Privacy Policy

RitGenie is a self-learning mileage tracking app. To automatically record, classify and produce tax-compliant reports of your trips, we process a limited amount of personal data. We never process more than is necessary for those purposes.

1. Who is responsible for your data

The data controller for RitGenie is:

• ProBytes
• Place of business: Hoogeveen
• Chamber of Commerce number: KvK 97744425
• Contact: contact form

Do you use RitGenie through your employer or fleet manager? In many cases that organisation is then the (joint) data controller for the trip records. ProBytes then acts as a processor on behalf of that organisation. For questions about those records, please contact your employer.

2. Which data we process

Depending on how you use RitGenie, we process the following categories of data:

Location and trip data

• Trip and location data (GPS/position) of the vehicle, obtained from the tracking system of your vehicle unit;
• Departure and arrival address with postcode, odometer readings, trip times and distance;
• The classification of a trip (business, private or commuting) and any detour mileage with a reason.

Identity and account data

• Your email address, which we store encrypted (unreadable) and use only to recognise your account, so that you get your data back after a reinstall or on another device;
• A marker that lets us recognise the device on which the app runs;
• Your name and any role/permissions within an administration;
• For sub-users: the invitation code with which you were linked.

Presence and driver data

• Proximity observations via the smart app that indicate your device was near a vehicle unit (for driver and passenger recognition), with boarding and exit times;
• Who drove and who rode along per trip.

Technical and notification data

• A technical code that lets us send notifications to your phone (delivery runs via Firebase, Google's notification service);
• App, crash and diagnostic data (build number, connection status, error messages) for resolving malfunctions.

3. Purposes and legal basis

We process your data for the following purposes, each based on a legal ground under the GDPR (AVG) (art. 6):

Purpose	Data	Legal basis
Automatically record and classify trips	Location/trip data, classification	Performance of a contract / legitimate interest
Create and email tax-compliant reports	Trip, vehicle and driver data	Legal obligation (tax retention obligation) / contract
Recognise driver and passenger	Proximity via the smart app, identity	Performance of a contract / legitimate interest
Send notifications (questions, report sent)	Notification code, device marker	Performance of a contract
Manage the account and establish identity	Email address (stored encrypted), name, role	Performance of a contract
Resolve malfunctions and improve the app	Diagnostic/technical data	Legitimate interest

Where we rely on legitimate interest, we have weighed your interests and limited the processing to what is necessary.

4. Privacy by design: our choices

At RitGenie, privacy is a design principle, not an afterthought. In concrete terms this means:

• Private stays private. Private trips and passengers are hidden where appropriate, even from the main user. Passengers are shown only for business and commuting trips.
• Hide, do not erase. Private data is hidden, not thrown away. If you set a trip back to business, the addresses, route and passengers reappear. This is a deliberate choice: hiding is reversible, erasing is not.
• The dashboard shows nothing by default. You actively choose what appears on your dashboard, so that sensitive data is not displayed unprompted.
• Minimal sharing. The accountant version of a report contains only business and commuting trips. Anonymised sharing can be configured per recipient; of someone else's private trip you never see more than the mileage.
• Separation per administration. If you work for multiple organisations, each administration is physically separated, so that trips from one organisation can never end up with another.
• Only fetch what is needed. External data (such as postcodes or traffic information) is only retrieved at the moment a trip needs it.

5. Processors and third parties

To make RitGenie work, we engage a number of service providers. They process data solely on our instructions and under a data processing agreement. The following parties may be involved:

Party	Role	Data
Firebase / Google	Delivering notifications to your device	Notification code, device marker
Vehicle tracking system (ProGeo Central)	Source of the vehicle's trip and position data	Location/trip data
OSRM	Calculating routes and fitting trips to the map to detect detour mileage	Trip coordinates (no identity)
PDOK	Looking up postcodes and addresses from coordinates	Coordinates (no identity)
NDW / Rijkswaterstaat	Traffic information (roadworks, closures, incidents) for detour reasons	No personal data
Email service (Microsoft)	Sending email with reports and invitations	Email address, report attachment

Some of these parties (such as Google/Firebase) may process data outside the European Economic Area. In that case we ensure appropriate safeguards, such as the EU standard contractual clauses (standard agreements the European Union prescribes for this).

6. Retention periods

• Trip and report data: for a tax-compliant administration, a statutory retention obligation of 7 years applies in the Netherlands. That period is counted from 1 January of the year following the year the data relates to. A mileage log from 2023 is therefore kept until 31 December 2030. Trip data that belongs to that administration is kept for as long as legally required and deleted afterwards.
• Account and identity data: for as long as you have an active account. If you delete your account, we delete this data (see §9), except for data covered by the statutory retention obligation.
• Presence/proximity data: for as long as it is needed for the associated trip and administration.
• Notification codes: for as long as the device is linked; expired codes are cleaned up.
• Diagnostic data: briefly, solely for resolving malfunctions.

7. Cookies and tracking

In concrete terms:

• No cookies during normal visits. The website does not place cookies on its own. Only strictly necessary, functional storage may occur (for example a choice you make yourself in the browser); under cookie legislation, no consent is required for that.
• No external requests. Fonts (Poppins) are loaded locally from our own server, not from Google Fonts. So when the site loads, no data (such as your IP address) goes to external parties.
• Visitor statistics: on our own server we keep anonymous, cookieless statistics (such as pages visited, referral source, country and device type). We store no full IP addresses, set no cookies and share nothing with third parties. The data cannot be traced to an individual, so no cookie notice is needed.
• App vs. website. This chapter is about the website ritgenie.nl. The data processing in the RitGenie app itself is described in the rest of this privacy policy.

If in the future we do opt for cookies or statistics that require it, we will ask for your consent in advance via a cookie notice and update this policy.

8. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections, encrypted (unreadable) storage of your email address, access rights that we enforce on our servers (a modified app cannot bypass them) and a physical separation of data per administration. You can add extra protection to access to reports, settings and downloads in the app with an app lock (fingerprint, face or your device PIN).

9. Your rights

Under the GDPR (AVG) you have the following rights regarding your personal data:

• Access: an overview of which data we process about you;
• Rectification: having inaccurate data corrected;
• Erasure: having your data erased ("right to be forgotten"), insofar as no statutory retention obligation applies;
• Restriction: temporarily having the processing stopped;
• Objection: objecting to processing based on legitimate interest;
• Data portability: receiving your data in a common format or having it transferred;
• Withdrawing consent: where we rely on consent, you can withdraw it at any time.

You can submit a request via our contact form. We respond within the statutory period of no later than one month. If you disagree with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.

10. Delete your account and data

11. Children under 16

RitGenie is intended for business use and is not directed at children under 16. We do not knowingly collect personal data from minors without the consent of a parent or legal guardian. If you believe we have processed data of a child under 16, please contact us via the contact form and we will delete that data where appropriate.

12. Changes to this policy

We may amend this privacy policy from time to time, for example for new features or changed legislation. The most current version is always available at ritgenie.nl/privacy, with the date of the last change at the top. In the event of significant changes, we will inform you via the app or by email.

13. Contact

Questions about this privacy policy or about your data? Contact us:

• Contact: contact form
• ProBytes, KvK 97744425, Hoogeveen