Data processing agreement
The parties and the purpose
This agreement applies when the customer (the controller) uses the service and ‹Lyron AS› (the processor) processes personal data on the customer's behalf, under GDPR article 28. We process the data only to provide the service and on the customer's documented instructions, which are the agreement and the settings the customer makes in the service.
Which data
Users: name, e-mail, mobile number, role, sign-ins. Trips: planned routes, stops, bookings and which driver drives. During trips: the truck's position, speed and battery level. Log: who did what in the company. The data subjects are the customer's employees and other users the customer invites.
For how long
Positions are deleted after 90 days, sign-in sessions after 30 days, and the company log and the booking log after 2 years. Other data is kept until the customer deletes it or the agreement ends; then everything is deleted within 30 days after access is closed, and the customer can export the data before that.
Security
Data is encrypted in transit and at rest. Each company is kept apart from the others in the database. Our staff's access needs two-step verification and is limited to what operations need; support can read the customer's data only when the customer has given time-limited access, and positions never. Everything we do with the customer's data is recorded in the customer's log.
Confidentiality
Everyone who processes the data at our end is bound by confidentiality.
Sub-processors
We use sub-processors for hosting (cloud provider), sign-in (identity provider), e-mail and SMS, and notify the customer at least 30 days before we change or add one, so the customer can object. The list of sub-processors and where they process data is published here before launch. Data is processed within the EEA. Route requests to the Norwegian Public Roads Administration contain only coordinates and the vehicle's dimensions, not who drives.
Assistance and audits
We help the customer fulfil the data subjects' rights (export of data, deleting users) and with data protection impact assessments. The customer can audit compliance with the agreement, with reasonable notice.
Breaches
In case of a personal data breach we notify the customer without undue delay, with what we know about what happened, which data it concerns and what we have done, so the customer can notify the data protection authority within 72 hours.
Version 2026-10-05