Privacy statement

1. Who we are

1.1 Zonetoegang, Tolmijden and Truckroute are products of VYS Tacho Solutions, a division and brand of VYS Scheduling BV, Poolland 24, 1768 BX Barsingerhorn, the Netherlands, Chamber of Commerce 73550027. VYS Scheduling BV is the controller for the data in this statement.

1.2 Questions about privacy and requests about your data can be sent to info@vysscheduling.nl. You can also call: +31(0)85-4013599.

2. What this statement covers

2.1 This statement covers the data we need ourselves to provide the services: your account, your company details, the payment, the acceptances and the logs for security and troubleshooting.

2.2 For the data your company itself enters into the services or has processed through them, such as the email addresses of invited colleagues, number plates and route addresses, your company is the controller and we are the processor. The data processing agreement applies to this.

3. Which data, for what purpose and for how long

3.1 Your account

Your email address (stored encrypted, together with an HMAC, a check value that cannot be reversed, which lets us look up your account), your company name, your role (administrator or user) and when you last signed in.

• Purpose: signing in and giving you access to your company's services.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Retention: up to 12 months after the last sign-in; if your company has a running subscription, for as long as it runs.

3.2 Your company details

Name, address, postcode, town, country, Chamber of Commerce number and VAT number if applicable, and a contact person with phone number (those two encrypted).

• Purpose: concluding and performing the contract, contact about the subscription and invoicing.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR); for the invoices a legal obligation (Article 6(1)(c) GDPR).
• Retention: for as long as the account exists; what appears on invoices for 7 years (tax retention obligation).

3.3 Payment details

IBAN, BIC and the name of the account holder (encrypted), and the direct debit mandate.

• Purpose: collecting the subscription each month.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR) and the tax retention obligation (Article 6(1)(c) GDPR).
• Retention: 7 years (tax retention obligation).

3.4 Acceptances

Which documents you accepted (terms and conditions, data processing agreement, privacy statement and the transition from the trial to the subscription), with the date and the version.

• Purpose: being able to demonstrate what was agreed.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in being able to demonstrate this (Article 6(1)(f) GDPR).
• Retention: for as long as the account exists, and after that together with the invoice data for up to 7 years.

3.5 Sign-in codes

You sign in with a code we send by email; there is no password. We only store the code as a check value (hash), not readable. It is valid for 10 minutes.

• Purpose: signing in securely.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Retention: 2 days.

3.6 Activity log

A click trail with the ids of the buttons you use, never the text you type and never number plates. Along with it the vehicle type, the browser, the language, and the country and town. We determine country and town with a database on our own server; we do not store your IP address for this.

• Purpose: finding and fixing faults.
• Legal basis: our legitimate interest in a properly working service (Article 6(1)(f) GDPR).
• Retention: 30 days.

3.7 Security log

Sign-in attempts, with an HMAC of the network (a check value that cannot be reversed, instead of the IP address). This log cannot be altered.

• Purpose: security and preventing misuse.
• Legal basis: our legitimate interest in security and preventing misuse (Article 6(1)(f) GDPR).
• Retention: 12 months.

3.8 Blocking in case of trial misuse

The trial is available once per company. Anyone who does not pay after the trial and creates a new account will be blocked. For this we only store an HMAC of the network, not the IP address itself. A paying company on the same network will not notice this. If you believe you have been blocked wrongly, email us and a member of staff will look into it.

• Purpose: preventing misuse of the trial.
• Legal basis: our legitimate interest in preventing misuse (Article 6(1)(f) GDPR).
• Retention: 12 months.

3.8a Web server logs

For every visit the web server keeps a log with the IP address, the time, the requested page and the browser. This is needed to secure the service and solve problems (legitimate interest, art. 6(1)(f) GDPR). The logs are kept for 14 days and then deleted automatically.

3.9 Required or not

Your email address and your company details are needed to conclude the contract. The payment details are not yet required when signing up, but they are needed to use the subscription after the trial. Without this data we cannot provide the services.

4. Number plates and routes

4.1 Number plates you enter stay in your own browser. Only when you have a route calculated with a number plate does the number plate go to our server to retrieve the vehicle data from the RDW (the Dutch vehicle authority). We do not store the number plate when doing so.

4.2 Addresses and routes you enter are processed on behalf of your company, in accordance with the data processing agreement.

5. Who receives the data

5.1 We do not sell your data and only share it with these parties, to the extent necessary:

5.2 We have agreements on security and confidentiality with every party that processes data for us.

5.3 Data only leaves the European Economic Area through Postmark, for sending email. That transfer is based on the standard contractual clauses of the European Commission.

6. Cookies

6.1 We do not show advertisements and do not use tracking cookies. We only use functional cookies that are needed for the services to work:

7. Security

7.1 We protect your data with measures including encrypted connections, encryption of email addresses, contact details and payment details in the database, access control, signing in with a code by email, a security log that cannot be altered, and backups. We work with an information security management system in line with ISO 27001; certification is in preparation.

8. Your rights

8.1 You have the right to access your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on our legitimate interest.

8.2 Email your request to info@vysscheduling.nl. We may ask you to confirm that the request comes from you, and we respond within one month.

8.3 If you do not agree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would like to hear from you first, so that we can resolve it together.

9. Changes

9.1 If we change this statement, the new version will appear on this page with a new version number and a new date. In case of an important change we will let you know by email in advance.

9.2 This statement is available in Dutch and English. In case of a difference between the two, the Dutch version prevails.