Data processing agreement for Leopol Fleet

Versie 2026-10-30 / Version 2026-10-30

TrapSpotter BV · Trekschurenstraat 245, 3500 Hasselt, Belgium · enterprise number 1031.603.017 (RLE Antwerp, Hasselt division) · VAT BE1031603017 · privacy@trapspotter.com

This data processing agreement is the contract referred to in Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR). It forms part of the business terms for Leopol Fleet and applies between the business that uses the console (the customer), as controller, and TrapSpotter BV (Leopol), as processor. Terms used in this agreement have the meaning given to them in the GDPR.

1Subject matter

1.1 Leopol processes personal data for the customer in order to provide the console and the features of Fleet. Annex 1 describes, for each feature, the subject matter, the nature, the purpose, the data subjects, the data and the retention period.

1.2 As regards the processing of personal data, this agreement prevails over the business terms.

2Roles

2.1 The customer is the controller for the data in Annex 1. It determines the purposes, has a legal basis for each processing operation (for data about traffic offences, also a basis permitted under Article 10 GDPR; see Annex 4), informs the data subjects and responds to their requests. It also determines, with the means that the service provides, how breaks, private time and time outside work are kept out of the recording (business terms, clause 9.3), and takes the measures that the GDPR requires of a controller for this (Articles 24 and 25 GDPR).

2.2 Leopol is the processor of that data.

2.3 Leopol is itself the controller, outside this agreement, for: each user's own Leopol account and their use of the app outside the features in Annex 1 (such as alerts, navigation, reports and Leopol Pro), the contract and billing data of the customer and its contact persons, the security of the service and the prevention of misuse, and statistics that identify no one. Leopol's privacy policy describes that processing.

3Instructions

3.1 Leopol processes the data only on documented instructions from the customer, including with regard to transfers to a third country. The instructions are: this agreement, the business terms, and what the customer and its managers set or do in the console. The customer gives other instructions in writing.

3.2 If Union or Member State law requires Leopol to process data without an instruction, Leopol informs the customer of this in advance, unless that law prohibits such notification.

3.3 If, in Leopol's opinion, an instruction infringes the GDPR or other data protection rules, Leopol informs the customer immediately. It then need not carry out the instruction until the customer confirms or amends it.

4Confidentiality

4.1 Only Leopol staff and subcontractors who need the data for their tasks have access to it, and they are bound by confidentiality.

4.2 Leopol's admin console shows staff no trips, routes, addresses or positions, and cannot open a customer's console. Only the system administrators have technical access to the database, for maintenance, security and fixing errors. For support, Leopol looks at a customer's data only if the customer asks, and only at what is needed for that purpose.

5Security

Leopol takes the technical and organisational measures in Annex 2 (Article 32 GDPR) and maintains them. It may adapt them, provided that the level of protection does not decrease.

6Sub-processors

6.1 The customer gives Leopol general authorisation to engage the sub-processors in Annex 3.

6.2 Leopol gives notice of a new or replacement sub-processor at least 30 days in advance, by email to the company's owner in the console. The customer may object, stating reasons, within that period. If the parties cannot find a solution, the customer may terminate the agreement before the sub-processor starts; anything it paid in advance for the period after that is refunded.

6.3 Leopol imposes on each sub-processor, by contract, data protection obligations that correspond to this agreement (Article 28(4) GDPR), and remains fully liable to the customer for the performance of those obligations.

7Transfers outside the European Economic Area

7.1 The service's database and files are located in the European Union (Stockholm, Sweden), and Leopol's own servers in Germany and Finland (Annex 3, item 2). Some sub-processors process data in or from a country outside the European Economic Area (EEA); Annex 3 states which ones and where.

7.2 Such a transfer takes place only with a safeguard under Chapter V of the GDPR: an adequacy decision of the European Commission (for the United States: the EU–US Data Privacy Framework, for companies certified under it) or the European Commission's standard contractual clauses. Annex 3 states the safeguard for each sub-processor.

7.3 If the customer is established outside the European Economic Area, the transfer of personal data by Leopol to the customer (in the console, in exports and by email) is governed by the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Four: transfer processor to controller (Article 46(2)(c) GDPR). The parties enter into them by accepting the business terms; they form part of this agreement, completed as follows:

• Leopol is the data exporter, as processor; the customer is the data importer, as controller;
• Clause 7 (docking clause) and the option in Clause 11(a) (an independent dispute resolution body) are not selected;
• Clause 17: the Clauses are governed by Belgian law; Clause 18: disputes are resolved by the courts of Belgium;
• Annex I.A: the parties as in the business terms and in the console, with privacy@trapspotter.com as Leopol's contact point and the owner in the console as the customer's; acceptance in the console counts as signature and date;
• Annex I.B: the data subjects, the data, the nature and the purposes in Annex 1; sensitive data: fine data (Article 10 GDPR), with the restrictions in Annex 1, item 8, and Annex 2; the transfer is continuous, for as long as the customer uses the service; retention at Leopol as in Annex 1 and clause 11, at the customer as it determines as controller.

In the event of a contradiction, the standard contractual clauses prevail (Clause 5). If an adequacy decision of the European Commission covers the customer's country (Article 45 GDPR), the transfer also rests on that decision.

8Assistance

8.1 Data subject requests. In the console, the customer can view, export and correct the data, delete vehicles and documents, and take members and clients out of use. What the customer cannot do itself, such as erasing trips, Leopol carries out at the customer's written request within ten working days.

8.2 If Leopol itself receives a request from a data subject concerning the customer's data, it forwards the request to the customer within five working days and does not respond on the substance, unless the customer asks it to.

8.3 Leopol assists the customer with security, the data protection impact assessment (DPIA) and any prior consultation of the supervisory authority, with the information available to it, including these annexes and the DPIA template for Belgium, the Netherlands, Luxembourg, France and Germany.

8.4 This assistance is free of charge, except for requests that are manifestly unfounded or excessive; in that case, Leopol may, with the customer's agreement, charge a reasonable fee.

9Personal data breaches

9.1 Leopol notifies a personal data breach involving the customer's data without undue delay and at the latest within 48 hours after becoming aware of it, by email to the company's owner and managers, or to the address the customer provides for that purpose.

9.2 The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and of data records, the likely consequences, the measures taken and proposed, and a contact person. Anything not yet known follows as soon as it is known.

9.3 The customer decides on notifying the supervisory authority and the data subjects (Articles 33 and 34 GDPR); Leopol assists it with this and documents the breach.

10Information and audits

10.1 Leopol makes available to the customer the information needed to demonstrate that it complies with this agreement: among other things, this agreement with its annexes, a description of the measures and the list of sub-processors.

10.2 If that information is not sufficient, the customer may, at its own expense, have an audit carried out by an independent auditor who is bound by confidentiality. An audit takes place at most once a year (except after a breach or at the request of a supervisory authority), on the basis of a written plan provided at least 30 days in advance, during office hours, and without access to other customers' data. For sub-processors, their own audit reports and certifications apply.

11Retention and end

11.1 During the agreement, the retention periods in Annex 1 apply. The customer may at any time ask in writing for data to be erased earlier; Leopol does so within ten working days.

11.2 After the end of the subscription, the customer can still export its data in the console for 30 days. After that, Leopol erases all data in Annex 1 within 30 days, unless Union or Member State law requires storage. Erased data disappears from the backups when they expire, within 30 days at most, and from the monthly copy of the stored files (Annex 2) within 35 days at most.

11.3 On request, Leopol confirms the deletion in writing.

11.4 If the customer has never had a subscription or a pilot and has never paid, Leopol erases all data in Annex 1 once neither an owner nor a manager has opened the console for 90 days, and at the earliest 30 days after it told the owner so by email (business terms, clause 17.4), unless Union or Member State law requires storage. Erased data disappears from the backups as in clause 11.2.

12Liability

As regards data subjects, Article 82 GDPR applies. Between the parties, the liability provisions of the business terms apply, except to the extent that the law prohibits this.

13Term, governing law and jurisdiction

This agreement applies for as long as Leopol processes personal data for the customer. This agreement is governed by Belgian law; disputes are submitted to the courts designated in the business terms.

14Anonymous traffic statistics

14.1 The customer hereby gives Leopol the documented instruction (Article 28(3)(a) GDPR) to anonymise the speed in its drivers' live positions into traffic statistics, as set out in this clause. The customer assesses whether this further processing is compatible with the purpose for which it collects the data (Article 6(4) GDPR).

14.2 To that end, Leopol keeps a sample of a live position with a speed: the week and the hour (in UTC), the position rounded to about 11 metres, the speed in whole km/h, the heading to 10 degrees, and a code for the driver computed with that week's secret key (salt). A sample contains no company, name, vehicle, trip or exact time; only speeds from 5 to 200 km/h, at most 60 per person and hour. The sample is pseudonymised (Article 4(5) GDPR) and remains personal data until it is erased together with that week's key: 9 days after the end of the week, so at most about 16 days after the measurement. Until then, Leopol processes the samples into statistics on its own server in Helsinki (Annex 3, item 2).

14.3 A statistic covers one road segment and one week (for example the median and the 95th percentile of the speeds and the share exceeding the limit by more than 10 km/h) and contains no company, driver, vehicle, device, trip or exact position. Samples count only on road segments where Leopol's own drive data also lie that week: one per person, segment and hour, and at most three per person, segment and week. A statistic is kept only if, all sources together, it rests on at least 20 different people and 50 trips and Fleet's samples make up at most half of those people and trips; a figure for the rush hours or outside them only if that part itself counts at least 50 trips. Statistics made in this way are anonymous (Recital 26 GDPR; Article 29 Working Party, Opinion 05/2014 on anonymisation techniques) and therefore no longer personal data. Leopol uses them as its own data, only itself, for its own traffic and driving statistics: it does not pass them on, share them or sell them. It never tries to link them back to a person, a vehicle or a company.

14.4 The customer can withdraw this instruction by email to privacy@trapspotter.com; Leopol carries this out within ten working days and then also erases its drivers' samples still kept. Statistics already made remain: they identify no one.

Annex 1. Description of the processing

Nature of the processing. Collecting via the app and the console, storing, organising, displaying, calculating (hours, kilometres, allowances), exporting, sending (email, push notifications) and erasing.

Data subjects. The customer's owners and managers; drivers (employees and other workers whom the customer invites); invited persons; contact persons of the customer's clients.

Duration. For as long as the agreement runs, and thereafter the period in clause 11.

Working mode. The data in items 12 to 14 is recorded only in the time clock mode (business terms, clause 3.6). In the no-tracking mode, no workdays, trips or positions are recorded (items 2 to 4). In the trips mode, a break is kept out of the recording by stopping the workday: between "Stop workday" and the next "Start workday", nothing is recorded (business terms, clauses 3.2 and 9.3).

Per feature:

1. Members and invitations. Data: first name, surname, email address, phone number, job title, employee number, notes, role, status, seat, whether an owner or manager also has their own work trips recorded, dates of invitation, acceptance and departure. Purpose: managing access and seats. Retention: for as long as the member exists; a member who has left or been removed is kept for as long as work data is linked to them, at the latest until the end of the agreement. An invitation is valid for 7 days and, once it has been used, revoked or has expired, is erased at the latest 90 days after it was sent.

2. Workdays. Data: start and end, the reason for the end (stopped by the driver, automatic stop, end of the work hours, end of the subscription, the driver's departure, a change of working mode), the vehicle or the driver's own car, the work hours the customer sets, for the company or per driver, and, in the time clock mode, whether the workday needs review (for example stopped automatically or site unknown). Purpose: working time and kilometres per workday, and limiting recording to the work hours. Retention: until the end of the agreement, unless the customer asks for erasure earlier.

3. Trips. Data: start and end time, start and end position with address, the route taken (simplified), the distance, the client, the vehicle or the driver's own car, a note, and whether the trip is private. For a private trip, only the time and the distance remain in the customer's data: the places, the route and the client are permanently erased from the trip, and the database does not accept a private trip with such data. The places and the route are kept apart for the driver alone, who sees them in the app: Leopol keeps them for the driver as a controller in its own right, not as the customer's processor, and never makes them available to the customer, its managers, the console, an export or a report. They are erased 60 days after the trip, when the driver leaves the company or is removed from it, when the driver deletes them or their account, and with the company. Purpose: proving trips and visits, calculating kilometres and allowances. Retention: the route taken and the exact start and end positions are erased 60 days after the trip; in every country except Belgium, the Netherlands and Germany the start and end addresses too. The rest (times, distance, client, vehicle, note and, elsewhere, the addresses) as for workdays.

4. Live positions (only if the customer switches them on). Data: position, direction of travel and speed according to the phone, and the time (the speed only in Belgium and the Netherlands and in the countries where the console shows it); at most once a minute, only during a workday, never during a private trip and, in the time clock mode, never during a break. The console shows the speed only in a country whose law allows an employer to see it (business terms 3.2 and 9.3); elsewhere it shows the position, not the speed. Purpose: knowing who is where during work (planning, assistance). Retention: erased after 30 minutes, at the end of the workday, when the driver leaves the company, and immediately for all drivers when the customer switches live positions off. From a position with a speed, Leopol may keep a pseudonymised sample, which exists for at most about 16 days and then goes into anonymous traffic statistics (clause 14).

5. Clients and addresses. Data subjects: the customer's clients and their contact persons. Data: name, address, position, label, contact person, phone number, note. Purpose: showing addresses in the app, where the drivers find them when they search, and linking trips to visits. Retention: until the end of the agreement, unless the customer asks for erasure earlier.

6. Vehicles and documents. Data: number plate, make, model, year of manufacture, fuel, odometer reading, assigned driver and the assignments over time (who had the vehicle when), and for equipment also its own number, type, category, serial number and supplier; type of document (such as registration certificate, insurance, inspection, green card or lease contract), reference, expiry date, and a scan or photo of the document. The scans are kept in private storage: only the owner and the managers, and the driver the vehicle is assigned to or who drives it for a workday, can see them, via links that are valid for five minutes. An email to the owner and the managers 30 days and 7 days before a document expires. Purpose: managing the fleet and its papers, and knowing who a vehicle is assigned to and who drove it. Retention: until the customer deletes them, at the latest until the end of the agreement.

7. Receipts. Data: date, type, merchant, amount, VAT, litres, photo, status, who decided and when. The photos are kept in private storage: only the driver who submitted them and the owner and managers can see them, via links that are valid for five minutes. Purpose: reimbursing expenses. Retention: until the end of the agreement, unless the customer asks for erasure earlier. The customer itself keeps what it must keep for its accounting.

8. Fines (through "Who was driving?"; only the owner and the managers). Data subjects: drivers. Data: number plate, date, time and place of the offence, the authority's reference, the date of the letter, deadline, status, the driver with whom the customer registers the fine and the trip found, the question to the driver and their answer, notes. This is data relating to criminal offences within the meaning of Article 10 GDPR. Purpose: establishing who was driving and, where the law requires it, designating the driver within the deadline (Annex 4). Retention: automatically erased after the period of the customer's country: in Belgium, 24 months after the offence; in France and Luxembourg, 45 days after the date of the letter (without that date, 90 days after the offence); in the Netherlands, Germany and every other country, 30 days after the customer closes the fine, and otherwise at the latest 24 months after the offence. The customer can erase fines earlier, and does so where the law applicable to it or its supervisory authority requires this (Annex 4).

9. Mileage statement. Calculated from the workdays and trips when the customer requests it: business kilometres in the driver's own car and in a company vehicle, the number of private trips (without places), workdays, hours and the allowance; per client: visits, kilometres and time on site. Purpose: preparing the mileage allowance and invoicing to clients. Retention: not stored separately.

10. Audit log. Data: who did what in the console and when (for example, a member invited or removed, a setting changed). Purpose: security and accountability. Retention: until the end of the agreement.

11. Emails and push notifications. Data: name, email address and company name in invitations; to drivers, a push notification when there is a question about a fine or when the server has ended a workday; to owners and managers, reminders about documents and fine deadlines. Purpose: the features above. Retention: the providers keep delivery logs in accordance with Annex 3.

12. Time clock (only in the time clock mode). Data: for each task, break or departure, the start and the end, the site or address (for a departure also the destination), the activity, the work type and the subtype, the equipment used, a note, and the position at the start of the task, rounded to about 100 metres; for a break only the start and the end, without a place, equipment or position; for a correction or addition by a manager: who, when, the reason and the original record. The position at clock-in serves only to suggest the nearest site and is not kept. Purpose: recording and reviewing working time per task, site and item of equipment, calculating the hours and allocating costs per site. Retention: as for workdays; the position at the start of a task is erased 60 days after the task, and earlier when a former member is erased.

13. Last place of equipment (only in the time clock mode). Data: one point per item of equipment: the position, rounded to about 10 metres, the time, the site, and who used it. Updated when a task with that item ends and, while that task runs, with the phone's position, at most every 45 seconds, also when live positions are off; never during a break and never outside the workday or the work hours. Each new place overwrites the previous one: there is no history. Purpose: knowing where equipment is. Retention: until the item is deleted, at the latest until the end of the agreement; who used it is erased 60 days after the time, and earlier when that person is erased as a former member.

14. Hours exports (only in the time clock mode). Calculated from the workdays and the time clock when the customer requests them: per driver and per day (in, out, break, time worked, sites), per cost centre (site, activity, work type, subtype and note), per item of equipment and per site. Purpose: preparing payroll, invoicing to clients and costs per site. Retention: not stored separately.

Annex 2. Technical and organisational measures

• Hosting in the EU. Database, file storage and server functions at Supabase in the AWS region eu-north-1 (Stockholm, Sweden); own servers at Hetzner in Falkenstein (Germany) and Helsinki (Finland).
• Encryption. TLS in transit; encryption of stored data by the hosting provider.
• Access through controlled functions. Apps and browsers have no direct access to the tables (row level security on every table, with no privileges for users). On every call, each function checks who the user is, which company they belong to and which role they have, and whether the company is active.
• Roles. Owner, manager and driver. A driver sees only their own data. Fines are visible only to the owner and the managers.
• Minimal recording. Fleet records only during a workday, with an automatic stop, and within the work hours if the customer sets them; the driver can stop the workday at any time, for example for a break, and nothing is recorded until they start a new one. Private trips are stripped of their places and route in the customer's data on the server; only the driver still sees them, in a store of their own that no function of the customer can read. Live positions are off by default, at most one per minute, and are erased after 30 minutes. Fines are erased after the period of the country, at the latest 24 months after the offence. In the time clock mode no position is kept during a break and the service keeps only the last place of equipment; in the no-tracking mode no workdays, trips or positions are recorded.
• Invitations. A random 256-bit key, of which only the hash is stored; valid for 7 days and usable once.
• Receipts and document scans. Private storage; readable only via links that are valid for five minutes.
• Misuse. Rate limiting on write actions and on sensitive functions; bot protection when signing in to the console.
• Audit log. Actions in the console are logged.
• Leopol staff. Access on a need-to-know basis and subject to a duty of confidentiality; the admin console shows no trips, routes, addresses or positions and cannot open a customer's console.
• Secrets. Keys are kept in the providers' management environments, not in the source code.
• Vulnerabilities. Daily check of the software used for known vulnerabilities.
• Tests. Automated tests check the access rules for each role.
• Error reporting. Errors are reported with technical data (error type, version, device, user ID), without the content of trips or positions.
• Backups by the hosting provider, which expire within 30 days at most, an encrypted weekly copy of the database on our own storage at Hetzner in Germany, which can no longer be read after a week, and an encrypted monthly copy of the stored files (receipts and document scans), kept until the next one and for at most 35 days.
• Incidents. A procedure to detect, contain and document breaches and to notify them to the customer within 48 hours.

Annex 3. Sub-processors

For the service:

1. Supabase Pte. Ltd. (Singapore), with Amazon Web Services as hosting provider. Database, authentication, file storage (including the photos of receipts and the scans of vehicle documents) and server functions. Location: AWS region eu-north-1 (Stockholm, Sweden); support by Supabase, Inc. from the United States may involve access. Safeguard: standard contractual clauses (module 2) in Supabase's data processing agreement.

2. Hetzner Online GmbH (Gunzenhausen, Germany). Leopol's own servers: the map in the console, looking up an address (for a position and in the console's address fields), the travel times of "Nearest driver" (computed itself or through TomTom, item 10) and processing the speed samples into statistics (clause 14). Location: Falkenstein (Germany) and Helsinki (Finland). No transfer.

3. Mapbox, Inc. (United States). Fallback for looking up an address for a position when Leopol's own server does not respond. Receives only coordinates, no name or user ID. Location: United States. Safeguard: EU–US Data Privacy Framework; standard contractual clauses.

4. Plus Five Five, Inc. (Resend, United States). Sending emails (invitations, reminders). Sending from Ireland; email data and logs are stored in the United States. Safeguard: standard contractual clauses; EU–US Data Privacy Framework.

5. Functional Software, Inc. (Sentry, United States). Error reports from the app and the console: error type, version, device, user ID. Location: European Union (Frankfurt); some account data in the United States. Safeguard: EU–US Data Privacy Framework; standard contractual clauses as a fallback.

6. Vercel Inc. (United States). Hosting of the console at fleet.trapspotter.com: serves the pages and, in doing so, receives the IP address and technical data of the browser. Location: global network. Safeguard: EU–US Data Privacy Framework; standard contractual clauses.

7. Cloudflare, Inc. (United States). Bot protection (Turnstile) when signing in to the console: IP address and technical signals from the browser. Location: global network. Safeguard: EU–US Data Privacy Framework; standard contractual clauses. Cloudflare also uses those signals as an independent controller to improve its bot detection.

8. Google LLC and Google Ireland Limited (Firebase Cloud Messaging). Push notifications to Android phones: the device token and the text of the notification. Safeguard: EU–US Data Privacy Framework; standard contractual clauses.

9. Apple Inc. (United States, Apple Push Notification service). Push notifications to iPhones: the device token and the text of the notification. Apple does not offer a data processing agreement or standard contractual clauses for this; that is why the service's push notifications contain only a generic text, without number plate, place or offence. The driver sees the details only in the app.

10. TomTom International B.V. (Amsterdam, Netherlands). Where the service uses TomTom: the address at the start and end of a trip and searching for an address in the console (currently in Belgium, from app version 2.7.80 and the console of that version), and the travel times of "Nearest driver" (within a monthly budget; otherwise Leopol's own server computes them). Through Leopol's own server in Helsinki, TomTom receives only coordinates (the start and end points, the live positions of the drivers on duty and the position of the address) and the search text, never a driver's name, user ID or IP address. TomTom is established in the European Union.

For billing (Leopol as controller; for information):

• Stripe Payments Europe, Limited (Ireland): subscription, payments and invoices; transfer to Stripe, LLC (United States) under the EU–US Data Privacy Framework and standard contractual clauses.
• Billit NV (Ghent, Belgium), as soon as sending via Peppol is active: invoices to Belgian customers via the Peppol network; servers in Europe.

Annex 4. Legal basis for fine data (for information)

The customer determines its legal basis. This annex summarises what Leopol found; it is not legal advice. A deadline runs from the date the law specifies (usually the date of sending or the date of the letter), not from receipt.

• Belgium. The legal person, or the natural person who represents it in law, communicates the identity of the driver or, if it does not know it, that of the person responsible for the vehicle, within 15 days of the sending of the request for information (Article 67ter of the Act on the Policing of Road Traffic). Since 1 September 2026, anyone who fails to do so risks a fine of €1,600 to €32,000 (Article 29ter), to be increased by the surcharges (opdeciemen). Legal basis: Article 6(1)(c) GDPR. Article 10 GDPR: Article 10, § 1, 1° of the Act of 30 July 2018 (management of its own disputes), to be confirmed by the customer; the customer keeps the list of the categories of persons with access and ensures that they are bound by confidentiality (Article 10, § 2).

• Luxembourg. The legal representative of the legal person that holds the registration certificate provides the data needed to identify the driver within 45 days of the date of the letter, one month longer for those who do not live in Luxembourg (Articles 4, 8, 8bis and 9 of the amended Act of 25 July 2015). Anyone who fails to do so risks a fine of €1,000 to €10,000 (Article 12). Legal basis: Article 6(1)(c) GDPR. Article 10 GDPR: the same legal obligation; we did not find an express Luxembourg rule for private employers.

• France. The legal representative of a legal person that holds the registration certificate, or that keeps the vehicle, communicates the identity and address of the driver within 45 days of the sending or delivery of the notice of offence, for offences detected by an automatic device (Article L121-6 of the Code de la route). Failure to do so exposes the legal person to a fixed penalty of €675 (€1,000 if the original offence is a misdemeanour). Legal basis: Article 6(1)(c) GDPR. Article 10 GDPR: Article 46 of Act No. 78-17 of 6 January 1978 (Informatique et Libertés), together with Articles A121-1 et seq. of the Code de la route, as confirmed by the CNIL's reference framework 2021-043 on the designation of drivers. That reference framework recommends keeping the data for the designation for 45 days after receipt of the fine; the service erases it automatically 45 days after the date of the letter (Annex 1), and the customer can erase it earlier in the console.

• Netherlands. For a fine under the Mulder Act (WAHV), there is no obligation to designate the driver: the registered keeper pays (Article 5 WAHV) and, since 1 September 2026, may process personal data in order to recover the fine from the driver (Article 5(2) WAHV). In the case of a penalty order, the owner or keeper is liable unless they disclose the name and address of the driver (Article 181 of the Road Traffic Act 1994, with a basis for criminal data in paragraph 5); in the case of a serious offence, they must disclose the driver within the period set in the demand, which is at least 48 hours (Article 165). Legal basis: Article 6(1)(f) GDPR, or (c) in the case of Article 165. Criminal data about staff is processed under rules adopted with the consent of the works council (Article 33(3) UAVG). The legislator points out that an owner or keeper may not keep a register of offences and may process data only for each specific sanction. According to the legislator, Mulder fines are not data within the meaning of Article 10 GDPR; as a precaution, the service treats them as such.

• Germany. There is no obligation to designate the driver. If the driver cannot be identified, the authorities may require the keeper to keep a logbook (§ 31a StVZO). Legal basis: Article 6(1)(f) GDPR. Article 10 GDPR: we did not find a clear German legal basis for employers; the customer, as controller, answers for its legal basis. The service keeps the fines and erases them automatically 30 days after the customer closes them (Annex 1).

• Other countries. This annex does not summarise the rules of other countries. The service counts down no deadline there and erases a fine 30 days after the customer closes it, and otherwise at the latest 24 months after the offence (Annex 1). The customer, as controller, answers for its legal basis.

A traffic offence falls within Article 10 GDPR, according to the Court of Justice (22 June 2021, C-439/19).