Data Protection Impact Assessment (DPIA)
Effective Date
Last Updated: 3/18/2026
Last Reviewed: 3/18/2026
Public Notice
This is a public summary of our Data Protection Impact Assessment. A more detailed version is available upon request to our Data Protection Officer at [email protected].
This Data Protection Impact Assessment (DPIA) has been conducted in accordance with GDPR Article 35 to assess the privacy risks associated with our GPS tracking and route optimization processing activities. This document outlines the nature of our data processing, associated risks, and the measures we have implemented to protect your privacy.
DPIA Summary
This Data Protection Impact Assessment confirms that Routemizer's GPS tracking and route optimization processing activities comply with GDPR requirements. While GPS tracking represents a high-risk processing activity, we have implemented comprehensive safeguards to protect your privacy, including explicit consent, data minimization, automatic deletion, and strong security measures.
1. Description of Processing Operations
Routemizer processes personal data to provide field service management and route optimization services. Our primary processing operations include:
Key Processing Activities:
- Real-time GPS Location Tracking: Continuous monitoring of field technicians' locations during active routes and working hours
- Route Optimization: AI-powered algorithms that analyze location data, task details, and constraints to generate optimal routes
- Performance Monitoring: Tracking task completion times, route adherence, and service delivery metrics
- Automated Decision-Making: ML-based predictions for maintenance scheduling and workload distribution
Data Processed:
- Personal identification (name, email, phone, employee ID)
- Precise GPS coordinates (latitude, longitude, accuracy, timestamp)
- Operational data (task assignments, completion status, time stamps, photos)
- Device information (IP address, device type, OS version)
- Usage data (login times, feature usage, error logs)
Data Subjects:
- Field Technicians: Primary subjects of GPS tracking and performance monitoring
- Managers: Users who create tasks, view reports, and manage teams
- Administrators: Users with full system access and configuration rights
- End Customers: Individuals receiving field services (addresses, contact info)
2. Necessity and Proportionality
Our processing operations are necessary and proportionate for the following reasons:
Business Necessity:
- GPS tracking is essential for route verification, proof of service delivery, and ensuring accountability
- Real-time location data enables dynamic route adjustments and emergency response
- Performance metrics are required for service quality assurance and SLA compliance
- Automated optimization reduces operational costs and environmental impact (fuel consumption, emissions)
Proportionality Measures:
- GPS tracking only occurs during active routes and within configured working hours (not 24/7)
- Location accuracy is limited to what's necessary for route verification (typically 10-50 meters)
- Data retention is limited to 90 days for GPS breadcrumbs (configurable per organization)
- Access to location data is restricted to organization administrators and the tracked technician
- Technicians can disable GPS tracking at any time (though this may affect route verification)
Legal Basis:
- Contractual necessity (employment or service contract)
- Explicit consent for GPS tracking (obtained before first use)
- Legitimate interest (operational efficiency, service quality, safety)
3. Risks to Data Subjects
We have identified the following privacy risks and their severity:
High Risk: Continuous Location Surveillance
Continuous GPS tracking could be perceived as invasive monitoring, potentially affecting technicians' privacy and autonomy.
Likelihood: Medium (data is collected systematically)
Severity: High (location data is sensitive personal information)
Overall Risk: HIGH
Medium Risk: Performance Profiling
Aggregation of performance metrics could lead to unfair profiling or discriminatory treatment based on productivity data.
Likelihood: Low (safeguards in place)
Severity: Medium (could affect employment)
Overall Risk: MEDIUM
Medium Risk: Data Breach
Unauthorized access to location data could reveal sensitive information about individuals' movements and routines.
Likelihood: Low (strong security measures)
Severity: High (location data is highly sensitive)
Overall Risk: MEDIUM
Low Risk: Scope Creep
Processing could expand beyond stated purposes without proper consent or transparency.
Likelihood: Very Low (strong governance)
Severity: Medium
Overall Risk: LOW
4. Measures to Address Risks
We have implemented comprehensive technical and organizational measures to mitigate identified risks:
Technical Safeguards:
- Data Encryption: TLS 1.3 for data in transit, AES-256 encryption for data at rest
- Access Controls: Role-based permissions with multi-factor authentication for administrators
- Data Minimization: GPS tracking only during active routes (configurable interval, typically 60 seconds)
- Automatic Deletion: GPS breadcrumbs auto-deleted after 90 days (GDPR compliance)
- Audit Logging: All access to sensitive data is logged and monitored
- Infrastructure Security: AWS cloud with SOC 2 compliance, regular security audits
- Anonymization: Analytics use aggregated, anonymized data where possible
Organizational Safeguards:
- Explicit Consent: Technicians must consent to GPS tracking before first use (can withdraw anytime)
- Transparency: Clear privacy notices explain what data is collected and why
- Purpose Limitation: Data used only for stated purposes (route optimization, verification)
- Data Processing Agreements: All third-party processors (AWS, Google, Sentry) have signed DPAs
- Privacy Training: All employees receive GDPR training and sign confidentiality agreements
- Incident Response: 24-hour breach notification process with incident response team
- Regular Reviews: DPIA reviewed annually and after significant processing changes
- DPO Oversight: Dedicated Data Protection Officer monitors compliance
User Control Mechanisms:
- GPS Toggle: Technicians can disable GPS tracking in mobile app settings
- Data Access: Users can request full export of their personal data
- Data Deletion: Users can request deletion of their data (subject to legal obligations)
- Consent Withdrawal: Users can withdraw GPS consent at any time
- Privacy Dashboard: Settings page shows all consents and allows granular control
5. Stakeholder Consultation
We have consulted with the following stakeholders during the DPIA process:
- Data Protection Officer: Reviewed assessment for GDPR compliance
- Field Technicians: Sample interviews conducted to understand privacy concerns
- Management: Confirmed business necessity and proportionality of processing
- Legal Counsel: Verified legal basis and contractual obligations
- IT Security: Assessed technical safeguards and infrastructure security
Key Feedback Incorporated:
- Technicians requested ability to disable GPS → Implemented toggle in mobile app
- Concern about 24/7 tracking → Limited to working hours and active routes only
- Data retention concerns → Implemented automatic 90-day deletion
- Access transparency → Added audit logs and privacy dashboard
6. Data Subject Rights
Data subjects have the following rights under GDPR:
- Right of Access (Article 15): Request copy of personal data in portable format
- Right to Rectification (Article 16): Correct inaccurate or incomplete data
- Right to Erasure (Article 17): Request deletion of data ("right to be forgotten")
- Right to Restriction (Article 18): Limit processing of data in certain circumstances
- Right to Data Portability (Article 20): Receive data in machine-readable format
- Right to Object (Article 21): Object to processing based on legitimate interests
- Rights Related to Automated Decision-Making (Article 22): Request human review of automated decisions
- Right to Withdraw Consent (Article 7): Withdraw consent at any time
- Right to Lodge Complaint: File complaint with supervisory authority (e.g., ICO, CNIL)
How to Exercise Rights:
- Email: Contact our Data Protection Officer at [email protected]
- Account Settings: Use privacy dashboard in application settings
- Response Time: We respond to requests within 30 days (extendable to 60 days for complex requests)
- No Fee: Exercising your rights is free (except for manifestly unfounded or excessive requests)
7. International Data Transfers
Your data may be transferred outside the European Economic Area (EEA):
International Transfers:
- AWS Infrastructure: Data stored in eu-west-3 (Paris) region, but AWS may transfer for operations
- Google Services: Maps and geocoding APIs (Google has EU-US Data Privacy Framework certification)
- Sentry (USA): Error monitoring with anonymized data only (Standard Contractual Clauses in place)
Transfer Safeguards:
- Standard Contractual Clauses (SCCs): Approved by European Commission for non-EEA transfers
- Data Processing Agreements (DPAs): All processors sign DPAs with appropriate security obligations
- Adequacy Decisions: Transfers to countries with adequacy decisions where applicable
- Encryption: All data encrypted in transit and at rest, regardless of location
8. Review and Update Process
This DPIA is reviewed and updated regularly:
Review Frequency: Annually or when significant changes occur to processing operations
Review Triggers:
- New processing activities or purposes
- Changes to data categories or data subjects
- New technologies or processing methods
- Security incidents or data breaches
- Changes in legal or regulatory requirements
- Stakeholder feedback or complaints
Documentation: All DPIA reviews are documented with date, reviewer, and changes made
Approval: DPO must approve all significant changes to processing operations
9. Conclusions and Recommendations
Based on this assessment, we conclude:
- Residual Risk Level: MEDIUM (after mitigation measures applied)
- Compliance Status: COMPLIANT with GDPR Article 35 requirements
- Proportionality: Processing is necessary and proportionate to legitimate business needs
- Safeguards: Appropriate technical and organizational measures are in place
Ongoing Recommendations:
- Continue annual DPIA reviews and update as processing evolves
- Monitor effectiveness of GPS tracking controls and gather ongoing feedback
- Explore additional anonymization techniques for analytics data
- Conduct regular penetration testing and security audits
- Provide ongoing GDPR training for all staff with data access
- Consider implementing Privacy-Enhancing Technologies (PETs) as they mature
DPIA Approval:
Approved by Data Protection Officer
Approval Date: 3/18/2026
Next Review Date: 3/18/2027
10. Contact Information
For questions, concerns, or requests regarding this DPIA:
Company: Routemizer
Data Protection Officer (DPO):
Email: [email protected]
Response Time: We aim to respond within 5 business days
Supervisory Authority:
You have the right to lodge a complaint with your local data protection authority if you believe we have not adequately addressed your concerns.
Request DPIA Copy: You may request a detailed copy of this DPIA by contacting our DPO.
Disclaimer
This DPIA is a living document and may be updated as our processing activities evolve. Material changes will be communicated to affected data subjects in accordance with GDPR requirements.