Privacy Policy
This privacy policy explains how Stratos Technologies AG ("we", "us") processes personal data in connection with Fleet Access (https://fleet-access.ch). Fleet Access is a platform through which garages submit cost approvals and invoices for vehicles to leasing and fleet companies, which check them and transfer them to their own systems. This policy is based on the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
1. Who is responsible
Fleet Access is provided by:
Stratos Technologies AG
Technoparkstrasse 1, 8005 Zürich
Switzerland
Email: info@stratos-tech.ch
UID: CHE-168.261.229
Our role depends on the data:
- We are the controller for data about the people who use Fleet Access (staff of garages and of our Clients), for the technical data needed to run and secure the platform, and for communication with our support.
- We act as a processor for the documents processed in Fleet Access and the data they contain. We process them on behalf of, and according to the instructions of, the leasing or fleet company that has contracted Fleet Access with us (the "Client"), on the basis of our agreement with the Client and its data protection provisions. See section 4.
2. Using Fleet Access
You log in to Fleet Access with a Stratos ID. Depending on your role, you are then taken to the Garage Dashboard (for garages) or to the area for Clients.
2.1 Technical data and security
When you use Fleet Access, technical data is processed automatically: IP address, date and time of access, pages and functions requested, browser type and version, and operating system. We use this data to provide the platform, protect it against misuse and attacks, and analyse and fix errors.
If an error occurs, an error report is sent to Sentry. It contains technical details about the error and the request concerned, which may include your user ID and IP address. Error reports are deleted after 90 days at the latest.
The legal basis is our legitimate interest in secure and reliable operation of the platform (Art. 6(1)(f) GDPR).
2.2 User accounts
To use Fleet Access, you need a user account. We process your name, email address, phone number (if provided), the company you work for (garage or Client), your role, your login credentials (passwords are stored only in hashed form) and your activity on the platform, such as the documents you upload, check, correct or forward.
Accounts are created when a Client invites you, when you register using a link sent by a Client, or when we set up the account on a Client's behalf. We use this data to give you access, keep your account secure, send you system emails (for example password resets and notifications) and provide support. The legal basis is the performance of our contract with the Client and our legitimate interest in providing the platform to the Client and to the garages that work for it (Art. 6(1)(b) and (f) GDPR).
We delete account data when the account is deleted or is no longer needed, unless we are legally required to keep it longer.
2.3 Contacting our support
If you contact us by email or phone, we process your contact details and your message to handle your request. The legal basis is our legitimate interest in answering requests and, where relevant, our contract with the Client (Art. 6(1)(b) and (f) GDPR). We delete this correspondence once it is no longer needed, unless we are legally required to keep it.
3. Cookies and local storage
Fleet Access only uses cookies and similar technologies that are strictly necessary for the platform to work. We do not use cookies for analytics or advertising.
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| Login data (local storage) | Fleet Access | Keeps you logged in | Until you log out | Necessary |
| Language (local storage) | Fleet Access | Remembers your language | Until you delete it | Necessary |
cf_clearance |
Cloudflare | Confirms that a security check has been passed | 30 minutes | Necessary |
_cfuvid |
Cloudflare | Distinguishes visitors who share an IP address, for rate limiting | Session | Necessary |
Login data and the language setting are stored in your browser's local storage and stay on your device.
Because these technologies are strictly necessary, they do not require consent. They are based on our legitimate interest in a secure, functioning platform (Art. 6(1)(f) GDPR). If you block them in your browser, you may not be able to log in.
4. Documents and the data they contain
This section also concerns people who do not use Fleet Access themselves but are mentioned in documents, for example contact persons at garages, or lessees and drivers of vehicles.
What we process. Garages submit cost approvals and invoices for work on vehicles managed by the Client. They do so through the Garage Dashboard, by email, by SFTP or through interfaces (API). These documents contain vehicle data (such as the VIN, licence plate, mileage and contract number), information about the garage including contact persons, and the work, parts and prices concerned. Documents may occasionally contain information about drivers. We do not use or evaluate this information.
How we process it.
- We read documents automatically (OCR and intelligent document processing) with Parashift, in order to extract the relevant data.
- To check that the work and parts prices are correct, we compare them with data from TecAlliance GmbH, Germany. For this, we send TecAlliance the identifiers of the work and parts and, if our own vehicle check cannot identify the vehicle, its VIN. No other data from the document, such as names or licence plates, is sent.
- Where necessary, the extracted data is checked and corrected manually by the Client, or on its behalf by our support team.
- We transfer the documents and the extracted data to the Client's systems, through interfaces (API, DMS), SFTP or email.
- Our administrators can access documents to operate the platform and to provide support.
Who is responsible. We process documents only on behalf of the Client and according to its instructions, on the basis of our agreement with the Client. The Client is responsible for this processing. Garages are responsible for the documents they submit. We do not use the documents or their content for our own purposes.
How long. We store documents and extracted data for as long as agreed with the Client. When our agreement with the Client ends, they are returned or deleted as agreed.
Your rights. If you are mentioned in a document, please contact the Client (the leasing or fleet company concerned) or the garage to exercise your rights. If you contact us instead, we will forward your request to the Client.
5. Service providers and other recipients
Documents and the data extracted from them are transferred to the Client concerned. In addition, we use carefully selected service providers who process personal data on our behalf and are contractually bound to protect it:
- Google Cloud (Google Ireland Limited): hosting of the platform, in data centres in Switzerland
- Exoscale (Akenes SA), Switzerland: storage of documents, in data centres in Switzerland
- Parashift AG, Switzerland: automatic document recognition (OCR and intelligent document processing)
- TecAlliance GmbH, Germany: vehicle, parts and price data for checking documents
- Cloudflare, Inc., USA: content delivery network, security and performance
- Functional Software, Inc. (Sentry), USA: error monitoring
- The Rocket Science Group LLC (Mandrill, part of Intuit Mailchimp), USA: sending system emails
- Google Workspace (Google Ireland Limited): email and office applications, including for documents we receive by email
We may also disclose personal data to authorities, courts or our professional advisers where we are legally required to or where it is necessary to protect our rights. We do not sell personal data.
6. Transfers abroad
Fleet Access is hosted in Switzerland. Switzerland and the EU/EEA recognise each other as providing an adequate level of data protection.
Some service providers are based in the USA or may process data there (Cloudflare, Sentry, Mandrill, Google Workspace). Cloudflare operates a global network, so data may be processed in the data centre closest to you. For transfers to countries without an adequate level of data protection, we rely on the EU–U.S. and Swiss–U.S. Data Privacy Framework where the recipient is certified under it, or on the European Commission's standard contractual clauses, which are also recognised in Switzerland.
7. How long we keep data
We keep personal data only for as long as it is needed for the purposes described in this policy, as agreed with the Client, or for as long as we are legally required to keep it. After that, we delete or anonymise it. More details are given in sections 2 and 4.
8. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted transmission (HTTPS), access controls based on user roles, hashed passwords and hosting in professionally operated data centres. Where our Clients require it, we also follow their security requirements.
9. Your rights
Under the FADP and, where applicable, the GDPR, you have the right to:
- request access to the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to the processing of your data, in particular processing based on legitimate interests;
- receive the data you have provided in a commonly used electronic format;
- withdraw your consent at any time with effect for the future, where processing is based on consent.
For data for which we are the controller, contact us at info@stratos-tech.ch or by post at the address in section 1. For data in documents, contact the Client or the garage (section 4). We may ask you to prove your identity. We respond within 30 days.
You also have the right to lodge a complaint with a data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). In Germany, it is the data protection authority of the federal state concerned. In other EU/EEA countries, you can contact the supervisory authority in your country of residence.
10. Automated decision-making
We do not use automated individual decision-making or profiling that has legal or similarly significant effects on you. The automatic recognition of documents serves only to extract data. Decisions on cost approvals and invoices are made by the Client.
11. Changes to this policy
We may update this privacy policy when Fleet Access or the law changes. The version published on this page applies. The date of the last update is shown at the top.