The security of your personal data
matters to us.

• Company name: Rubikas UK Limited
• Company registration number: 14332454
• Country: United Kingdom
• Official website: https://rubikas.co.uk
• Privacy policy: https://rubikas.co.uk/en/privacy

Rubikas UK Limited acts as a data controller in activities where it determines the purposes and means of processing personal data itself.

You can contact Rubikas UK Limited with questions, requests or complaints about the processing of your personal data.

• Email: [email protected]
• Postal address: 5th Floor, The Grange, 100 High Street, London, N14 6BN, United Kingdom
• Website: https://rubikas.co.uk

Keeping contact details up to date matters so that individuals can exercise their rights under the UK GDPR.

Where Rubikas acts as a data controller, it is responsible for processing personal data lawfully, fairly and transparently.

In this context it determines the purposes for which personal data is processed, the legal bases that apply, how long data is kept and who it is shared with.

It also aims to apply appropriate technical and organisational measures for data security and to make sure individuals can exercise their data protection rights.

In the Rubikas vehicle tracking system, live vehicle locations, past routes, driving information and security records may be processed.

Where individual users or corporate customers determine the purposes and essential means of processing this data, that user or organisation may be the data controller.

Rubikas acts as a data processor in activities where it processes this data on the instructions of the relevant data controller.

Where Rubikas carries out separate processing for its own purposes, controllership is assessed separately.

In the Rubikas biometric vehicle security system, drivers’ first name, last name, phone number and unique driver ID are stored in the relevant database of the system.

Fingerprint enrolment and verification are carried out on the biometric device inside the vehicle, in line with the system architecture described.

Raw fingerprint images and biometric templates are not transferred to Rubikas servers and are not stored in the central database.

However, processing biometric data on the device in the vehicle does not mean these activities fall outside the scope of the UK GDPR.

The party that determines the purposes and essential means of processing biometric data is treated as the data controller for that activity. Rubikas’s role in this process is determined by the nature of the service it provides and the actual responsibilities of the parties.

Corporate customers may act as data controllers in vehicle tracking and driver management activities relating to their own employees or the drivers they authorise.

In that case, the corporate customer is responsible for determining the purposes and legal bases of the processing and for giving individuals the required information.

Rubikas acts as a data processor in activities where it processes personal data on behalf of a corporate customer.

The parties’ obligations are set out in data processing agreements where required under Article 28 of the UK GDPR.

To deliver its services, Rubikas may use providers of servers, cloud infrastructure, technical support, SMS, voice calls and mobile notifications.

Whether these organisations act as data controllers or data processors depends on the nature of the service and the purposes for which they process personal data.

Contractual and security arrangements required under the UK GDPR are put in place with service providers that process data on Rubikas’s behalf.

Individuals may make requests to access their personal data, correct inaccurate information, erase data, restrict processing or exercise other UK GDPR rights.

Rubikas handles requests directly for activities where it is the data controller.

For activities where Rubikas acts as a data processor, it provides appropriate support to the relevant data controller in fulfilling requests.

Requests can be sent through the contact channels set out in the “How Can You Contact Us?” section of this Privacy Policy.

Rubikas UK Limited collects and processes first name and surname in order to identify users and authorised drivers in connection with its vehicle tracking and biometric vehicle security services.

This information is entered into the system through the mobile app by the user or authorised person and is used for the following purposes:

• Registering users and authorised drivers in the system.
• Matching drivers to their vehicles.
• Creating authorised driver records in the fingerprint verification system.
• Associating vehicle usage and security records with the relevant driver.
• Managing user and driver permissions.

Identity information is processed only to the extent necessary for the stated purposes, in line with the data minimisation, purpose limitation and security principles set out in Article 5 of the UK GDPR.

Personal data is kept for as long as the required retention period and, once that period ends, is deleted or anonymised in accordance with applicable data protection law.

Rubikas UK Limited collects and processes contact information, such as the phone number and email address of users and authorised drivers, in connection with its vehicle tracking and biometric vehicle security services, in order to provide the service and to communicate with users where necessary.

This information may be entered into the system by the user or authorised person through the mobile app or the web platform and may be used for the following purposes:

• Registering users and authorised drivers in the system and keeping their contact details up to date.
• Creating and managing user accounts and, where necessary, carrying out account verification.
• Delivering vehicle security alarms, alerts and notifications by SMS, phone call or email.
• Sending notifications to the designated contact numbers in the event of unauthorised use, towing, device tampering or other security incidents involving a vehicle.
• Handling technical support requests and sending important service-related notices.

Contact information is processed only to the extent necessary, in line with the purpose limitation, data minimisation and security principles under Article 5 of the UK GDPR.

A valid lawful basis under Article 6 of the UK GDPR that suits the activity concerned is identified for processing this data. Contact information is kept for the required retention periods and, once they end, is deleted or anonymised in accordance with applicable law.

Contact information is not used for direct marketing unless there is a separate valid lawful basis.

Rubikas UK Limited collects and processes vehicle information in connection with its vehicle tracking and biometric vehicle security services, in order to identify, track and secure the vehicles registered in the system and to associate them with authorised users.

The following information may be processed in this context:

• Vehicle identification details: Registration number, make, model, model year and vehicle type.
• Vehicle identity details: Vehicle identification number (VIN) and the vehicle ID assigned in the system.
• Tracking device details: Serial number and IMEI of the GPS tracking device and its vehicle pairing records.
• Vehicle and driver pairings: Authorised users and drivers assigned to the vehicle and the related authorisation records.
• Vehicle status information: Ignition on/off status, movement and stop information.
• Security system information: Status information for the engine immobiliser module, the biometric verification module and other vehicle security systems.

This data may be used for the following purposes:

• Identifying and managing vehicles on the Rubikas platform.
• Pairing vehicles with authorised users and drivers.
• Providing vehicle tracking and security services.
• Managing the tracking and security devices connected to vehicles.
• Detecting unauthorised vehicle use and generating security alerts.
• Detecting technical faults and providing support services.

Vehicle information is treated as personal data under the UK GDPR to the extent it can be linked to an identified or identifiable natural person.

This information is processed in line with the lawfulness, transparency, purpose limitation, data minimisation and security principles set out in Article 5 of the UK GDPR.

A valid lawful basis under Article 6 of the UK GDPR that suits the activity concerned is identified for processing this data. Vehicle information is kept only for as long as necessary and, once the retention period ends, is deleted or anonymised in accordance with applicable law.

Rubikas UK Limited collects and processes GPS location and route information in connection with its vehicle tracking and biometric vehicle security services, in order to determine vehicle locations, monitor their movements, display past journeys and keep vehicles secure.

The following data may be processed in this context:

• Real-time GPS location: The vehicle’s geographic position, including latitude and longitude coordinates.
• Location history: Places where the vehicle has previously been, with the date and time of each.
• Route and itinerary information: Roads the vehicle has taken, start and end points, and journey history.
• Movement and stop information: Time records for where the vehicle moved, stopped and was parked.
• Journey information: Journey start and end times, travel durations and distances covered.
• Geographic zone information (geofencing): Entry and exit records for predefined safe or restricted zones.
• Location-based security events: Records of unauthorised vehicle movement, towing and breaches of set location boundaries.

This data may be used for the following purposes:

• Letting authorised users view vehicles’ real-time locations.
• Reviewing past journeys and vehicle movements.
• Detecting unauthorised movement or towing of vehicles.
• Generating location-based alarms and notifications for vehicle security.
• Managing fleets, route tracking and operational processes.
• Helping to locate vehicles that are lost or stolen.
• Producing journey history, distance and usage reports.

GPS location and route information is personal data under the UK GDPR when it can be linked to an identified or identifiable person. Because it can reveal detailed information about people’s movements and the places they visit, it calls for special privacy and security measures.

Where Rubikas acts as data controller, it processes this information in line with the lawfulness, transparency, purpose limitation, data minimisation and security principles set out in Article 5 of the UK GDPR.

A valid lawful basis under Article 6 of the UK GDPR that suits the processing activity concerned is identified for processing GPS data. Access to location information is limited to users authorised for the provision of the service.

GPS location and route records are kept for as long as necessary for the stated processing purposes. When the retention period ends or a valid deletion request is accepted, the data is deleted or anonymised in accordance with applicable law.

Rubikas UK Limited collects and processes driving and vehicle usage data in connection with its vehicle tracking and biometric vehicle security services, in order to monitor how vehicles are used, analyse driving behaviour, improve vehicle security and support fleet management.

The following data may be processed in this context:

• Speed information: The vehicle’s real-time speed, speed history, maximum speed values and speed limit violations.
• Driving time information: Journey start and end times, total driving time and usage history.
• Distance information: Distance covered during a journey and total daily and periodic mileage.
• Ignition status: Whether the vehicle’s ignition is on or off, with date and time records of each state.
• Movement and stop information: How long the vehicle spent moving, stopped, idling and parked.
• Driving behaviour information: To the extent the system can detect them, harsh acceleration, hard braking, sharp turns and other driving events.
• Vehicle usage history: Records of the dates, times and durations for which the vehicle was used.
• Driver pairing information: Records linking vehicle use to the authorised drivers defined in the system.
• Unusual usage events: Unauthorised use, unexpected movement and usage events detected by the security systems.

This data may be used for the following purposes:

• Monitoring vehicle usage in real time.
• Viewing past driving and vehicle usage records.
• Detecting speed limit violations and unusual driving events.
• Supporting vehicle and driver safety.
• Detecting unauthorised vehicle use and generating security notifications.
• Supporting fleet management and operational efficiency.
• Preparing reports on vehicle usage times, distances and driving history.
• Investigating technical problems and abnormal vehicle movements that the system can detect.

Driving and vehicle usage data is treated as personal data under the UK GDPR when it is linked to an identified or identifiable driver.

Because this data can reveal information about drivers’ movements, vehicle usage habits and behaviour, it is processed in line with the lawfulness, transparency, purpose limitation, data minimisation and security principles set out in Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR that suits the activity concerned is identified. Access to the data is limited to the relevant users in line with their duties and authority.

Driving and vehicle usage records are kept for as long as necessary for the stated processing purposes. When the retention period ends or a valid deletion request is accepted, the data is deleted or anonymised in accordance with applicable law.

Rubikas UK Limited collects and processes security and alarm records in connection with its vehicle tracking and biometric vehicle security services, in order to keep vehicles secure, detect unauthorised use attempts, identify potential security threats and inform users in good time.

The following data may be processed in this context:

• Unauthorised vehicle use records: Detected attempts to use or start vehicles by unauthorised persons.
• Fingerprint security records: Unrecognised fingerprint attempts, failed biometric verifications and unauthorised access attempts.
• Vehicle towing and movement alarms: The vehicle being moved or towed with the ignition off, or set security conditions being breached.
• Device tampering records: Removal or disconnection of the vehicle tracking device, or unauthorised interference detected on the device.
• GPS and GSM jamming records: Suspicious events detected by the system indicating that GPS or mobile communication signals are being jammed.
• Location and zone alarms: Entries into and exits from defined geographic zones and location-based security breaches.
• Ignition and engine immobiliser records: Changes in ignition status and operations to activate or deactivate the engine immobiliser system.
• Accident and unusual movement records: Possible accidents, impacts or unusual vehicle movements detected by the device sensors.
• Notification and voice call records: Records of mobile notifications, SMS messages and automated voice calls generated because of security events.
• Alarm date, time and location information: When the security event occurred, the vehicle concerned and, where available, GPS location information.
• Alarm management records: Viewing and acknowledging of alarms and the related actions taken by users.

Purposes of Processing

Security and alarm records may be used for the following purposes:

• Helping to detect unauthorised use, theft or towing of vehicles.
• Identifying interference with vehicles and security devices.
• Recording unauthorised access attempts on the fingerprint verification system.
• Informing authorised users of security events by mobile notification, SMS or automated voice call.
• Reviewing and reporting on past security events.
• Informing users in the event of a possible accident or emergency.
• Checking the technical operation of security systems and investigating problems.
• Carrying out system analyses to improve vehicle and user security.

Protection of Personal Data

Security and alarm records are treated as personal data under the UK GDPR when they can be linked to an identified or identifiable person.

This data is processed in line with the lawfulness, transparency, purpose limitation, data minimisation, storage limitation and security principles under Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR is identified for the relevant processing purpose.

Access to security and alarm records is limited to the relevant users and authorised personnel in line with their duties and authority.

Records are kept for as long as necessary for the stated security and service purposes. When the retention period ends or a valid deletion request is accepted, the data is deleted or anonymised in accordance with applicable data protection law.

Rubikas UK Limited collects and processes user account and authorisation information in connection with its vehicle tracking and biometric vehicle security services, in order to create user accounts, carry out authentication, manage system access, and ensure that vehicles can be viewed and controlled only by authorised persons.

The following data may be processed in this context:

• User account information: Username, account ID, registered email address, phone number and account creation date.
• Authentication information: Securely stored verification values of passwords, session information and user login verification records.
• User roles and permissions: Access permissions for administrators, vehicle owners, fleet managers, drivers and other defined user roles.
• Vehicle access permissions: Authorisation records showing which vehicles users may view, track and manage.
• Driver authorisation information: Pairing authorised drivers with vehicles, and creating, updating and removing driver records.
• Biometric authorisation information: User IDs, enrolment numbers and vehicle usage permissions linked to the fingerprint verification system.
• Session and access records: Login and logout times, IP addresses, failed login attempts and records relating to session security.
• Permission change records: Changes to user roles, granting or removal of vehicle access permissions, and account management operations.
• Account security records: Password reset requests, account verification operations, suspicious login attempts and security alerts.
• Account status information: Records of whether user accounts are active, inactive, suspended or closed.

Purposes of Processing

User account and authorisation information may be used for the following purposes:

• Creating, verifying and managing user accounts.
• Providing users with secure access to the Rubikas web platform and mobile apps.
• Defining different access permissions for vehicle owners, fleet managers and drivers.
• Ensuring vehicles are viewed and managed only by authorised persons.
• Managing driver and vehicle authorisations in the fingerprint verification system.
• Detecting unauthorised access attempts and protecting account security.
• Creating, changing or removing user permissions.
• Carrying out account security, technical support and system administration operations.
• Investigating security events and, where necessary, checking access history.

Protection of Personal Data

User account and authorisation information is treated as personal data under the UK GDPR when it is linked to an identified or identifiable natural person.

This information is processed in line with the lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security principles set out in Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR that suits the relevant purpose is identified for processing this data.

Access to user accounts and authorisation information is limited in line with the duties and responsibilities of the people concerned. Appropriate technical and organisational security measures are applied to protect account security.

User account and authorisation information is kept for as long as necessary to provide the service, ensure account security and meet applicable legal obligations.

When the retention period ends or a valid deletion request is accepted, personal data is deleted or anonymised in accordance with applicable data protection law.

Rubikas UK Limited collects and processes device and technical connection information in connection with its vehicle tracking and biometric vehicle security services, in order to identify the tracking and security devices installed in vehicles, establish communication links, monitor system performance, detect technical problems and deliver the services securely and without interruption.

The following data may be processed in this context:

• Device identification information: GPS tracking device serial number, IMEI, device ID and hardware identifiers registered in the system.
• SIM card and mobile network information: SIM card ID, ICCID, IMSI, mobile operator details and the mobile network the device is connected to.
• GPS connection information: GPS satellite connection status, signal quality, location accuracy and satellite access information.
• GSM and LTE connection information: Mobile network connection status, signal level, connection quality, network technology in use and connection interruptions.
• Network and server connection information: IP address, connection dates and times, server communication status and connection error records.
• Device operation information: Whether the device is active or inactive, restart records, uptime and system error notifications.
• Power and energy information: Vehicle battery voltage, the device’s external power connection, internal battery level and power interruption records.
• Software and hardware version information: The device’s firmware version, hardware model, software update status and update records.
• Bluetooth connection information: Where used, Bluetooth device identifiers, pairing records, connection status and proximity detection information.
• Biometric device connection information: Device ID, connection status and technical error records of the fingerprint verification module.
• Technical event records: Technical records relating to device disconnection, GPS signal loss, mobile network outages, system errors and device tampering.

Purposes of Processing

Device and technical connection information may be used for the following purposes:

• Securely connecting vehicle tracking and security devices to the Rubikas platform.
• Identifying devices, pairing them with vehicles and managing them remotely.
• Monitoring the status of GPS, GSM, LTE and other communication links.
• Detecting connection interruptions, technical faults and device performance problems.
• Updating device software and carrying out technical maintenance.
• Supporting the correct operation of vehicle security systems.
• Protecting devices against unauthorised interference and security threats.
• Providing technical support services and investigating system problems.
• Improving service continuity, connection reliability and system performance.

Protection of Personal Data

Device and technical connection information is treated as personal data under the UK GDPR to the extent it can be linked, directly or indirectly, to an identified or identifiable natural person.

Technical identifiers such as IMEI, IMSI and IP address can make it possible to identify users or drivers when combined with other information. Where such information is personal data, it is therefore subject to the relevant data protection provisions.

This data is processed in line with the lawfulness, transparency, purpose limitation, data minimisation, storage limitation and security principles under Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR that suits the processing purpose concerned is identified.

Access to technical connection records is limited to persons authorised to provide the service, ensure system security and carry out technical support.

Device and technical connection information is kept for as long as necessary for the relevant service and security purposes. When the retention period ends or a valid deletion request is accepted, information that is personal data is deleted or anonymised in accordance with applicable data protection law.

Rubikas UK Limited collects and processes mobile app and system usage records in connection with its vehicle tracking and biometric vehicle security services, in order to keep the mobile apps and web platform running securely, manage user operations, detect technical problems, prevent unauthorised access and improve service quality.

The following data may be processed in this context:

• App usage information: Dates of access to the mobile app and web platform, usage times, session durations and the app features used.
• Login and session records: Users’ login and logout times, successful or failed login attempts and session security records.
• Device and operating system information: Mobile device model, operating system type and version, app version and technical compatibility information.
• IP address and connection information: IP addresses from which users connect to the system, connection times and network access records.
• User operation records: Viewing vehicles, selecting vehicles, changing alarm settings, adding or deleting drivers and authorisation operations.
• Remote control operation records: Security-related operations performed by authorised users, such as activating or deactivating the engine immobiliser.
• Notification records: Security alerts and push notifications sent through the mobile app, notification delivery status and, where available, user interactions.
• App error records: App crashes, software errors, connection problems and technical performance records.
• System security records: Suspicious login attempts, unauthorised access attempts and events relating to system security.
• App preferences: Language, notification, appearance and other personalisation settings chosen by the user.
• Mobile notification identifiers: App or device notification tokens used to deliver push notifications.
• Technical support records: App problems reported by users, support requests and records of the steps taken to resolve them.

Purposes of Processing

Mobile app and system usage records may be used for the following purposes:

• Ensuring the Rubikas mobile apps and web platform run securely and properly.
• Managing user sessions and protecting account security.
• Detecting unauthorised access and suspicious user operations.
• Recording important user operations relating to vehicle security.
• Keeping security operations such as engine immobilisation, driver authorisation and alarm management traceable.
• Delivering mobile notifications and security alerts to the relevant users.
• Detecting software errors, connection problems and performance issues.
• Assessing and resolving technical support requests.
• Improving app performance, reliability and user experience.
• Preserving user preferences and managing app settings.

Protection of Personal Data

Mobile app and system usage records are treated as personal data under the UK GDPR to the extent they can be linked, directly or indirectly, to an identified or identifiable natural person.

Data such as IP addresses, session records, device identifiers and user operation history can reveal information about users’ activity on the system, so it is protected with appropriate privacy and security measures.

This data is processed in line with the lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security principles set out in Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR that suits the processing purpose concerned is identified.

Access to usage and operation records is limited to personnel authorised within the scope of their duties and responsibilities.

Personal data is kept for as long as necessary to provide the service, ensure system security, resolve technical problems and meet applicable legal obligations.

When the retention period ends or a valid deletion request is accepted, personal data is deleted or anonymised in accordance with applicable data protection law.

If analytics, advertising or similar non-essential tracking technologies are used in the mobile app or web platform, separate information is provided about the data processing concerned and, where required under the privacy and electronic communications rules applicable in the United Kingdom, user consent is obtained.

Rubikas UK Limited collects and processes website and system usage records in order to keep its website and online services running securely, without interruption and efficiently, manage user operations, detect technical problems, prevent unauthorised access and improve service quality.

The following data may be processed in this context:

• Website visit information: Pages visited, access dates and times, and page view and usage records.
• IP address and connection information: IP addresses from which users connect to the website or system, connection times and network access records.
• Browser and device information: Browser type and version, operating system, device type and technical compatibility information.
• Session and login records: Users’ login and logout times, successful or failed login attempts and session security records.
• User operation records: Viewing vehicles, changing alarm settings, adding or deleting drivers and user authorisation operations.
• Remote control records: Engine immobiliser and other vehicle security control operations performed by authorised users.
• Cookie and similar technology information: Cookies and online identifiers used for session management, security, user preferences and, where applicable, analytics.
• Technical error and performance records: Website errors, connection problems, server responses and technical records relating to system performance.
• Security events: Suspicious access attempts, unauthorised operation attempts and event records relating to system security.
• Contact and form records: Contact forms and support requests submitted through the website and the related processing information.

Purposes of Processing

Website and system usage records may be used for the following purposes:

• Ensuring the website and online services run securely and properly.
• Managing user sessions and protecting account security.
• Detecting unauthorised access, suspicious operations and potential security threats.
• Keeping important user operations on the vehicle tracking and security platform traceable.
• Resolving technical errors and connection problems.
• Improving website performance and user experience.
• Handling users’ contact and technical support requests.
• Meeting legal obligations and, where necessary, investigating security events.

Protection of Personal Data

Website and system usage records are treated as personal data under the UK GDPR to the extent they can be linked to an identified or identifiable natural person.

This data is processed in line with the lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security principles under Article 5 of the UK GDPR.

Where Rubikas acts as data controller, a valid lawful basis under Article 6 of the UK GDPR that suits the processing purpose concerned is identified.

Access to usage records containing personal data is limited to persons authorised in line with their duties and responsibilities.

Records are kept for as long as necessary for the stated processing purposes. When the retention period ends or a valid deletion request is accepted, the data is deleted or anonymised in accordance with applicable law.

Cookies and Tracking Technologies

If cookies or similar technologies are used on the Rubikas website, users are given clear information about their types, purposes, retention periods and the third parties involved.

Under the Privacy and Electronic Communications Regulations (PECR) that apply in the United Kingdom, users’ prior valid consent is obtained for cookies and similar tracking technologies that are not strictly necessary, except where an exemption applies.

Users must be able to manage their preferences for non-essential cookies.

GPS location and route data is processed in order to determine vehicles’ real-time locations, track their movements, display past journeys and make vehicle usage information available to authorised users.

In this context, vehicles’ live locations, past routes, movement and stop information, journey durations and distances covered may be processed on the system.

This information is used so that vehicle owners and authorised fleet managers can track their vehicles, review usage history and manage vehicle security.

Fingerprint verification and driver authorisation operations are carried out to help ensure vehicles are used only by authorised persons.

In this context, drivers’ first name, surname, phone number, user ID, vehicle pairing details and data relating to biometric verification processes may be processed.

The fingerprint verification system is used to add a further verification layer to existing vehicle security, not to replace the vehicle key.

Biometric data is treated as special category personal data under the UK GDPR. Processing it requires a valid lawful basis under Article 6 of the UK GDPR and a suitable additional condition for processing under Article 9.

Vehicle security data is processed to help detect events such as vehicle theft, unauthorised use, towing or interference with security devices.

In this context, records relating to ignition status, vehicle movements, device removal, engine immobiliser operations, unrecognised fingerprint attempts and other security events may be used.

The purpose of these operations is to make vehicle owners aware of security threats and to provide additional protection against unauthorised vehicle use.

Alarm and notification data is processed to inform authorised users about security events involving their vehicles.

In this context, vehicle towing alarms, device tampering, suspected GPS/GSM jamming, unauthorised use attempts, biometric verification errors and possible accident notifications may be assessed.

Users may be informed of security events by mobile app notification, SMS, email or automated voice call.

The user contact details, vehicle identifiers, event types and related time records needed to generate and deliver notifications may be processed.

Driving and vehicle usage data is processed to assess how vehicles are used, review past journeys and support fleet management.

In this context, vehicle speed, driving time, distance covered, ignition status, movement and stop durations and the driving events the system can detect may be analysed.

This information is used to prepare vehicle usage reports, display past journeys and manage operational processes.

If driving data is used to evaluate employee performance, this purpose must be notified to the people concerned separately and clearly.

User accounts and authorisation information are processed to provide secure access to the Rubikas platform and mobile apps.

In this context, user IDs, contact details, account status, user roles, vehicle access permissions and session security records may be used.

These operations ensure that users access only the vehicles and system features they are authorised for, protect account security and manage user permissions.

Technical device and connection data is processed to ensure that vehicle tracking devices, biometric verification modules and other security components work correctly.

In this context, device serial numbers, IMEI, SIM card and mobile network information, GPS connection status, software version, power status and technical error records may be used.

This data is processed to connect devices to the system, detect connection problems, resolve technical faults and ensure service continuity.

App and system usage information is processed so that the Rubikas mobile apps and the web-based vehicle tracking platform can perform their functions.

In this context, user sessions, app versions, device types, IP addresses, user preferences and records of operations performed on the platform may be used.

This information is processed so that users can view their vehicles, manage security settings, carry out driver authorisations and access the services securely.

Relevant data is processed to resolve technical problems users encounter, maintain devices and software, and increase the reliability of the services provided.

In this context, technical support requests, error records, device connection information, software versions and system performance information may be assessed.

This data is used to investigate technical problems, conclude support requests and improve the services.

Where possible, anonymous information or information that contains no personal data is preferred for service development activities.

System security data is processed to protect personal data against unauthorised access, unlawful use, loss, alteration or disclosure.

In this context, user login records, IP addresses, access permissions, failed session attempts and security events may be examined.

These operations are carried out to protect system security, detect suspicious activity and ensure that only authorised persons can access personal data.

Rubikas UK Limited may process personal data to meet obligations arising from applicable legislation, to assess lawful requests from competent public authorities and, where necessary, to exercise or defend legal rights.

In this context, relevant user information, transaction records, security events and other information needed for legal processes may be used.

Personal data is processed and shared only to the extent necessary for the legal obligation or legal process concerned.

Rubikas UK Limited keeps the personal data it controls for as long as necessary to achieve the purposes for which it was collected and to meet applicable legal obligations.

Retention periods are determined by the type of data, the purpose of processing, the nature of the service and the relevant legal requirements.

When the retention period ends or a valid deletion request is accepted, personal data is deleted or anonymised in accordance with applicable law.

Where Rubikas UK Limited acts as data controller, it processes personal data on a valid lawful basis under Article 6 of the UK GDPR that suits the processing activity concerned.

Depending on the nature of the processing, the following lawful bases may apply:

• Performance of a contract (Article 6(1)(b)): Processing necessary to perform a contract to which the data subject is party, or to take steps at their request before entering into one.
• Legitimate interests (Article 6(1)(f)): Activities such as protecting system security, preventing unauthorised access and ensuring service reliability, subject to the required balancing assessment.
• Legal obligation (Article 6(1)(c)): Processing necessary to meet legal obligations to which Rubikas is subject.
• Consent (Article 6(1)(a)): Specific processing activities based on valid consent given freely by the data subject.

Where biometric data is processed to uniquely identify or verify a person, a suitable condition for processing under Article 9 of the UK GDPR must also apply.

Explicit consent (Article 9(2)(a)) is one of the conditions that can be used where its requirements are met. However, the validity of explicit consent depends on the data subject having a genuine choice and being able to withdraw consent without suffering negative consequences.

The purpose, lawful basis and, where applicable, the special category data condition of each processing activity are determined before the activity begins.

Personal data is kept to provide vehicle tracking and security services, manage user accounts, identify authorised drivers, carry out biometric identity verification, investigate security events, provide technical support and meet legal obligations.

Data is not used for new purposes that are incompatible with the purposes it was collected for unless the necessary legal conditions are met.

Retention periods for personal data are determined taking into account the nature of the data, the purpose of processing, the requirements of the service, the relevant contracts and applicable legal obligations.

Where Rubikas acts as data controller, it keeps personal data only for as long as necessary.

Retention periods are reviewed regularly. When the purpose requiring the data to be kept no longer applies and there is no other valid reason for keeping it, the data is deleted or anonymised.

Information such as the first name, surname, phone number and email address of users and authorised drivers may be kept to manage user accounts, carry out driver authorisations and provide necessary service communications.

When a user account is closed or a driver’s authorisation is removed, it is assessed whether it is still necessary to keep this information.

Information for which there is no continuing legal obligation or other valid reason for retention is deleted or anonymised.

Vehicle registration plate, vehicle ID, GPS location, past routes, movement records, stop information and journey history may be kept to provide vehicle tracking and security services.

Because GPS location data can reveal detailed information about users’ movements and the places they visit, access to this data is limited to authorised users.

Location and route history is not kept for longer than necessary for the stated service purpose.

Information on vehicle speed, driving times, distances covered, ignition status, movement and stop durations and driving events detected by the system may be kept to display vehicle usage history and prepare the related reports.

These records are kept for as long as the vehicle tracking and fleet management services require.

When the retention period ends and there is no other valid reason for keeping them, records that are personal data are deleted or anonymised.

The Rubikas Vehicle Tracking and Biometric Security System uses fingerprint recognition technology to prevent unauthorised use of vehicles and to verify the identity of registered drivers.

Driver Registration Information

When a driver is registered in the system, the following information is collected through the Rubikas mobile app:

• First name and surname
• Phone number
• The unique driver ID (ID) assigned by the system

This information is stored in the Rubikas database and used to manage driver records, match identity details and provide vehicle security services.

Fingerprint Enrolment and Storage

Once the driver details have been saved in the system, the Rubikas server sends the relevant driver ID and the fingerprint enrolment instruction to the fingerprint device in the vehicle.

On this instruction the device switches to fingerprint enrolment mode. When the driver places their finger on the sensor, the biometric data is processed inside the device and linked to the relevant driver ID.

The fingerprint image and the biometric data created inside the device are not transferred to the Rubikas server. Biometric enrolment and matching take place inside the fingerprint device in the vehicle.

When enrolment is complete, the device notifies the server that the fingerprint record for the relevant driver ID has been created.

Driver Recognition by Fingerprint

When a registered driver scans their fingerprint, the device compares it with the records held inside the device.

When a match is made, the device sends the identified driver ID to the Rubikas server.

The Rubikas server matches the ID sent to it with the driver information in its database to identify the person concerned.

This information can be viewed by authorised users in the Rubikas mobile app and web management panel.

Confidentiality of Biometric Data

As this system works as described, the Rubikas server does not receive raw fingerprint images or biometric templates and does not store them in the central database.

The information sent to the server consists of the driver ID, notifications about enrolment status and system messages relating to the verification process.

Processing fingerprint data on the device does not mean this data falls outside the scope of the UK GDPR. Biometric data used for identification is treated as special category personal data and is subject to the relevant data protection obligations.

Records of vehicle towing alarms, device tampering, unauthorised use attempts, failed fingerprint verifications, suspected GPS/GSM jamming and other security events may be kept to investigate security events and provide the service.

These records are kept for as long as necessary to assess security events, investigate technical problems and, where needed, protect legal rights.

When the retention period ends and there is no other valid reason, records that are personal data are deleted or anonymised.

User account information, access permissions, user roles, vehicle pairings, driver authorisations and account security records are kept to manage user accounts and ensure system security.

When a user account is closed or an access permission is removed, it is assessed whether it is still necessary to keep the related information.

Closing an account does not mean that all records will be deleted automatically at the same time. Some records needed for security, legal obligations or the protection of legal rights may be kept for a limited period, provided there is an appropriate lawful basis.

Serial numbers of GPS tracking devices, IMEI information, mobile network connection records, device operating status, technical error records and connection history may be kept to manage devices and provide technical services.

This information is kept for as long as necessary to ensure the devices work correctly, resolve connection problems and investigate technical security events.

Technical records that are personal data are deleted or anonymised when the retention purpose ends and there is no other valid reason.

IP addresses, session records, user operation history, app error records and system access information created when the Rubikas website, web platform and mobile apps are used may be kept to ensure the services run securely and properly.

These records are kept for as long as necessary to protect user accounts, resolve technical problems, investigate security events and assess system performance.

For data obtained through cookies and similar tracking technologies, the purpose of the technology concerned, how long it is used and the applicable privacy rules are taken into account.

Personal data may be stored on servers and in data centres used by Rubikas, or in the technical infrastructure of service providers.

The countries where data is stored depend on the technical infrastructure of the service concerned and the data processing services used.

If personal data is transferred outside the United Kingdom, the international data transfer rules that apply under the UK GDPR and the necessary safeguards are taken into account.

Users are given the necessary information about the countries where data is stored, the service providers concerned and the applicable international transfer safeguards.

Where Rubikas acts as data controller, it applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, unlawful disclosure or other security threats.

Depending on the nature of the data and the risks involved, these measures may include limiting access permissions, secure communication methods, appropriate encryption, system security controls and managing authorised personnel’s access.

For special category personal data, additional protection measures proportionate to the risks involved are considered.

Personal data may be backed up to ensure service continuity in the face of system failures, data loss and technical problems.

Appropriate security measures are applied in backup operations to protect the confidentiality and integrity of the data.

The principle of limiting retention periods also applies to personal data held in backups.

Where data that should be deleted is held in backups, methods are applied that are technically appropriate for deletion or for securely removing it within the backups’ life cycle. Data held in backups is not reprocessed for ordinary use during this process.

When the purpose requiring personal data to be kept no longer applies and there is no other valid reason for retention, the data is deleted or anonymised.

Deletion is carried out taking into account the nature of the data, the medium it is stored on and the characteristics of the technical infrastructure.

Appropriate control and review processes are applied so that personal data that should be deleted is not kept unnecessarily.

After specific processing purposes end, personal data may, where appropriate, be anonymised.

Anonymisation must be carried out so that the person concerned can no longer be identified by methods reasonably likely to be used.

Merely removing the first name and surname, or replacing data with a user number, does not in every case amount to anonymisation.

Data that has been truly anonymised can be used for statistical analysis and service development to the extent it no longer constitutes personal data.

Under Article 17 of the UK GDPR, data subjects can request that their personal data be deleted where the applicable conditions are met.

Deletion requests are concluded after the data subject’s identity has been verified by appropriate means and the legal conditions of the request have been assessed.

For activities where Rubikas is the data controller, requests are, as a rule, answered within one month. Where the conditions set out in legislation apply, this period may be extended and the person concerned is informed.

Where Rubikas acts as data processor on behalf of a corporate customer, requests are handled in line with the data controller’s instructions and applicable legal obligations.

Keeping some personal data may be necessary under legislation in force, legal obligations, or to establish, exercise or defend legal rights.

In such cases, the data is kept only to the extent and for the period the retention reason concerned requires.

When the legal retention obligation or valid exception ends, the personal data is appropriately deleted or anonymised.

Personal data may be shared to provide vehicle tracking and security services, let authorised users access vehicle information, carry out fleet management operations, deliver security notifications, provide technical support and meet legal obligations.

Every instance of data sharing is limited to the stated purpose. The types of data shared are determined taking into account the recipients’ permissions and the requirements of the processing activity concerned.

Vehicle owners and users authorised in the system can access information about the vehicles assigned to them through the Rubikas mobile app or the web management panel.

In this context, vehicle location, past journeys, vehicle usage information, security alarms and the related driver information can be viewed according to permission level.

Access to personal data is limited to the vehicle and account permissions defined for users in the system.

Corporate customers and authorised fleet managers can access the relevant data in order to track the vehicles they manage, carry out driver authorisations and run fleet operations.

In this context, vehicle locations, driving history, vehicle usage records, driver pairings and security events can be viewed by authorised persons.

Where corporate customers determine the purposes and means of processing concerning their own employees or drivers, the customer concerned may act as data controller and Rubikas as data processor.

In such cases, data sharing and processing are carried out within the framework of the parties’ data protection responsibilities and the applicable contract terms.

Drivers’ first name, surname, phone number, the unique driver ID assigned by the system and vehicle authorisation information can be viewed by authorised users in order to manage driver records and check vehicle usage permissions.

Data may be exchanged between the necessary system components in order to pair driver information with vehicles, manage the biometric security system and identify authorised drivers.

Access to drivers’ personal information is limited in line with the relevant users’ duties and system permissions.

Vehicles’ real-time GPS locations, past routes, movement and stop records, speed information and journey history may be shared with users who have access permission for the vehicle concerned.

This information is used so that vehicle owners can track their vehicles, fleet managers can manage their operations and vehicle security events can be investigated.

GPS location and route data is personal data when it can be linked to an identified or identifiable driver.

Access to the data is therefore limited to the permission levels the service requires, and unnecessary data sharing is avoided.

In the Rubikas biometric vehicle security system, fingerprint enrolment and verification take place inside the fingerprint device in the vehicle.

When a driver is registered in the system through the mobile app, their first name, surname, phone number and unique driver ID are stored in the Rubikas database.

The Rubikas server sends the relevant driver ID and the fingerprint enrolment instruction to the biometric device in the vehicle.

When the driver places their finger on the sensor, the biometric data is processed inside the device and matched to the relevant driver ID.

Raw fingerprint images and the biometric templates created inside the device are not transferred to the Rubikas server and are not stored in the central database.

During fingerprint verification, when a match occurs the device sends the relevant driver ID to the Rubikas server. The server matches that ID to the registered driver information to identify the person concerned.

Authorised users can view the driver’s identity and the related authorisation information through the mobile app and the web management panel.

Processing biometric data on the device inside the vehicle does not mean this data falls outside the scope of the UK GDPR. Biometric data used for identification is treated as special category personal data under Article 9 of the UK GDPR.

Events relating to vehicle security may be sent to users with permission for the vehicle concerned and to notification recipients defined in the system.

In this context, vehicle towing alarms, device tampering notifications, unauthorised use attempts, failed biometric verifications, suspected GPS/GSM jamming and possible accident notifications may be shared.

Depending on the methods the system supports, security notifications may be delivered by mobile app notification, SMS, email or automated voice call.

The information shared is limited to the data needed to understand the security event and respond as required.

Rubikas may use certain service providers to deliver its vehicle tracking and biometric security services technically.

These services may cover software infrastructure, server management, technical maintenance, device connectivity, system security, error tracking and customer support.

Where a technical service provider needs access to personal data, access is limited to the information necessary to perform the service concerned.

With service providers that process data on behalf of Rubikas, the data processing contracts required under Article 28 of the UK GDPR and appropriate confidentiality and security arrangements are put in place.

Rubikas may use server, data centre and cloud infrastructure services to run the vehicle tracking and security platform, store personal data, create system backups and ensure service continuity.

In providing these services, user accounts, vehicle information, GPS records, driver information and technical system records may be processed on the infrastructure concerned.

Access to data and data processing activities are governed according to the service provider’s role, its contractual obligations and the applicable data protection legislation.

The countries where data is stored and international data transfers are described in the relevant section of the privacy policy.

Rubikas may use mobile notification, SMS and automated voice call services to deliver vehicle security notifications to users.

In this context, phone numbers, mobile notification identifiers, notification content, alarm types and technical information about delivering the notifications may be processed by the communication service providers concerned.

This data is used to deliver security alerts and service notifications to the relevant recipients.

The information shared with communication service providers is limited to the data needed to deliver the notification service.

Where required under applicable legislation, Rubikas UK Limited may share personal data with lawfully authorised public bodies, courts, regulators or law enforcement.

Such sharing may take place to meet valid legal obligations, respond to lawful requests or protect legal rights.

Each request is assessed in line with the relevant legal authority, necessity and the data minimisation principle.

Personal data is shared only to the extent the request lawfully requires.

Because of the technical infrastructure, cloud services or other service providers Rubikas uses, personal data may be transferred to countries outside the United Kingdom.

Such transfers must comply with the international data transfer rules that apply under the UK GDPR.

Where necessary, UK adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum or other appropriate safeguards provided for in legislation are applied.

Data subjects are given the necessary information about the countries to which data is transferred internationally, the recipient categories concerned and the transfer safeguards used.

When personal data is shared with third parties, Rubikas puts the confidentiality, integrity and security of the data first.

Access to personal data is limited to the persons and organisations needed to perform the service concerned.

Service providers acting as data processors are contractually required to process personal data only on valid instructions and to apply appropriate technical and organisational security measures.

Sharing activities are assessed taking into account the nature of the data, the purpose of processing and the security risks involved.

Rubikas UK Limited does not sell the personal data it obtains in connection with its vehicle tracking and biometric security services to third parties for commercial purposes.

Personal data may be shared only for specified purposes, such as providing the relevant services, carrying out security operations, running the technical infrastructure or meeting valid legal obligations.

Where personal data would be passed to third parties for advertising, marketing or other commercial purposes, the valid lawful basis and the applicable information or consent requirements for that activity are assessed separately.

In sharing personal data, Rubikas applies the lawfulness, transparency, purpose limitation and data minimisation principles of the UK GDPR.

Protecting the confidentiality of personal data processed in Rubikas systems is one of the core security principles.

Only persons authorised to carry out the relevant operations can access users’ identity and contact details, vehicle locations, driving histories, security records and driver authorisation information.

Personal data is not shared with third parties outside the stated processing purposes or without a valid lawful basis.

Appropriate access controls are applied in the Rubikas mobile app, web management panel and server infrastructure to prevent unauthorised access to personal data.

The aim is that users can access only the vehicles, drivers and system features defined for them.

Security controls suited to the risks are used to prevent and detect unauthorised access attempts.

Secure authentication and account management methods are applied to protect user accounts.

Appropriate technical measures are taken to protect user passwords, ensure session security and prevent unauthorised access to accounts.

Users are encouraged to choose strong passwords, not share their account details with third parties and report suspicious account activity.

In Rubikas systems, users’ access permissions are managed taking into account account types and the vehicles assigned to them.

Vehicle owners, fleet managers and other authorised users can reach only the information they have been granted access to.

When user permissions need to be changed or removed, the relevant access permissions are updated.

Reviewing access permissions regularly helps prevent unnecessary access to personal data.

Vehicles’ real-time GPS locations, past routes, movement records and driving information can reveal detailed information about people’s movements.

Access to GPS location and vehicle usage data is therefore limited to users with permission for the vehicle concerned.

Security measures suited to the nature of the data and the risks involved are applied when location data is transmitted, stored and viewed.

In the Rubikas biometric vehicle security system, fingerprint enrolment and verification take place on the fingerprint device inside the vehicle.

When a driver is registered in the system, their first name, surname, phone number and the unique driver ID generated by the system are stored in the Rubikas database.

The Rubikas server sends the driver ID and the fingerprint enrolment instruction to the biometric device in the vehicle concerned.

When the driver places their finger on the sensor, the fingerprint data is processed inside the device and linked to the relevant driver ID.

Raw fingerprint images and the biometric templates created inside the device are not transferred to the Rubikas server and are not stored in the central database.

Fingerprint verification takes place inside the device. When a match is made, the device sends the relevant driver ID to the Rubikas server.

The Rubikas server matches this ID to the registered driver information to identify the person concerned.

Processing biometric data on the device does not mean this data falls outside the scope of the UK GDPR. Biometric data used for unique identification is treated as special category personal data and is subject to the relevant protection obligations.

The GPS tracking devices and biometric verification devices used in vehicles are important components of the vehicle security system.

Appropriate technical security measures are assessed and applied to protect these devices against unauthorised use, tampering and security threats.

Matters such as the security of the devices’ data communication with the server, verification of device identities and blocking of unauthorised commands are addressed within the system’s security management.

Appropriate security methods are applied to data communication between the Rubikas mobile app, web platform, servers and vehicle devices, to prevent information from being intercepted or altered by unauthorised persons.

To protect data in transit, the security of communication channels, authentication mechanisms and encryption methods suited to the risks are taken into account.

Encryption and other security controls are assessed according to the nature of the data processed and the technical infrastructure used.

The servers and databases used in Rubikas systems are protected with appropriate technical and organisational measures so that personal data is processed and stored securely.

These measures may include limiting access permissions, system updates, security configurations, preventing unauthorised access and technical security controls.

Server and database security is assessed in line with the system’s technical characteristics and the risks present.

Appropriate security measures are applied in the Rubikas mobile app and web management panel to protect user information, ensure session security and prevent unauthorised operations.

Security risks are taken into account in developing, updating and operating the app and web platform.

Assessing identified vulnerabilities and making the necessary fixes is part of system security work.

Technical errors, unusual access attempts and security-related events in Rubikas systems may be recorded, depending on the system’s characteristics and the security controls applied.

These records may be used to detect security events, investigate technical problems and improve the necessary security measures.

Access to security records is limited to authorised persons, and records are kept in line with the set retention periods.

Events such as personal data being obtained by unauthorised persons, lost, altered, damaged or unlawfully disclosed may constitute a personal data breach.

When a personal data breach is suspected, Rubikas assesses the nature of the event, the types of data affected and the risks to the rights and freedoms of the people concerned.

Where a notification obligation arises under the UK GDPR, for processing in which it acts as data controller, the necessary notifications to the relevant supervisory authority are made, where possible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to the rights and freedoms of the people concerned, they are also informed as legislation requires.

Where Rubikas acts as data processor, personal data breaches are reported to the relevant data controller without undue delay.

Appropriate backup and recovery measures are applied in Rubikas systems to ensure service continuity in the face of loss of personal data, technical failures or unexpected system outages.

The confidentiality and integrity of personal data are taken into account in backup operations.

Access to backed-up data is limited to authorised persons, and backup retention periods are set in line with data protection principles.

Employees and authorised personnel at Rubikas who have access to personal data are expected to process it only for the purposes their duties require.

Access permissions to personal data are determined taking into account the duties and responsibilities concerned.

Personnel’s confidentiality obligations, data protection responsibilities and secure data processing practices are supported by appropriate organisational measures.

Rubikas may use third-party service providers for services such as server infrastructure, cloud services, mobile notifications, SMS, voice calls and technical support.

Where these service providers need to access personal data or process data on Rubikas’s behalf, security and confidentiality requirements suited to the nature and risks of the service concerned apply.

The necessary contractual arrangements are made with data processor service providers under Article 28 of the UK GDPR.

Third parties’ access to personal data is limited to the scope necessary to perform the service concerned.

Rubikas assesses the effectiveness of the technical and organisational measures used to protect the security of personal data in line with the system’s characteristics and the risks involved.

Updating security measures is considered in light of new security threats, technological developments, system changes and applicable legal requirements.

The security of personal data is taken into account not only when data is collected or stored but throughout the processing, transmission, sharing and deletion of data.

You have the right to find out for what purposes your personal data is collected, how it is used, how long it is kept and who it is shared with.

In this context, you can request information about your identity and contact details, GPS location records, vehicle usage information, driver authorisation records and biometric verification processes processed by Rubikas.

Where Rubikas acts as data controller, it provides the necessary privacy information.

Under Article 15 of the UK GDPR, you have the right to find out whether personal data about you is being processed and, if so, to request access to it.

Under this right, you can request a copy of the account information, driver records, vehicle usage history, GPS location data and personal data relating to security events that can be linked to you, subject to the applicable legal conditions.

The right of access cannot be exercised in a way that adversely affects the rights and freedoms of others. Where necessary, the request is met while protecting information relating to third parties.

Under Article 16 of the UK GDPR, you can request that inaccurate personal data held about you be corrected and incomplete information be completed.

For example, if your first name, surname, phone number or driver registration details are wrong or out of date, you can ask for them to be corrected.

For processing where Rubikas is the data controller, it assesses correction requests and makes the necessary updates.

Under Article 17 of the UK GDPR, you can request that your personal data be erased where the relevant legal conditions are met.

This right may apply where the data is no longer necessary for the purpose it was processed for, there is no valid basis for processing, or the other erasure conditions provided for in legislation are met.

For example, you can request that your driver record be removed, your user account be closed, or certain personal data about you be erased.

However, because of valid exceptions such as legal retention obligations or the protection of legal rights, some data may need to be kept for a further period.

In the Rubikas biometric vehicle security system, fingerprint records are created and processed inside the biometric device in the vehicle.

Raw fingerprint images and biometric templates are not transferred to the Rubikas server or stored in the central database.

Where the applicable legal conditions are met, a driver can request that their biometric record be deleted.

Such a request is assessed within the authority of the data controller concerned and the technical operation of the system. If the deletion request is accepted, the necessary action is taken to remove the biometric record from the device in the vehicle, or support is provided to the authorised data controller for this.

Because the driver’s identity and contact details are also held in the Rubikas database, deletion of the biometric record does not mean that this information will automatically be deleted in every case.

Under Article 18 of the UK GDPR, you can request that the processing of your personal data be restricted in certain situations.

For example, where you contest the accuracy of your personal data or there is a dispute about the lawfulness of the processing, you can ask for processing to be restricted within the relevant conditions.

When processing is restricted, the data is, apart from exceptions legislation allows, essentially held for storage only and other processing activities are limited.

Under Article 20 of the UK GDPR, where certain conditions are met, you may have the right to receive the personal data you have provided to Rubikas in a structured, commonly used and machine-readable format.

This right depends on certain conditions, such as the processing being based on consent or a contract and carried out by automated means.

Where technically feasible and subject to the applicable conditions, you can also request that the personal data concerned be transmitted directly to another data controller.

The right to data portability does not mean that all technical records or derived analyses held in Rubikas systems can be transferred automatically.

Under Article 21 of the UK GDPR, where your personal data is processed on the lawful bases of public interest or legitimate interests, you can object to the processing on grounds relating to your particular situation.

For processing where Rubikas is the data controller, it considers your objection and stops the processing concerned unless there are compelling legitimate grounds that legislation allows, or exceptions relating to legal claims.

Where your personal data is processed for direct marketing, you have the right to object to that processing at any time.

Where consent is the lawful basis for processing your personal data, you can withdraw the consent you have given at any time.

Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

Where a processing activity is based on a contract, a legal obligation or another valid lawful basis, the right to withdraw consent may not apply to that processing in the same way.

The lawful basis used for processing biometric data and the special category data condition under Article 9 of the UK GDPR are also taken into account.

Under Article 22 of the UK GDPR, you have the right to protection against certain decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

In the Rubikas system, vehicle use authorisation that depends on the result of biometric verification, or other automated security operations, may apply.

Whether such operations amount to an automated decision under Article 22 of the UK GDPR is assessed taking into account the nature of the decision and its effects on the person concerned.

Where Article 22 applies and automated decision-making is lawfully possible, the people concerned are given the safeguards and means of recourse that legislation requires.

GPS location information, vehicle movement history, driving records and route data are personal data when they are linked to an identified or identifiable person.

In relation to this data, you can exercise rights such as access, rectification, erasure, restriction of processing and objection, within the applicable conditions of those rights.

For driver data processed in corporate vehicles, the fleet operator or employer concerned may be the data controller.

In such cases, where Rubikas acts as data processor, it provides appropriate support to the data controller concerned in fulfilling data subject requests.

You can request information about the recipients, or categories of recipients, your personal data is shared with.

In this context, you can ask for information about the sharing of your personal data with authorised fleet managers, technical service providers, cloud infrastructure providers or, where legislation requires, competent authorities.

Where Rubikas acts as data controller, it provides the necessary explanations within the framework of the applicable UK GDPR obligations.

If your personal data is transferred to countries outside the United Kingdom, you have the right to information about those transfers and the appropriate data protection safeguards used.

Where international data transfers take place, Rubikas takes into account the transfer rules that apply under the UK GDPR.

Data subjects can request information about the transfer safeguards used, within the applicable conditions.

If you believe your personal data is being processed unlawfully or your data protection rights have been infringed, you can contact Rubikas UK Limited.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection supervisory authority.

ICO official website: https://ico.org.uk

Contacting the ICO does not remove any other administrative or judicial remedies you may have under legislation.

To exercise your rights regarding your personal data, you can contact Rubikas UK Limited through the contact channels set out in the privacy policy.

You may be asked to provide information that allows your request to be understood and the relevant records to be identified.

Where necessary and proportionate, Rubikas may ask for identity verification to prevent personal data from being disclosed to unauthorised persons.

Requests relating to activities for which corporate customers are the data controller may be referred to the data controller concerned or handled in line with the data controller’s instructions.

Where Rubikas UK Limited acts as data controller, it assesses data subjects’ requests relating to their data protection rights under the UK GDPR.

Requests are, as a rule, answered without undue delay and at the latest within one month.

Where necessary because of the complexity of the request or the number of requests, the response period may be extended by up to two months under the conditions set out in legislation. In that case the person concerned is informed of the extension and the reasons for it within the first month.

Data subject requests are, as a rule, handled free of charge. However, exceptions that legislation allows may apply to requests that are manifestly unfounded or excessive.

If a request is refused in whole or in part, the person concerned is given the necessary information about the reasons for the refusal and the legal remedies available.

You can contact Rubikas UK Limited on matters relating to the protection of personal data.

• Company name: Rubikas UK Limited
• Company registration number: 14332454
• Website: https://rubikas.co.uk
• Privacy policy: https://rubikas.co.uk/en/privacy
• Email address: [email protected]
• Postal address: 5th Floor, The Grange, 100 High Street, London, N14 6BN, United Kingdom

Where Rubikas acts as data processor on behalf of a corporate customer, the customer, as data controller, may be primarily responsible for handling the relevant personal data requests.

You can request information about which of your personal data Rubikas processes, what purposes it is used for, how long it is kept and who it is shared with.

Stating clearly in your request what you want to find out will help your request to be assessed correctly.

Information requests are assessed under the UK GDPR in line with the applicable conditions of the rights concerned.

You can request access to personal data held about you in Rubikas systems, or ask for inaccurate or incomplete information to be corrected.

These requests may cover user account information, first name and surname, phone number, driver records and other personal data that can be linked to you.

For processing where Rubikas is the data controller, it assesses requests and carries out the necessary actions.

Where the applicable conditions under the UK GDPR are met, you can request that your personal data be erased.

In this context, you can apply for your user account to be closed, your driver record to be removed or certain personal data to be erased.

Erasure requests are assessed taking into account legal retention obligations and other applicable exceptions.

Closing a user account does not mean that all the related personal data will be erased at the same time in every case.

In the Rubikas biometric vehicle security system, fingerprint enrolment and verification take place on the biometric device inside the vehicle.

Raw fingerprint images and biometric templates are not transferred to the Rubikas server or stored in the central database.

Drivers can apply to obtain information about their own biometric records or, within the applicable conditions, to request that their records be deleted.

Because biometric data is stored on the device inside the vehicle, carrying out the deletion may depend on the accessibility of that device and the technical operation of the system.

Where Rubikas acts as data processor, these requests are handled in line with the instructions of the data controller concerned.

You can request information about, or access to, GPS location records, past routes, driving information and vehicle usage history that can be linked to you.

Where the applicable legal conditions are met, you can also request that the personal data concerned be corrected, erased or its processing restricted.

For corporate vehicles, the employer or fleet operator concerned may be the data controller.

In such cases, to the extent that Rubikas acts as data processor, it provides appropriate support to the data controller concerned in assessing data subject requests.

If you believe your personal data has been used or shared without authorisation, or there has been a problem with data security, you can contact Rubikas.

Describing the nature of the incident and the system or service concerned in your report can help the matter to be assessed.

In security reports, you are advised not to share passwords, fingerprint images or unnecessary sensitive personal information.

Rubikas assesses reported security events in line with the risks involved and the applicable legal obligations.

To prevent requests about personal data being made by unauthorised persons or personal data being disclosed to the wrong people, identity verification may be requested where necessary.

During identity verification, information appropriate and necessary for the nature of the request is asked for.

The principle is that no unnecessary personal data is collected for identity verification and the security of the information received is protected.

Where Rubikas UK Limited acts as data controller, it responds to data subject rights requests under the UK GDPR, as a rule, without undue delay and at the latest within one month.

Where necessary because of the complexity of the request or the number of requests, this period may be extended by up to two months under the conditions legislation allows.

If the period is extended, the person concerned is informed of the extension and the reasons for it within the first month.

Requests are, as a rule, handled free of charge. However, exceptions that legislation allows may apply to requests that are manifestly unfounded or excessive.

If you have a complaint about the processing of your personal data, you can first contact Rubikas UK Limited.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection supervisory authority.

• Supervisory authority: Information Commissioner’s Office (ICO)
• Official website: https://ico.org.uk
• Complaint and contact information: https://ico.org.uk/make-a-complaint/

Your right to complain to the ICO does not depend on first contacting Rubikas. However, the ICO may advise you to contact the organisation concerned before making a complaint.

Any other administrative and judicial remedies you may have under legislation are reserved.

Rubikas UK Limited may update the Privacy Policy in line with developments in the scope of its services, the technologies used and its personal data processing activities.

Updates may cover vehicle tracking services, the processing of GPS location data, the biometric driver recognition system, mobile apps, the web management panel and the related technical infrastructure.

The purpose of the changes is to ensure that users have access to accurate and up-to-date information on how their personal data is collected, used, stored and shared.

The Privacy Policy may be updated because of changes in UK data protection legislation, in the guidance of the regulators concerned or in applicable legal obligations.

Rubikas assesses legal developments that affect data protection practices and makes the necessary policy changes.

These changes take into account the rights and obligations currently in force regarding the protection of users’ personal data.

The Privacy Policy may be updated if new features are added to Rubikas vehicle tracking and biometric security systems or existing features are changed.

These changes may relate to GPS tracking features, vehicle security alarms, driver recognition operations, biometric verification, mobile app functions and web platform services.

If a new feature changes how personal data is collected or processed, the necessary information about the processing activity concerned is provided.

If it is planned to use personal data for a purpose different from the existing processing purposes, the lawfulness of the processing concerned is assessed.

The lawful basis and other data protection conditions needed for the new purpose are determined.

Where required under the UK GDPR, the people concerned are given the necessary information before the new processing activity begins and, where applicable, their consent is obtained.

Updating the Privacy Policy does not by itself create a lawful basis for a new data processing activity.

As the services Rubikas provides are developed, changes may occur in the categories of personal data collected.

These changes may relate to user account information, vehicle and GPS records, driver authorisation information, security events or biometric verification processes.

When new categories of personal data need to be processed, the data minimisation and transparency principles are taken into account.

The people concerned are given the necessary explanations under applicable legislation.

In the Rubikas biometric vehicle security system, as currently described, fingerprint enrolment and verification take place on the biometric device inside the vehicle.

Raw fingerprint images and biometric templates are not transferred to the Rubikas server or stored in the central database.

When changes are planned to the method of processing biometric data, where it is stored, the verification process or how data is shared, the impact of the change on data protection is assessed.

New biometric data processing activities do not begin until the necessary legal conditions are met.

Users are given the necessary information under applicable legislation.

Rubikas may work with third-party service providers for server infrastructure, cloud services, mobile notifications, SMS, voice calls and technical support.

If service providers or categories of personal data recipients change, the relevant sections of the Privacy Policy are updated where necessary.

Where new service providers need to access personal data or process data on Rubikas’s behalf, appropriate contractual and technical security measures are assessed.

If there is a change in the countries where personal data is stored or processed, the lawfulness of the international data transfer concerned is assessed.

For transfers of personal data outside the United Kingdom, the transfer conditions and appropriate safeguards required under the UK GDPR are taken into account.

Where there are significant changes to the countries transferred to or the data protection safeguards used, the Privacy Policy is updated and the necessary information is provided.

If changes are made to the Privacy Policy that significantly affect the processing of users’ personal data or their data protection rights, the people concerned are informed by appropriate means.

Depending on the nature of the change, notification may be given through a website announcement, a mobile app notification, email or other appropriate communication channels.

Where the law requires prior notification, the relevant notices are given before the new data processing activity begins.

The current version of the Privacy Policy is published on Rubikas’s official website.

Users can access the current Privacy Policy at the following address: https://rubikas.co.uk/en/privacy

The updated text is presented so that users can easily find the current explanations about the processing of personal data.

To make updates to the Privacy Policy traceable, the date of the last update is stated.

Where considered necessary, policy version information and explanations of significant changes may also be published.

This information lets users understand when the policy was updated and the scope of the changes concerned.

Users can contact Rubikas UK Limited about changes made to the Privacy Policy or about current practices relating to the processing of their personal data.

Requests can be sent through the channels set out in the contact section of the Privacy Policy.

Where Rubikas is the data controller, it assesses requests for information about the processing of personal data under applicable data protection legislation.

The rights users have under the UK GDPR are protected under the legislation in force, regardless of changes made to the Privacy Policy.

Depending on the services used, Rubikas may process personal data such as first name, surname, phone number, user account information, vehicle information, GPS location records, driving history, security alarms and technical connection records.

For the biometric driver recognition service, this may include driver identity details and fingerprint data processed on the device in the vehicle.

The data collected is limited to what the services require and to the stated processing purposes.

Depending on the operating status of the vehicle’s tracking device, connection conditions and the service configuration, the Rubikas vehicle tracking system may receive the vehicle’s location information at set intervals.

Vehicle locations are processed so that authorised users can view them through the mobile app or web management panel.

The collection and storage of vehicle tracking data depend on the features of the service concerned and the applicable data protection conditions.

Vehicle location information can be viewed by users who have access permission for the vehicle concerned.

These may be the vehicle owner, authorised users or, for corporate vehicles, authorised fleet managers.

Access to location data is limited according to the user and vehicle permissions defined in the system.

Depending on the features of the service used, Rubikas may keep vehicles’ past routes, journey dates, movement and stop durations, distances covered and other driving information.

These records may be used to display vehicle usage history, investigate security events and provide fleet management services.

Data is kept in line with the set retention periods or the criteria that determine them.

No. In the Rubikas biometric vehicle security system, fingerprint enrolment and verification take place inside the biometric device in the vehicle.

Raw fingerprint images and biometric templates are not transferred to Rubikas servers or stored in the central database.

When verification succeeds, the device sends the relevant driver ID to the Rubikas server. The server matches this ID with the registered driver details to identify the authorised driver.

Processing biometric data inside the device does not mean this data falls outside the scope of the UK GDPR. This data is protected as special category personal data.

When a driver is registered in the system through the Rubikas mobile app, a unique driver ID is assigned to them.

The Rubikas server sends this ID and the fingerprint enrolment instruction to the biometric device in the vehicle.

When the driver places their finger on the sensor, the fingerprint data is processed inside the device and linked to the relevant driver ID.

When enrolment is complete, the device reports the result to the Rubikas server.

When a registered driver scans their fingerprint, the device carries out verification internally.

When a match is made, the relevant driver ID is sent to the Rubikas server.

The server matches this ID with the driver information in its database to identify the person concerned.

The raw fingerprint image or biometric template is not sent to the server.

Because, in the system architecture Rubikas describes, raw fingerprint images and biometric templates are not held on a central server, no access to this data is offered through the mobile app or the web management panel.

Biometric data is processed inside the device in the vehicle.

That said, appropriate technical security measures need to be applied to protect biometric data stored on the device.

Yes. Where the applicable conditions under the UK GDPR are met, you can request that your biometric record be deleted.

Because the fingerprint record is held on the device in the vehicle, deletion is carried out on that device.

Where Rubikas acts as data processor, the request is assessed in line with the data controller’s instructions.

Removing driver information from the Rubikas database and deleting the biometric record held on the device in the vehicle are technically separate operations.

Where both records need to be removed, it is therefore necessary to confirm that both deletions have been completed.

Whether automatic deletion takes place depends on the system’s current technical configuration.

Your phone number may be used to manage driver records, provide necessary service communications and, depending on the system configuration, deliver security notifications.

The processing of your phone number is limited to the stated purposes and the applicable legal conditions.

Where necessary to provide the services, Rubikas may share personal data with authorised users, the corporate customers concerned and technical service providers.

This sharing is limited to the information needed to carry out the service concerned.

Personal data may also be shared with competent authorities under valid legal obligations.

Under Rubikas’s policy of not selling personal data to third parties for commercial purposes, user data is not shared for sale.

However, data processing needed to provide server, communication and technical infrastructure services may be carried out.

Such service arrangements do not amount to selling personal data.

The countries where personal data is stored depend on the server and service provider infrastructure Rubikas uses.

If data is transferred outside the United Kingdom, the international data transfer rules that apply under the UK GDPR and the necessary safeguards are taken into account.

You can request information about the countries where data is processed and the transfer safeguards concerned.

Personal data is kept for as long as necessary for the processing purposes, taking into account applicable legal retention obligations.

Retention periods may vary depending on the type of data and the requirements of the service concerned.

When the retention purpose ends and there is no other valid reason for retention, the data is deleted or anonymised.

If your account is closed, it is assessed whether it is still necessary to keep your personal data.

Data that no longer needs to be kept is deleted or anonymised.

However, for valid reasons such as legal obligations or the protection of legal rights, some records may need to be kept for set periods.

For corporate vehicles, fleet managers with access permission for the vehicle concerned can access information such as vehicle location, journey history, driving records and driver pairings.

This access takes place within the framework of the corporate customer’s data controller responsibility and the permissions defined in the system.

Monitoring of employees or drivers must comply with applicable data protection and employment law obligations.

Vehicle security alarms may be sent to users or contact persons authorised to receive notifications for the vehicle concerned.

Depending on the features the system supports, notifications may be delivered by mobile app notification, SMS, email or automated voice call.

These notifications are used so that the security event can be understood and the necessary action taken.

Yes. Under the UK GDPR, you have the right to access your personal data and to request that inaccurate or incomplete information be corrected.

Requests are assessed within the applicable legal conditions of the right concerned.

For processing where corporate customers are the data controller, requests may be referred to the data controller concerned.

Under the UK GDPR, where certain conditions are met, you can object to the processing of your personal data or request that its processing be restricted.

The scope of the right to object depends on the lawful basis on which the data is processed.

You can object at any time to personal data processing carried out for direct marketing.

You can contact Rubikas UK Limited with questions about the processing, storage, sharing or deletion of your personal data.

You can send your requests through the contact channels set out in the “How Can You Contact Us?” section of the Privacy Policy.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection supervisory authority.

ICO: https://ico.org.uk

Where Rubikas acts as data controller, it responds to data subject rights requests under the UK GDPR, as a rule, without undue delay and at the latest within one month.

Where necessary because of the complexity of the request or the number of requests, this period may be extended by up to two months under the conditions legislation allows.

If the period is extended, the person concerned is informed within the first month.