GDPR · Data processing

GDPR and data processing

What your lawyer and your IT lead need in one place: roles, the processing terms, who touches the data, where it is and how long it stays.

Last updated 5 Oct 2026

What changed: The provider is now UAB "Logis tech", and the data processing terms are section 12 of the Terms.

The short version

You are the controller of your workspace data and Logis is your processor, under the data processing terms in section 12 of the Terms. The database is in the EU. Nine named providers, each with a purpose and a region. Requests go to the address below and are answered within one month.

1Roles

For everything inside a workspace — your staff, drivers, contacts, customers and partners, and the records you create — you decide why and how it is processed: you are the controller and Logis is your processor. For account security, billing, support, feedback and this website, Logis is a controller in its own right.

Data processing terms

Terms and Conditions · section 12

Data processing terms

The Article 28 terms are part of the Terms and Conditions you accept when you create a workspace, so they are in force without a separate signature.

Read section 12

They cover processing only on your documented instructions, the subject, duration and categories of data, confidentiality of the people who process it, the security measures, sub-processors with at least 14 days’ notice and a right to object, safeguards for transfers, help with data-subject requests and impact assessments, notification of a breach without undue delay, deletion or return at the end, and audits on reasonable notice, at most once a year.

3Sub-processors

ProviderPurposeRegion

Supabasedatabase, sign-in and file storage, on servers in Ireland (EU).EU · Ireland

Vercelhosting of the web platform and the website, on servers in Dublin (EU) with a global delivery network.EU · Dublin, global delivery network

Expodelivering updates and push notifications to the driver app.US-based · DPF or SCCs

Appledelivering push notifications to iPhones.US-based · DPF or SCCs

4Transfers

The database and servers are in the EU, but several providers are based in the United States. Where personal data leaves the European Economic Area, the transfer relies on the provider’s certification under the EU–U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

5Security measures

Data is encrypted in transit and at rest.
Photos and documents are kept in private storage and open only for people signed in to the workspace they belong to.
Each workspace’s records are kept apart by access rules enforced in the database itself, not only in the apps.
The copy of your routes on the phone is protected by the phone’s own encryption and the app’s PIN or biometric lock, and it is deleted when you sign out. Too many wrong PINs sign the phone out.
Our own staff access personal data only when that is needed to run, secure or support the service.

6Retention

DataHow long

Operational recordsOperational records — trips, stops, reports, documents, invoices — are kept for as long as the workspace keeps them, since they are that company’s business records and are often subject to transport and tax retention rules.

A closed workspaceWhen a workspace is closed, its data is deleted within 90 days.

Your accountYour account is deactivated as soon as your workspace removes you. The records you created stay with the workspace as its business records.

Arrival positionsOnly the 50 most recent arrival positions are kept for each place; older ones are deleted automatically.

The driver app’s copyThe driver app’s copy stays on the phone until you sign out or remove the app.

7Data-subject requests

Access, correction, erasure, restriction, portability and objection. Because the workspace is usually the controller, the quickest route is to ask it; you can also write to info@omus.io or use Your data. We answer within one month and may first ask you to confirm who you are.

You may complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or to the authority where you live or work.

Related pagesPrivacyTermsPricing

delivering push notifications to Android phones, and serving the typeface our web pages use — your browser loads it from Google, which sees your IP address.

US-based · DPF or SCCs

Twiliosending the sign-in code by text message.US-based · DPF or SCCs

Resendsending email.US-based · DPF or SCCs

Mapboxmaps, address search and driving distances in the web platform — it receives the addresses and map positions being searched or shown, and your browser’s IP address when a map loads.US-based · DPF or SCCs

Linearour internal issue tracker — it receives the text of the feedback reports you send us and your company’s name.US-based · DPF or SCCs

A new or replaced sub-processor is announced at least 14 days ahead, by updating this list and the privacy policy or by email. You may object on reasonable data-protection grounds within that time.

Feedback reportsFeedback reports are kept while we need them to answer you and fix what they report. You can ask us to delete yours at any time.

BackupsDeleted data can remain in our encrypted backups for a short time, until they are overwritten.

Operational records stay as long as the workspace keeps them; a closed workspace is deleted within 90 days; only the 50 most recent arrival positions are kept per place. The full list is in the privacy policy.