Privacy policy
How personal data is used on the Netfleet website and platform, and how to exercise your rights.
Last updated:
Service provider: JOPA Studio
Rue du relais 10, 1370 Jodoigne, Belgium
BE0717537506
contact@jopa.studio1. Who is responsible for your data?
Netfleet is provided by JOPA Studio, Rue du relais 10, 1370 Jodoigne, Belgium, enterprise/VAT number BE0717537506. Contact contact@jopa.studio for service, contractual or privacy requests. JOPA Studio is the controller for website enquiries, account administration, its own subscription billing and service security.
For passenger, customer, driver and employee records entered by a coach operator, that operator determines the purposes of processing and is the controller. Netfleet processes those records on the operator’s instructions under a data processing agreement (DPA). For a booking or transport-related request, contact the operator named on your booking first.
2. Data, purposes and legal bases
Contact and demo forms collect your name, email and the company, phone, fleet size and message you choose to provide. We use these to answer your request and take steps towards a contract, or for our legitimate interest in responding to business enquiries. Submitting a form does not subscribe you to marketing.
Account data includes identity, email, password hash, verification and session information, company memberships and roles. We use it to provide contracted access. Billing contacts, subscription and payment references support contract performance and legal accounting obligations. For staff of a business customer, our legitimate interest is administering that business relationship.
Technical connection information, security events and audit records help operate the service, investigate failures and prevent misuse, based on our legitimate interest in protecting it. Optional website analytics requires your choice to allow it. Where consent is used, you may withdraw it without affecting earlier lawful processing.
Workspace records may include contact details, bookings, journeys, assignments, invoices, driver qualifications and uploaded documents. The operator determines the applicable legal basis and must give its own privacy information. Do not enter unnecessary health information or other sensitive data.
3. Recipients and international transfers
JOPA Studio uses OVHcloud infrastructure to host Netfleet in the European Union. Access is limited to authorised workspace users, personnel who need it for their duties and providers needed for the services used. We do not sell personal data or use customer workspace data for advertising.
Optional services may involve additional recipients: journey locations for route calculation, email addresses and message content for email delivery or a connected mailbox, transaction details for a payment provider, and minimised technical information for diagnostics. Plausible receives public website pageviews only when configured and you allow analytics. Activating an integration does not authorise unrelated uses of your data. Payment and mailbox providers may also act as independent controllers under their own notices.
OVHcloud is the infrastructure provider identified in the DPA. Before adding another processor for customer data, we provide its identity, purpose, processing locations and relevant transfer safeguards under the DPA notice procedure. An EU hosting location does not by itself exclude support access or onward transfers outside the EEA. Such transfers require an applicable adequacy decision or other lawful mechanism, including standard contractual clauses and additional safeguards where necessary. Contact contact@jopa.studio for the list applicable to your service or a copy of the relevant safeguards.
4. Retention, export and deletion
The following maximum periods apply to data held by JOPA Studio for the stated purposes. They are retention commitments administered through scheduled reviews and the controlled deletion process; not every category is deleted automatically by the application. We delete earlier when data is no longer needed or a valid rights request requires it. A documented legal obligation or actual dispute may require limited, access-restricted preservation until that obligation or dispute ends.
Workspace owners can export records and stored documents and request deletion in company settings. A deletion request makes the workspace read-only and unpublishes its booking site. We allow 30 days for export and cancellation of the deletion request, then review retention and complete deletion from active systems by day 60 after the effective end of the service or a confirmed deletion request. Requests needing faster action under data protection law are handled individually. Shared accounts and subscriptions are separate: we coordinate any necessary subscription closure and preserve access to other companies.
Residual backup copies are isolated from ordinary use and expire within 35 days after deletion from active systems. If a backup is restored, completed deletions must be reapplied before ordinary access resumes. The operator remains responsible for its own statutory records and must export what it needs; JOPA Studio’s accounting retention is not a reason to keep the operator’s entire workspace.
| Category | Maximum retention / starting point |
|---|---|
| Enquiries and unsuccessful demo requests | 12 months after the last meaningful exchange |
| Ordinary support correspondence | 24 months after the request is closed |
| Technical access, security and error logs | 90 days after the event, unless needed for a documented incident |
| Workspace records, documents and workspace audit trail | While the service is used; deletion from active systems by day 60 after service end or confirmed deletion request, following a 30-day export/grace period |
| User account and membership data | While needed for active companies; remove or anonymise within 30 days of a valid account-erasure request, subject to legal exceptions |
| JOPA Studio’s invoices and tax-supporting records | 10 years following the relevant taxable period; longer only when specifically required by law |
| Minimum evidence of the contract, acceptance and disputes | 10 years after the contract ends; restrict any longer preservation to an actual unresolved claim |
| Residual backups of deleted data | Up to 35 additional days after deletion from active systems |
5. Your rights and how to use them
Depending on the processing and applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent by emailing contact@jopa.studio. We may request proportionate identity information to protect your data. We normally respond within one month; any permitted extension, up to two additional months, is explained within the first month.
For information controlled by an operator, address the request to that operator; Netfleet assists it under the DPA. You may complain to the Belgian Data Protection Authority or the supervisory authority where you live or work or where the alleged infringement occurred.
Information needed for an account or booking is necessary to provide that service; optional form fields can be left blank. Netfleet’s cost and driving-time tools support the operator’s decisions. They do not replace human assessment or independently decide your legal rights.
6. Changes to this notice
The date above identifies this version. Material changes to purposes, recipients or your choices should be communicated before the new processing begins, with renewed consent where required.