Privacy Policy of NexOpt GmbH
Information on the processing of personal data pursuant to Art. 13 GDPR – website, app, contact requests and fleet management system.
1. General Information
Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States and other data protection provisions is:
NexOpt GmbH
Betriebsstraße 21
4224 Wartberg ob der Aist, Austria
Phone: +43 7236 218 218
Email: info@nexopt.com
Website: www.nexopt.com
Data protection contact
For questions about data protection and to exercise your rights, please contact our data protection coordinator:
Hubert Eder, Data Protection Coordinator
NexOpt GmbH, Betriebsstraße 21, 4224 Wartberg ob der Aist
Email: datenschutz@nexopt.com
Processors
For certain processing activities we use external service providers (processors pursuant to Art. 28 GDPR). They have been carefully selected, are contractually bound by our instructions and are regularly audited. This applies in particular to Google LLC for the delivery of push notifications and the analysis of the use of our app (see next section). We operate the website and all other processing activities on our own server infrastructure in Austria.
Transfers outside the EEA
In the following cases we transfer data to recipients based outside the European Economic Area (EEA):
- Google LLC (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, processes data from our app on our behalf. The data transferred are device identifiers and information on how frequently the app is used. The purpose is the delivery of push notifications (performance of a contract, Art. 6(1)(b) GDPR) and the analysis of app usage (consent, Art. 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021)).
Transfers to the USA are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. The data are deleted as soon as they are no longer required for the stated purposes.
Important: All other data, such as recorded GPS tracks or saved start/destination routes, are not shared with Google.
2. Fleet Management System and Driver App
As part of our fleet management system, digital logbook and telematics, we process personal data – such as driver and vehicle data, trips and location data – on behalf of our customers. The controller for this processing is the respective customer company. NexOpt acts as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement and exclusively in accordance with the customer’s instructions.
These data are processed exclusively within the EU on our own servers in Austria and are not used by NexOpt for its own purposes. Information on the purpose, legal basis and storage period, as well as on how to exercise your rights, is available from the respective controller, usually your employer. Requests mistakenly addressed to us will be forwarded to the controller without delay.
3. Website and Related Data Processing
Provision of the website and creation of log files
Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data are collected:
- Information about the browser type and version used
- Language and version of the browser software
- The user’s operating system and its interface
- The user’s IP address
- Date and time of access and time zone difference to Greenwich Mean Time (GMT)
- Amount of data transferred
- Websites from which the user’s system reaches our website
- Websites accessed by the user’s system via our website
- Access status/HTTP status code
These data are also stored in our system’s log files.
Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is our legitimate interest pursuant to Art. 6(1)(f) GDPR.
Purpose of data processing
The temporary storage of the IP address by the system is necessary to deliver the website to your computer. For this purpose, your IP address must remain stored for the duration of the session.
Storage in log files takes place to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our IT systems. The data are not analysed for marketing purposes in this context.
These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.
Storage period
The data are deleted or anonymised as soon as they are no longer required for providing the website, at the latest at the end of the respective session.
Log files are deleted after 90 days. The data are not stored beyond this in a form that allows the data subjects to be identified.
Recipients
These data are processed via our server infrastructure.
Use of cookies
Definition of cookies
Cookies are small text files that are stored in your browser. They are downloaded by the browser on your first visit to our website. When you visit this website again with the same device or browser, the cookie and the information stored in it are sent back either to the website that created it (first-party cookie) or to another website to which it belongs (third-party cookie). This makes it possible to recognise that the website has already been accessed with that browser and to adapt the display of content accordingly. Cookies “remember”, for example, preferences, provide information on how a page is used and in some cases tailor the offers displayed to the individual user.
Strictly necessary cookies
We use technically necessary cookies to transmit messages and provide the services you request. The associated data processing is based on our legitimate interest in providing a fully functional website (Art. 6(1)(f) GDPR, Section 165(3) TKG 2021). No consent is required for these cookies.
Analytics cookies
In addition, we use cookies for analytics purposes that help us improve our website and our services. These cookies are only set with your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). The IP address is anonymised by truncation, which rules out any direct personal reference. If the “Do Not Track” setting is enabled in your browser, such cookies are not set.
You can withdraw your consent at any time with effect for the future by changing your cookie settings or deleting the cookies in your browser.
Cookie settings in your browser
If you wish to block or restrict cookies entirely, you can do so in the settings of your web browser. Cookies that have already been stored can be deleted at any time. If cookies are disabled for our website, some functions of the website may no longer be fully available.
How to manage and delete cookies is described in the help function of the respective browser, for example Mozilla Firefox, Google Chrome, Apple Safari or Microsoft Edge.
Contact requests via form, email or telephone
Purpose
You can reach us via the contact form on nexopt.com, by email or by telephone. In doing so, we process your name, your contact details such as your email address, your request including your message and, where applicable, data from uploaded or attached documents. The purpose is to respond to your request.
Legal basis
If your request relates to the conclusion or performance of a contract, the processing is carried out to take pre-contractual steps or to perform the contract (Art. 6(1)(b) GDPR). In all other cases, it is based on our legitimate interest in communicating with prospective customers, customers and website and app users (Art. 6(1)(f) GDPR).
Storage / deletion
NexOpt deletes or anonymises personal data as soon as they are no longer required for the purposes for which they were collected and no other legal obligations require further storage. Retention obligations arise in particular from commercial and tax law. In addition, NexOpt retains personal data that are necessary for the assertion, exercise or defence of legal claims in administrative or court proceedings. In such cases, the data are retained until the expiry of the relevant limitation periods or until the final conclusion of the proceedings.
Recipients
The data are processed via our server infrastructure.
4. Your Rights as a Data Subject
The General Data Protection Regulation (Regulation (EU) 2016/679) grants you the following rights. Please note that certain rights may be mutually exclusive – for example, you can request either the rectification or completion of data or their erasure, but not both.
Withdrawal of consent
Where NexOpt processes personal data on the basis of your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Right of access
You may request information as to whether and which personal data NexOpt processes about you, in particular regarding their origin, categories, storage period, recipients, purpose and type of processing.
Right to rectification and erasure
If data about you are incorrect or incomplete, you may request their rectification or completion. You may also request the erasure of your data, provided that no other legal obligations require their storage and we do not need the data in the individual case for the establishment, exercise or defence of legal claims.
Right to restriction of processing
If it is unclear whether the data processed about you are correct and complete or are being processed lawfully, you may request that processing be restricted until the matter has been finally clarified.
Right to object
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time and without giving reasons.
Right to data portability
You may receive data that you have provided to us yourself and that we process automatically on the basis of your consent or for the performance of a contract in a structured, commonly used and machine-readable format. You may also request that we transmit these data directly to another controller, where technically feasible and provided that the rights of third parties are not affected.
Right to lodge a complaint
If you believe that the processing of your personal data infringes the General Data Protection Regulation, you may lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, website: www.dsb.gv.at.
Automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
Provision of your data
The provision of your data is neither required by law nor by contract. However, without your contact details we cannot respond to your request.
Contact for exercising your rights
To exercise your rights, please contact our data protection coordinator in writing – by letter or email – at datenschutz@nexopt.com or at the address stated above.
5. General
We reserve the right to amend this privacy policy in compliance with the applicable data protection regulations. The version published on this page applies. If you have any questions about this privacy policy, please contact us at datenschutz@nexopt.com.
Data security
We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. Data transmitted between your browser and our website are encrypted.
Use of non-personal data
We use non-personal, anonymised data for statistical purposes, for the further development of our products and to improve the user experience. Data that we process on behalf of our customers are used exclusively in accordance with their instructions and not for our own purposes.
Third-party websites
This privacy policy does not apply to third-party websites that are not operated or controlled by us, even if they are referred to via links on this website. Please refer to the privacy notices of the respective providers.
Last updated: 18 September 2026