DDDStart privacy and cookie policy

1. Controller and contact

The controller of data related to the account and sales is: AMK VISION spółka z ograniczoną odpowiedzialnością, ul. Jarosława Iwaszkiewicza 18 lok. 1, 59-900 Zgorzelec, KRS 0001137743, NIP 6152075857, REGON 540174839. Contact on data matters: info@dddstart.com. Automatic notifications (e.g. confirmations, reminders, account information) are sent from powiadomienia@dddstart.com; this address is for sending only and does not accept messages, so please send questions, complaints and requests only to info@dddstart.com. No data protection officer has been appointed. The portal is operated by an authorised person on the service provider's side; technical access by providers is limited to the necessary extent.

2. Data, purposes and legal bases

Providing account data is voluntary but necessary to provide the service. A phone number is required when creating an account on the website and in the mobile app; we use it to contact you about the account, orders and support requests, not for marketing. The chosen account language determines the language of e-mails, PDF reports and the mobile app screens (Android and iPhone); the app also keeps it on the phone. The data required to properly document a transaction depends on the type of sales document. We do not store full payment card data.

Company offer

The driver decides whether to link their account to a company: they enter the company's code in the app and accept the scope of sharing. In the company panel the company sees the driver's name, link status, number of files sent and the next card download date, and in the card archive the original card files downloaded in the app after linking. The company does not see the driver's analyses, reports, balance or account settings, location or live readings. As regards the card archive, the company is the controller of the driver's data and DDDStart acts as a processor on its instructions. The driver can exercise their rights regarding files in the company's archive with the company; we forward any requests we receive to the company without undue delay. Unlinking stops further files from being sent but does not delete files already given to the company, which the company keeps in accordance with the law.

3. Other people in DDD files

A tachograph may contain data of co-drivers, technicians and controllers. Upload only files whose use and transfer you may lawfully commission. In the read representation, recognised workshop and control card data is masked; the original file is not modified and may still contain this data.

Other people's data comes from the file provided by the user. We process only the scope needed to reconstruct the context of shared driving, assess completeness and protect against incorrect results, on the basis of the legitimate interest of the controller and the user (Art. 6(1)(f) GDPR). The data subject may object. Information about such processing is provided in the document “Information about the data in DDD files”; in situations requiring individual notification we fulfil this obligation within the period under Art. 14 GDPR. Publication of the document or a statement by the uploader alone does not release the controller from this obligation. The content of DDD files is not used for ad targeting.

4. Retention periods

Messages about analysis validity and the planned deletion of reports or the account serve the performance of the contract and data protection, not promotion. They do not depend on marketing consent. The system sends them automatically 30 and 7 days before the deadline. A failed sending is retried; the absence of effective advance notice of deletion of an inactive account postpones that operation.

Infrastructure backups may also be made by the hosting provider within the scope of the contract; the maximum period for which service data can be restored is 30 days. Deleting data from active storage does not mean its immediate deletion from every backup. Restoring a backup requires re-applying retention and earlier deletion requests. Backups are not used for ongoing use of deleted data. After restoration we apply the deletion log before accounts are made available again.

The deletion log contains record identifiers and the time of the operation, without DDD content. It is used to re-apply deletions after restoration. We keep it until the last backup from before the deletion expires and its rotation is checked; unnecessary entries are reviewed and deleted at least once a quarter.

The support register contains the subject, category, dates, status, notes and evidence of replies. An open matter suspends automatic deletion of the account; the administrator must regularly assess whether further storage is justified. Closed matters are deleted together with the account. Necessary evidence of a complaint, settlement or claim may first be separated into a limited archive according to the periods in the table; for this purpose we do not keep the whole account or the whole DDD file.

The confirmation queue stores the address and content until the message is accepted by the sending service. After acceptance it deletes the content from the queue, and the recipient's address after 30 days; it keeps a technical hash of the address to prevent duplicates. This does not mean deletion of separate order documentation or messages at the e-mail provider. Unsent messages are reviewed by support. After the problem is resolved or the message is delivered through another channel, unnecessary content and the address are deleted from the queue within 30 days at the latest. Financial documents, the claims archive, external correspondence and the deletion log are also subject to periodic review by the administrator; the application does not automatically delete all these categories.

Older unlimited entitlements and transitional periods after a change of rules are protected. The absence of effective advance notice of account deletion postpones the operation. Driver or vehicle profile data are account resources separate from a single report.

5. Recipients and transfers

Selected providers and scope of transfer:

The only payment operator is Tpay. Tpay remains inactive until the integration is launched and customer information is updated. Using the account does not require consent to advertising. External payment and social platforms may act as separate controllers for their own purposes; roles in the remaining scope result from the specific services and contracts.

Basic account and analysis data is handled in infrastructure covered by the hosting contract, on webh.pl servers located in Poland. Marketing integrations do not transfer DDD files or reports to Google, Meta and TikTok. Providers' tools may involve processing outside the EEA, including in the USA, and in the case of TikTok also access from China. Before activation we verify the recipient, the countries of access and the appropriate transfer basis: a current adequacy decision for the recipient covered by it, or the European Commission's standard contractual clauses and the effectiveness of the required supplementary safeguards. Consent to cookies and OAuth do not replace this assessment. Information about the basis and a copy of the safeguards can be obtained at info@dddstart.com. The absence of an appropriate basis rules out launching the tool. We do not declare that all data is stored exclusively in Poland.

Providers' policies: Google, Meta and TikTok — EEA. Their own purposes and retention are not determined by DDDStart. For Facebook page statistics we apply the relevant joint controllership arrangement with Meta; it does not cover DDD files. Requests concerning the handling of our profile can be sent to DDDStart, and those concerning the platform's processing also to its provider.

6. Data subject rights

To the extent provided by the GDPR, you have the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Withdrawal of consent does not affect the lawfulness of earlier processing. The right to erasure has exceptions, among others related to legal obligations and claims.

You can delete the account together with DDD files, reports and profile data yourself in the account settings on the website (https://dddstart.com/app/ustawienia#usun-konto) or in the DDD Driver Assist mobile app, after entering your password. A private account with no settlements to clarify is deleted immediately; in other cases, e.g. with unused paid analyses, a subscription or a company account, the request goes to support and we delete the account after settlement, no later than within 30 days. We confirm the deletion by e-mail. We keep only billing documentation (orders, payments and the analysis ledger) for the period required by law and the deletion log described in section 4; backups expire within a cycle of up to 30 days.

Send other requests to info@dddstart.com. Do not send your password; additional identification data may be requested only in case of justified doubts and to the necessary extent. The reply is generally given within one month; under the conditions of Art. 12(3) GDPR an extension is possible after informing about the reasons. You may lodge a complaint with the President of the Personal Data Protection Office (UODO).

7. Automated analysis

The list of actions after an analysis and the comparison use saved results within the limits of account access. They do not create a new legal decision or an advertising profile. A comparison is refused or limited when consistency of scope, version and data quality cannot be ensured. Handling a request stores the report identifier and messages, without an additional copy of the DDD file. The user sees their own conversation and support's replies; internal notes are not published in the customer panel. Passwords or other drivers' data should not be entered there. Requests for access to data in notes are considered individually, protecting the rights of others.

The owner and the operator's administrator with the marketing role have full access to all modules, including handling of accounts, requests and payments. Roles are granted only to authorised persons of the operator; they do not mean that the providers Google, Meta or TikTok receive account data or DDD files. Role changes are recorded and invalidate the sessions of the affected account. The history available to the administrator covers events recorded in the application, not all possible actions outside it.

The own purchase funnel uses the dates of account creation, payment start, purchase confirmation and file upload. It returns aggregate numbers to administrators; the stage data remains part of the relevant account, order and file records and is subject to their retention. It is used to assess how the service works on the basis of legitimate interest, with the right to object. We do not send this link to advertising platforms. Public visits are a separate measurement; retention limits and the absence of historical measurements are not evidence that a particular person dropped out.

The Bluetooth G2V2 diagnostic report is used to check whether the phone and tachograph can complete scanning, pairing, connection and service discovery. It does not store the card number, the driver's name, the Bluetooth address, raw GATT values, tokens, protocol frames or bytes of the DDD file. The report is not evidence of a statutory download of data from the card or the tachograph memory. From version 0.2.72 we use a deterministic SHA-256 hash of the canonical service UUID (pseudonymisation, not full anonymisation) to compare Android/iOS profiles. We also store an optional random test code assigned by the user, which should not identify the vehicle or a person. Aggregate comparisons may concern reports of different users in the administrator panel; we do not infer the identity of the physical device on this basis.

The test version of the app (TEST), intended for trials with a tachograph, keeps from version 0.2.171 a technical event log stored only on the phone: the order and time of Bluetooth events (scanning, pairing, connection, disconnection), LIVE and card download events, the app state (on screen or in the background), the network state (whether there is internet and of what kind), the power state (battery saving, charge level, background restrictions), the reasons why the system previously closed the app, the phone model and system version, and whether the vehicle is moving (yes or no, without speed or location). Tachographs are marked in it only with a sequential symbol (T1, T2). The log does not contain the address or name of the Bluetooth device, the card number, the driver's name, counter values, protocol frames, bytes of the DDD file, pairing codes or account data. It leaves the phone only in a test report that the user of the test version saves, copies or shares; the report sent from the app to DDDStart does not contain it. The app for customers does not keep this log.

The mobile app shows current driving and break times from the tachograph counters read over Bluetooth. These readings are processed on the phone and are not stored on the server. Compensations and the weekly rest deadline, which the tachograph does not provide, are calculated automatically from the card file downloaded in the app. This calculation does not use an analysis from the package, does not create a report or store the original file, and is for guidance only. When the tachograph counters differ from the card calculation, the app shows a warning on the phone. The app needs an internet connection to work properly: when it starts without internet and after the connection is lost, it says so first. Without internet only LIVE works, and the app says so on the screen; the account and other functions return once the connection is back. So that LIVE works without internet, the phone keeps locally, in encrypted form, the data last confirmed by the server that the start screen needs (name, account name and type, role) and the LIVE access information (subscription or trial). This data does not leave the phone, is tied to the current session, is invalidated by signing out, and the server confirms the session again when the internet returns. To detect a missing connection the app reads the network state from the system, without data about visited websites or location. So that the next connection goes straight to the right tachograph, the phone stores locally a pseudonymous marker of the tachograph the user chose from the list and paired with the phone (not the Bluetooth address itself); the user can change it. Each tachograph on the list shows a short identifier derived from this marker, so that tachographs with the same name can be told apart. The marker is not sent to the server or included in diagnostic reports.

The service automatically processes activities and indicates potential infringements. It does not issue decisions of an inspection authority or impose penalties. The result is supporting and shows data limitations. We do not take solely automated decisions producing legal effects or similarly significant effects for a person within the meaning of Art. 22 GDPR. We do not combine the analysis result with an advertising profile.

8. Cookies and device storage

Essential mechanisms serve the functions you ordered. Google Analytics 4 requires choosing analytics, and Meta Pixel a separate choice of marketing. The banner allows “Essential only”, saving your own choice and accepting all indicated tools. The options are off by default if there is no valid choice for the current version. Refusal does not block the account, price or purchase. A link in the footer allows changing and withdrawing the decision when the tools are configured. A change after the tags have loaded reloads the page and deletes measurement cookies accessible to the application; it does not undo earlier data transfers or delete cookies not accessible to this domain. Tags are not initialised on the login, registration, payment and DDD demo pages, in the panels or for logged-in users. Moving to the private part with tags loaded reloads the document.

A link to Facebook, Instagram or TikTok alone does not initialise their pixel or an embedded video. Additional embeds require assessment and consent settings. DDD and report data are not used to create advertising audiences. No newsletter, customer list upload, TikTok Pixel, Meta Conversions API or Purchase tracking has been launched. The current tags serve page views; Google Ads as a UTM channel does not mean an advertising API or additional tracking. New tools require the information and consent to be reviewed again.

The operator's administrator connects their own Google, Meta or TikTok accounts via OAuth and approves the scope of access at the provider. DDDStart does not ask for or store passwords to these platforms; tokens and secrets are stored in encrypted form. A driver does not have to connect social media accounts. OAuth is not the visitor's consent to cookies. Disconnecting deletes the local token, but revoking permissions at the provider is a separate action; it does not delete posts already published. Application backups include the encrypted configuration and marketing materials; after restoration synchronisation is disabled and unreconciled publications are sent for review.

A graphic or video in the marketing module is available at a public address even before publication on the network. It is not a driver's private attachment. The administrator uses materials to which they have the rights and ensures an appropriate basis for publishing the image or data of other persons. DDD files or customer reports may not be added there. Deleting material from DDDStart does not automatically delete copies at Meta or TikTok; support handles those actions separately. Marketing retention from the table requires actions by the operator; the application does not automatically delete all these categories.

Google Analytics may store _ga and _ga_* for up to 2 years, and Meta Pixel _fbp for up to 3 months. The tools work only after configuration and obtaining appropriate consent; the time may be shorter due to browser settings. Before enabling another tool we update the information and the consent mechanism. Own statistics of public pages are used to assess how the service works; they do not store the content of analyses. The statistics cover the path of the public page, the referral source, the device and browser category and a daily hashed identifier. Purchase or registration events may contain an account identifier. The legal basis is the controller's legitimate interest in assessing how the service works; you have the right to object. Retention is set out in the table; we do not treat this data as unconditionally anonymous.

After a selected tag is launched, the provider also receives technical connection data, including the IP address, device/browser information, measurement identifiers, the address of the visited public page and the referral source to the extent of the tool's operation. Public addresses and campaign parameters should not contain personal data. Meta may link an event to its user in accordance with its own rules. The limited scope of application events does not mean that all data at the provider is anonymous.

9. Security and updates

The code applies permission control, account isolation, password hashing, session invalidation and audit. Access to data is limited by permissions. We use an encrypted HTTPS connection, backups and an incident handling procedure. Security measures are regularly checked; no system guarantees a complete absence of risk. Significant policy changes require a new review and information for users; a code update does not in itself constitute legal approval.

Analysis balance and buying more

A confirmed further purchase increases the balance by the analyses purchased and renews the validity of all unused, unexpired analyses for 12 calendar months from confirmation of that payment. A pending, cancelled or unpaid purchase does not extend validity. Expired analyses are not restored. We do not shorten longer deadlines or unlimited entitlements. This is not an automatic subscription or a charge for another fee. Balance validity does not change the storage periods for DDD files and reports or the consumer's statutory rights.

Driver Assist subscription – Tpay recurring payments

For the Driver Assist subscription we process: customer and organisation identifier, the operator Tpay, the type of instrument (payment card), the version and time of consent to recurring charges, the amount and billing period, the transaction identifier, the payment status, the dates of renewals, cancellations, complaints and refunds, and the necessary history of security events. The legal basis is, respectively, performance of the contract (Art. 6(1)(b) GDPR), legal obligations relating to settlements (point c) and the legitimate interest in protection against abuse and pursuing claims (point f), taking into account the rights of the data subject.

Card numbers and CVV codes are not stored in DDDStart. The operator token needed for renewals is stored in encrypted form with restricted access; after cancellation and Tpay's confirmation that the consent has been withdrawn, the token is deleted. Cancellation in DDDStart alone is not a confirmation of cancellation of the authorisation at the operator. We do not transfer the content of DDD files, driver activity data or analysis reports to payment operators. We also use the information whether a subscription is active to apply the subscriber analysis price in the cart and to provide LIVE in the app (performance of a contract, Article 6(1)(b) GDPR); we do not build a marketing profile on this basis.

Subscription settlement data (orders, payments, renewals, refunds) is kept for the periods for tax documents and for evidence of conclusion and performance of the contract set out in the table in section 4; it is not deleted solely as a result of account closure if keeping it is required by law or necessary to defend claims. For its own purposes Tpay may act as a separate controller, under its own privacy policy.

Phone information in the app

After the login is confirmed, the app transfers the phone manufacturer and model, the hardware model code, the system version and build, and the DDDStart version and build number. The record is linked to the account and a random app installation identifier. The last activity is updated while the app is used, no more often than every 5 minutes within a session. The data is available to the Super Admin for diagnosing problems and handling requests. We do not collect the phone number from the device (the number given at registration is described in section 2), IMEI, serial number, personal phone name or advertising identifier. A bug report keeps the information about the model and versions at the time it was sent, even if the device is later updated.