Website, contact, and demo requests
Data: Name, email address, optional phone number, company, job title, fleet size, message content, preferred contact channel, language, and technical request metadata.
Purpose: Responding to enquiries, preparing demos, qualifying Enterprise requests, and keeping sales/support context.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual requests and Art. 6(1)(f) GDPR for business communication and service security.
Retention: Enquiries are kept while the request is active and then retained only as needed for business documentation or legal obligations.
Account, authentication, and security
Data: Name, email, password hash, session cookies, email verification state, password reset tokens, role, locale, login/session activity, and admin acting-user context.
Purpose: Creating accounts, signing users in, protecting accounts, sending verification/password emails, and preventing misuse.
Legal basis: Art. 6(1)(b) GDPR for account delivery and Art. 6(1)(f) GDPR for security and abuse prevention.
Retention: Account data is kept while the account exists. Security logs and reset/verification tokens are limited according to operational need.
Vehicle operations
Data: Vehicle details, VIN lookups, mileage, reminders, service logs, expenses, uploaded documents, document metadata, telemetry provider settings, and related support history.
Purpose: Providing the Fahrnex SaaS features for vehicle maintenance, reminders, documents, expenses, analytics, telemetry, and support.
Legal basis: Art. 6(1)(b) GDPR for product delivery and Art. 6(1)(f) GDPR for product reliability and support.
Retention: Vehicle and document records remain available while the account is active or until the user deletes them, subject to legal retention duties.
Consent-based website and product analytics
Data: Aggregated event names, public page paths, referrer domain, campaign parameters, inferred visit intent, device/browser category, language, account identifiers where applicable, timestamps, limited non-sensitive metadata such as plan type or feature category, and Google Analytics 4 measurement data where visitors opt in.
Purpose: Understanding public-page interest, campaign performance, feature usage, reliability, conversion, and support demand. Google Analytics 4 should load only after analytics consent, while non-essential advertising and retargeting storage remain disabled.
Legal basis: Art. 6(1)(a) GDPR for consent-based analytics and Art. 6(1)(f) GDPR for product improvement, operational insight, and service reliability where data is processed without non-essential cookies.
Retention: Analytics events are kept only as long as needed for product and operational reporting, then aggregated or deleted according to the retention policy.
Billing, subscriptions, and invoices
Data: Plan, subscription status, invoice data, billing name, billing email, payment preferences, Stripe checkout references, refund claims, and invoice PDFs.
Purpose: Managing paid plans, invoices, refunds, payment confirmation emails, and accounting records.
Legal basis: Art. 6(1)(b) GDPR for billing performance and Art. 6(1)(c) GDPR for statutory tax/accounting duties.
Retention: Commercial and accounting records may be retained for statutory retention periods, commonly up to 10 years in Germany depending on record type.
Support tickets and notifications
Data: Ticket subject, category, priority, messages, assigned admin, notification settings, notification logs, and reply history.
Purpose: Providing customer support, documenting support actions, and sending support replies or reminders.
Legal basis: Art. 6(1)(b) GDPR for support related to the service and Art. 6(1)(f) GDPR for support quality and dispute documentation.
Retention: Support records are kept while needed for customer service, product quality, and legal defence.