided), language, time zone, settings; session identifiers, sign-in logs (IP, time, device), push notification token, device model and OS. The phone’s location is used only while the app is open, to show your position on the map, and is not stored on the server. If you sign in with Google, Apple or Diia, we receive from that service, with your consent, your account identifier, email, name and language; via Diia, your full name and taxpayer number (RNOKPP) from your electronic signature. On the first launch of the app we choose the interface language from the country of your IP address.

Equipment and objects: IMEI, SIM number, model, settings, history of coordinates, speed, events and sensors, object names, drivers’ data if entered by the customer.

Payments: plan, amount, currency, transaction status and ID, payer’s name and phone. Card data is processed by the payment provider or the App Store; we do not receive or store it.

Support: email and Telegram correspondence. Do not send passwords, card details or other sensitive data to support.

We do not collect special categories of data (health, biometrics — Face ID/Touch ID data stays on your device).

3. Purposes and legal grounds

Performance of the contract: registration and sign-in, providing the Services, notifications, reports, support, payments and invoicing. Legitimate interest: Platform security, preventing fraud and abuse, defending against claims, improving the service on anonymised data, handling requests from companies. Consent: analytics cookies, marketing emails, website form requests — consent can be withdrawn at any time without affecting earlier processing. Legal obligation: accounting and tax records, responding to lawful requests from authorities.

We do not make automated decisions with legal effects about you, do not profile you and do not sell personal data. We do not use artificial intelligence to analyse your personal data.

4. Who we share data with

We engage processors only to the extent needed for their function and under their data processing agreements:
• hosting and backups — Hetzner Online GmbH, Germany (EU);
• sign-in code and notification emails — Google (email service);
• push notifications — Apple Push Notification service, Google Firebase Cloud Messaging;
• card payments — WayForPay (Ukraine); in-app purchases — Apple App Store, Google Play;
• web analytics with your consent — Google Analytics via Google Tag Manager, Microsoft Clarity;
• sign-in — Google, Apple, Diia (SE «Diia»), only if you choose that sign-in method;
• country detection for the interface language — ipwho.is, ipapi.co (only the IP address is sent);
• support — Telegram (only if you contact us there);
• map — NaviZone’s own map server based on © OpenStreetMap contributors data.

We share contact details from a request with partner companies that connect Business customers only so they can contact you about your request. Data may be disclosed on a lawful request of a court or authority, and to a legal successor in the event of a reorganisation or transfer of the Platform, subject to this Policy.

5. Where data is stored and international transfers

The Platform’s main servers are located in Germany (EU). Some processors (Apple, Google, Microsoft, Telegram) may process data outside the EU and Ukraine. For individuals in the EU such transfers rely on European Commission adequacy decisions, including the EU–US Data Privacy Framework, or Standard Contractual Clauses (SCC). Transfers from Ukraine are made to countries ensuring adequate protection or on the basis of a contract or your consent under Article 29 of the Law of Ukraine “On Personal Data Protection”.

6. Retention

Account data — for the term of the Agreement. Location history — within your plan’s history depth. After the Agreement ends, data is deleted within 30 days, or within 72 hours on request. Accounting and payment records — up to 3 years. Website requests that did not lead to a contract — up to 12 months. Security logs — up to 12 months. Data needed to defend against claims — until the limitation period expires. Backups are overwritten in a 30-day cycle. After an account is deleted, we keep for up to 3 years only irreversible hashed fingerprints of the email and sign-in identifiers, without the data itself, to prevent abuse and repeat registrations.

7. Security

Encrypted connections (HTTPS/TLS), one-time code sign-in, sign-in attempt limits, least-privilege staff access, access logging, backups, and digital signature checks of payment notifications. Passwords are stored only as hashes. Changes to your email, password or sign-in methods are confirmed with a code sent to your email, and you receive an email notice with the option to undo the change. No system is completely secure; in the event of an incident we act under section 11.

8. Your rights

You have the right to access your data and receive a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, to withdraw consent, and other rights under Article 8 of the Law of Ukraine “On Personal Data Protection”. Send requests to info@navi.zone from your account’s email address; we reply within 30 days. We may ask you to verify your identity and may refuse manifestly unfounded or excessive requests.

You can delete your account yourself in the app or at navi.zone/account-deletion.

You may lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights and, if you are in the EU, with the supervisory authority in your country of residence.

9. Cookies and analytics

Necessary cookies (language, session, form protection) work without consent. Analytics tools (Google Analytics via Google Tag Manager and Microsoft Clarity) are enabled only after you consent in the banner; before consent Google runs in cookieless mode (Consent Mode). There are no advertising cookies. You can change your choice at any time via the “Cookie settings” link at the bottom of the website. The mobile app does not use cookies. The language preference is stored in the navi_language cookie for 180 days; choosing a language again restarts this period. The country for the initial language selection is determined locally from the IP address, without sending it to an external geolocation service.

10. Children

The service is intended for persons aged 18 and over; we do not knowingly collect children’s data. If you become aware of such data, let us know and we will delete it.

11. Personal data breaches

In the event of a personal data breach we notify the competent authority within the deadlines set by law (within 72 hours for data subject to the GDPR) and affected individuals without undue delay where the breach poses a high risk to their rights. For Monitoring Data we notify the customer as controller within 48 hours.

12. Customers’ drivers and employees

Under the Offer, companies using NaviZone must inform drivers and employees about monitoring, its purpose and duration, and have a legal basis for it. Covert monitoring of people is prohibited by the Offer. If you believe monitoring is unlawful, contact your employer or us at info@navi.zone; we will review the complaint and, where justified, restrict the customer’s access.

13. Changes and contacts

We notify you of material changes to this Policy by email or in the app at least 14 days in advance. The current version with its date is published on this page.

Data protection enquiries: DB CONSULTING LLC (ТОВ «ДБ КОНСАЛТИНГ»), EDRPOU code 45916064, Ukraine; email info@navi.zone.