Privacy notice
1. Who processes your data
Routevance is a service of SNJ Media Studio S.r.l., Via Serviliano Lattuada 26, 20135 Milan, Italy, VAT number IT04886260969 ("SNJ" or "we"). For any question about your data, write to privacy@snjmediastudio.com.
This notice covers the data we process as controller: the data of people who visit this website and its login and sign-up pages, register a company, hold an account or contact us for support.
We process the data a customer company enters in Routevance for its work (its technicians, its clients, its jobs) on that company's behalf; the company is the controller. If you are a technician or an end client of a company that uses Routevance, the privacy notice that applies to you is that company's. If the company has added the link, you will find it under "Privacy notice" on the pages to follow and rate the job and in the email with the job certificate. Otherwise, ask the company.
2. What data we process and why
| When | Data | Why | Legal basis |
|---|---|---|---|
| A company signs up on the website | company name, first and last name, email, branch name and address, industry, version of the Terms accepted with date and time | create the account and activate the service | contract (Art. 6(1)(b) GDPR) |
| Purchase on AWS Marketplace | subscription identifiers received from AWS (licence, agreement, AWS account, plan and expiry), then the same data as at sign-up | activate the plan bought and follow renewals and cancellations | contract |
| Use of the account | username, email, role, date of last login, password stored only as a hash | give you access to the service | contract, for whoever signs up the company; legitimate interest of the customer company and ours in giving access to the users the company invites |
| Security | login attempts, active sessions (stored as hashes), activity log with the main operations (exports, anonymisations, account closure) and the IP address, server technical log with IP address, pages requested and, in some lines, username, email or addresses | protect accounts and reconstruct who did what | legitimate interest (Art. 6(1)(f) GDPR) and security obligations (Art. 32 GDPR) |
| Support | company name, username, email, phone if you give it, text of the request | answer the request | contract or pre-contractual steps |
| Visit to www.routevance.com | IP address, received by the AWS delivery network (CloudFront) only to deliver the pages; we keep no visit logs | show you the website | legitimate interest |
| Service emails | email address and message content (activation, invitations, password reset) | make the account work | contract |
Without the sign-up data we cannot create the account. We do not sell data and do not use it for advertising or profiling. No decision about you is made by automated means.
3. Where the data comes from
You enter it in the sign-up, login and support forms. For purchases on AWS Marketplace, part of the data comes from Amazon Web Services, which sends you to Routevance. Users invited by a company get their account from that company's administrator, who enters their name and email.
4. Who we share it with
With the providers we use to run the service, which act as our processors:
- Amazon Web Services EMEA SARL (Luxembourg): servers and database, backup copies, email sending, delivery of this website and management of subscriptions bought on AWS Marketplace;
- Google (Google Workspace): the support mailbox.
Data also reaches services that process it as independent controllers or as transmission channels:
- Google Maps Platform: on pages with maps or address fields, for maps, routes and address suggestions. When a page uses Google Maps, the browser downloads the script from Google's servers, which receive the device's IP address. Google processes this data as an independent controller, under its own privacy policy;
- browser push services (Google, Mozilla, Apple or Microsoft, depending on the browser): only if you turn on notifications, they receive the device's subscription address and the encrypted message;
- MET Norway (the Norwegian Meteorological Institute, a public body): for the weather in the technicians' app it receives the branch coordinates from our server, rounded to about one kilometre, and no technician data. It keeps its access logs in Oslo, under its own privacy policy.
The providers that process customer companies' data are listed in Annexes B and C of the Terms of use. We disclose data to authorities only when the law requires it.
5. Where the data is stored
Servers, database, backup copies and email sending are in the AWS Frankfurt region (Germany). This website is delivered by the AWS CloudFront network, with points of presence in Europe, North America and Israel: a page may be delivered from a server outside the EU.
Data leaves the European Economic Area in these cases:
- AWS Marketplace subscription identifiers, which AWS handles in the United States (us-east-1 region): the European Commission's standard contractual clauses in the AWS data processing addendum apply to this data;
- data that reaches Google through Google Maps Platform and Google Workspace, which Google may process in the United States as well: Google LLC participates in the EU-US Data Privacy Framework and its terms include the standard contractual clauses;
- data received by browser push services, if you turn on notifications, depending on the browser you use.
6. How long we keep it
- Account and company data: as long as the account is active. When the administrator asks to close the account, or when an AWS Marketplace subscription ends with no Free plan to return to, the company's data is deleted 30 days later. During those 30 days the administrator can download a full archive. The AWS Marketplace subscription identifiers and the version of the Terms accepted, with date and time, are deleted together with the company.
- Activity log: 365 days, unless the company chooses a different period (90 to 3650 days, or no limit).
- Server technical log: each part of the application keeps at most 50 MB, then overwrites the oldest lines. It is normally reset at every application update; a copy remains in the copies of the whole server, which expire after 7 days.
- Login attempts: the count per IP address lasts 15 minutes, the count for account lockout 24 hours; both are kept only in memory and disappear when the server restarts.
- Login sessions: they stop working after 30 days without use and are deleted with the account.
- Support requests: we do not store them in Routevance; they stay in the support mailbox for as long as needed to handle them and in any case no longer than 24 months.
- Backup copies: database copies are kept for 14 days on the server and 35 days on S3, plus 7 days as a previous version (42 in total). For copies of the whole server, the latest 7 daily ones are kept. They expire and are deleted automatically.
7. Your rights
You can ask us for access to your data, to correct or erase it, to restrict its processing, to receive it in a machine-readable format, and to object to processing based on legitimate interest. Write to privacy@snjmediastudio.com: we reply within one month.
If you are a technician or an end client of a company that uses Routevance, contact the company: it decides how your data is used, and we help it answer you.
We have not appointed a data protection officer (DPO): privacy@snjmediastudio.com is the address for every request.
You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the data protection authority in your own country.
8. Security
Connections go over HTTPS only. Passwords are stored as hashes and database backups are encrypted before they leave the server. Each company's data is kept separate from the others'. The measures are described in Annex A of the Terms of use.
9. Changes
If we change this notice, we publish the new version at this address with the date of the update. If the changes affect how we use data already collected, we tell the companies' administrators by email first.