Privacy policy.

1. Controller

The controller for the processing on this website, in RPS Fleet Control and in the “RPS Logistics” app is:

RPS Logistics – Managing director: Sajeeshan Pathamanathan
Mozartstraße 18, 74172 Neckarsulm, Germany
Phone: +49 1523 3598784
Email: info@rps-gmbh.eu

More details are in the legal notice (Impressum). We have not appointed a data protection officer. Please send questions about data protection and requests concerning your rights to info@rps-gmbh.eu.

2. Overview

RPS Logistics transfers vehicles on behalf of car rental firms and other companies. For this we run three services:

• Website rps-gmbh.eu: information about our company. No account, no cookies, no tracking (section 3).
• RPS Fleet Control (fleet.rps-gmbh.eu): our web application for the office, for sub-companies and for drivers. It can only be used with an account we have approved.
• The “RPS Logistics” app for iPhone and Android: the mobile side of Fleet Control. The app exchanges data only with the Fleet Control server and loads map tiles (section 9).

The people concerned are visitors to the website, office staff, drivers (employed by us or by a sub-company), contact persons of sub-companies, people who sign a handover protocol, and contact persons of our customers where they appear in job data.

Our servers are in Germany. We do not sell data, show no advertising and use no analytics or tracking services. There is no automated decision-making within the meaning of Art. 22 GDPR: a person in the office decides on every registration.

3. Website rps-gmbh.eu

Server log files

For every page request our web server automatically records: IP address, date and time, the page requested, status code and amount of data, the page you came from (referrer) and browser type and operating system. We need this to run the website reliably and securely and to detect attacks (legal basis: Art. 6(1)(f) GDPR). We do not combine it with other data. The log files are deleted after 14 days. The same applies to the Fleet Control log files.

No cookies, no tracking

The website sets no cookies, stores nothing in your browser and uses no analytics, tracking or advertising services. Fonts and all other content come from our own server. No connections to third parties are made.

Contacting us

If you contact us by phone, email or WhatsApp, we store what you send us (name, contact details, content of the enquiry) to handle the enquiry (Art. 6(1)(b) GDPR, for general enquiries Art. 6(1)(f)). We keep it for as long as the enquiry and any follow-up questions require. If it leads to a job, the periods in section 12 apply. For WhatsApp, the privacy notice of WhatsApp Ireland Ltd. also applies. Links to external services (Google Maps, Instagram, WhatsApp) only open them when you tap them. The provider’s privacy policy applies there.

Request form

With the “Request a transfer” form on the home page and the contact page you send us your name, email address, pick-up location and destination, preferred date and your message, and optionally your company, phone number and vehicle. We use these details to answer your request and to prepare a quote (Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract). The form sends the data encrypted to RPS Fleet Control on our server in Germany (fleet.rps-gmbh.eu). The request is stored there, and the office is notified by email (sent through our email provider, section 11). The management also gets a notice in Fleet Control and in the app that shows only the name, company and route (push delivery as described in section 8). The tick box under the form confirms that you have read this notice. A field that visitors do not see helps us filter out automated spam; nothing is stored in your browser. We delete the request after 180 days unless it leads to a job. If it does, we keep it like job records (section 12).

4. Fleet Control and app: account and registration

Registration (“Create an account”)

Drivers and sub-companies can register in the app and on fleet.rps-gmbh.eu. We ask for:

• from everyone: name, email address, phone number and a password;
• from drivers: licence class and expiry date, photos of the driving licence (front and back), a photo of the ID card or passport, whether you are a citizen of the EU, the EEA or Switzerland and, if not, a photo of the work or residence permit with its expiry date; also who you drive for (RPS Logistics or a sub-company);
• from sub-companies: company name, address, contact person and, optionally, tax number or VAT ID.

Before anyone drives a customer’s vehicle, we check identity, driving licence and right to work. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract or employment), for drivers of a sub-company Art. 6(1)(f) (our legitimate interest that only checked people drive customers’ vehicles).

Nobody gets an account without the office’s approval. A person checks every registration. Only the owner can see the document photos. They are deleted 30 days after our decision (approval or rejection), and at once if the account is deleted. You may black out the access number (CAN) and the serial number on the ID photo. We do not need them.

Without these details we cannot approve an account. If we reject a registration, the name, email address, phone number and the reason stay stored so that you learn why when you try to sign in. We delete them at once on request.

Account data

For each account we store name, email address, password, role (office, sub-company or driver) and company. We store the password only as a salted hash. We cannot read it. For drivers we also store phone number, licence class and expiry, vehicle types, languages, city, emergency contact, office notes and the pay rate (visible to the office only). For sub-companies: company details, contact person and their own drivers.

We use this data to run the account, give out jobs, reach you and pay you. Legal basis: Art. 6(1)(b) GDPR; for drivers employed by us Art. 88 GDPR together with § 26 BDSG (German Federal Data Protection Act); for drivers of a sub-company Art. 6(1)(f) GDPR (our interest in carrying out the jobs with the sub-company). If you give an emergency contact, please let that person know.

Signing in

On the website a session cookie keeps you signed in (section 10). When you sign in, the app receives a token that it stores on the phone. It also becomes invalid on the server when you sign out and expires after 30 days without use.

5. Job data

Jobs come from our customers’ portals (SIXT, Enterprise Mobility and PS-Team), which the office reads with RPS Logistics’ own logins, or the office enters them itself. A job contains the pickup and delivery address, dates, the vehicle (plate, VIN, model) and, where the customer provides them, contact persons on site. We also store who drives the job, its status and the pickup date and, for tenders to sub-companies, their bids.

The office sees all jobs. A sub-company sees the jobs we give it, with its price. Drivers see only what they need for the drive, never prices.

Legal basis: Art. 6(1)(b) GDPR (carrying out the jobs) and Art. 6(1)(f) (organising dispatch). The customers are responsible for their own portals.

6. Location data

The app uses the phone’s location only in the following four cases.

a) Availability (“online”): 14 days

While a driver is signed in to the app and has it open, the app sends the current position at intervals. This lets the office (and, for drivers of a sub-company, that sub-company) see who is available and who is near a job. When the app is closed or you are signed out, no position is sent. We delete these positions after 14 days.

b) Route during a job: 180 days

From the START to the END protocol of a job, the app records the route driven, also while the screen is locked. The phone shows that recording is running the whole time (Android: a permanent notification; iPhone: the location indicator). Recording stops with the END protocol. The route proves to the customer, and in disputes about damage, times or mileage, when and where the vehicle was picked up, driven and delivered. We delete it after 180 days.

c) Parking position

When a vehicle is parked on the way so that someone else can continue the run, the app saves the position so the vehicle can be found. It is part of the job’s protocol.

d) Incident report

Whoever reports an incident (for example an accident or damage) sends the GPS position at the time of the report. It is part of the report.

What we do not do: Without the app open and outside a job, no location is recorded. We do not create movement profiles and use location data only for the purposes named here. You can withdraw the location permission at any time in the phone’s settings. The app then cannot record a route or a parking position.

Legal basis: for drivers employed by us Art. 6(1)(b) GDPR together with Art. 88 GDPR and § 26 BDSG (performance of the employment relationship); for drivers of a sub-company Art. 6(1)(f) GDPR (our legitimate interest in proving that the transfer was carried out properly and in clearing up damage), or Art. 6(1)(b) if you are our contractual partner yourself.

7. Protocols, photos, signatures, chat and incidents

Handover protocols

At pickup, at delivery and at every handover on the way, the driver creates a protocol in the app: photos of the vehicle, marked damage, odometer reading, checklist, receipts (for example fuel or toll receipts), notes, place and time, and the signatures of the person handing over or receiving the vehicle and of the driver. The office, the sub-company on the job and the driver can see the protocol. The customer receives it where it needs it as proof. Please do not take photos of people.

Protocols are business records of the transfer. Legal basis: Art. 6(1)(b) GDPR (the job), Art. 6(1)(c) (retention duties under commercial and tax law) and Art. 6(1)(f) (evidence in case of damage). Retention: section 12.

Chat

Each job has a chat between the office, the sub-company and the driver, in which photos can be sent too. Only the people on that job can see it. The messages stay stored with the job.

Incident reports

An incident report contains the kind of incident, the description, photos, the position and who reported it. It is sent by email to the office (info@rps-gmbh.eu, sent through Hostinger’s mail server) and stored with the job. If the report contains details about other people, such as the other party in an accident, we process them to settle the claim (Art. 6(1)(f) GDPR).

Pay statements

Fleet Control calculates the drivers’ pay statements from the jobs driven. Only the driver concerned and the office can see a pay statement.

8. Notifications and push

New jobs, messages and status changes appear in the bell in Fleet Control and in the app. You also get push notifications, but only if you have allowed them in your browser or on your phone:

• Web push in the browser: We store with your account your browser’s push address, its keys and the browser identifier. Delivery runs through the push service of the browser maker (for example Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). The content is end-to-end encrypted. The push service only sees which device a notification goes to and when.
• iPhone app: For lock-screen notifications we use the Apple Push Notification service. We store your iPhone’s device token. Apple receives the token and the text of the notification.
• Android app: It currently uses no push service from Google (no Firebase Cloud Messaging). Notifications appear in the app.

We delete push addresses and device tokens when you sign out or delete your account. You can switch push off at any time in your browser’s or phone’s settings. Legal basis: Art. 6(1)(b) and (f) GDPR.

9. Maps (OpenStreetMap)

The maps in Fleet Control (for example live drivers, running jobs, protocols) and in the app are made of map tiles. Your browser or phone loads them directly from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). The Foundation receives your IP address, the coordinates of the tiles loaded (that is, the map area shown) and browser details, but no account data. An adequacy decision of the European Commission covers the United Kingdom. Legal basis: Art. 6(1)(f) GDPR (showing maps). See the OpenStreetMap Foundation’s privacy policy.

Navigation links to Google Maps only open the service when you tap them. Google’s privacy policy then applies.

Place names and coordinates for the radius rules and the place suggestions in Fleet Control come from GeoNames (licence CC BY 4.0). The list is kept on our own server; what you type goes to no outside service.

10. Cookies and local storage

• Website rps-gmbh.eu: no cookies, no local storage.
• Fleet Control: a single session cookie that keeps you signed in. It is strictly necessary and cannot be read by scripts (HttpOnly). It expires after 8 hours or when you sign out. Your browser’s local storage (localStorage) holds display settings such as language, colour theme, light/dark mode and sort order, plus your recent searches. The searches are deleted when you sign out. A service worker keeps the page frame, scripts and styles ready for a fast start. It does not store any data from your account.
• App: it stores the sign-in token and your settings on the phone.

This storage is strictly necessary for the function you use. No consent is required for it (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). We use no analytics or advertising cookies, no tracking and no third-party fonts.

11. Recipients, processors and transfers to third countries

These processors work for us (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the website and Fleet Control in the Nuremberg data centre (Germany).
• Hostinger International Ltd. (Cyprus): the info@rps-gmbh.eu mailbox and sending emails, for example incident reports.
• Apple: delivery of push notifications to iPhones (Apple Push Notification service).

Independent controllers are:

• Apple (App Store, TestFlight) and Google (Google Play) for downloading the app and your store account. If we invite testers to TestFlight, Apple receives their name and email address. Apple or Google provide crash reports and statistics to us only without reference to you as a person, and only if you have allowed this in your device settings.
• the browser makers’ push services (section 8) and the OpenStreetMap Foundation (section 9);
• our customers (SIXT, Enterprise Mobility, PS-Team) for the job data in their portals and the proof they receive from us;
• sub-companies for the data of their own drivers;
• authorities and courts where we are legally obliged to disclose data.

Transfers to third countries

Fleet Control data is stored only on our server in Germany. Data leaves the EU only in these cases: Apple Inc. and Google LLC (USA) for the app stores and push delivery. Both are certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists, and also use standard contractual clauses. The OpenStreetMap Foundation is based in the United Kingdom (adequacy decision). The browser makers’ push services may use servers outside the EU. We do not sell data or pass it on for advertising.

12. Retention periods

The periods under commercial and tax law start at the end of the calendar year in which the job was completed. When a period ends, the data is deleted.

13. Your rights

You have the right to:

• access to the data stored about you (Art. 15 GDPR). When signed in, you can download your data yourself: in Fleet Control in the menu under “Download my data”, or directly at fleet.rps-gmbh.eu/api/account/export;
• rectification of incorrect data (Art. 16);
• erasure (Art. 17), see below;
• restriction of processing (Art. 18);
• data portability (Art. 20);
• withdraw a consent with effect for the future (Art. 7(3)), for example for push notifications in your browser’s or phone’s settings;
• lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

An email to info@rps-gmbh.eu is enough for any request. We reply within one month.

Deleting your account

Drivers and sub-companies delete their account themselves: in the app, open the Menu tab, tap Delete account at the bottom and confirm with your password. Without the app, follow the steps at fleet.rps-gmbh.eu/account-deletion.html, or write to info@rps-gmbh.eu from the email address of your account. We close an office account on request.

Deleted at once: login and password, all sessions and sign-in tokens, push devices, the registration documents and the location history (availability and routes). They disappear from the nightly backup copies after 14 days at the latest.

Kept: jobs, protocols, pay statements and chat messages that we need for the statutory retention periods (section 12) and as proof. Your name appears in them only as far as the record requires. The driver’s roster entry stays, without contact details.

14. Security

• All connections to the website, Fleet Control and the app are encrypted with TLS (HTTPS). Both sites send HSTS and the usual browser security headers.
• We store passwords only as a salted hash.
• Role-based access: drivers see only their own jobs, sub-companies only their own jobs and drivers. Only the owner sees registration documents.
• The server is in Germany. The nightly backup copy stays on the same server, is accessible to the administrator only and is deleted after 14 days.
• App sign-in tokens expire after 30 days without use and become invalid when you sign out.

15. Information for drivers

If you are employed by RPS Logistics, processing your data in Fleet Control and in the app is part of your employment. The legal basis is Art. 6(1)(b) GDPR together with Art. 88 GDPR and § 26 BDSG. We do not rely on consent for this.

If you drive for a sub-company, that company is your employer and is responsible for its own processing. We process your data for the jobs we give the sub-company (Art. 6(1)(f) GDPR). Your sub-company sees your jobs, protocols and your position while you are online. You can also contact us directly with questions.

What the office sees: your profile, your jobs and protocols, your position while you are signed in to the app and have it open, the route of a job from START to END protocol, and your pay statements.

No monitoring outside jobs: When you are signed out or the app is closed, no location is recorded. A route is recorded only between the START and END protocol, and the phone shows this the whole time. Location data is used only for the purposes in section 6 and deleted after 14 or 180 days.

You can see your own profile, protocols and pay statements in the app and in Fleet Control. You can download all data on your account at any time (section 13).

16. Date

This privacy policy is dated October 2026. If the processing changes, we update it. The current version is always on this page.