This is an English translation provided for convenience. In the event of any discrepancy, the Romanian version available at www.routena.com/gdpr shall prevail.
This page is a general overview of how Routena handles the protection of personal data. It does not replace the mandatory documents: the Data Processing Agreement (DPA) applies to the processor relationship, and the Privacy Policy applies to Routena’s own processing.
1. Routena’s two roles
Depending on the data in question, Routena (SPECTRALAB SOLUTIONS S.R.L.) acts either as an independent controller or as a processor of the Client.
2. Routena as independent controller
For the processing that Routena decides on for its own purposes, it acts as a controller. Examples:
- administration of accounts and of the contractual relationship;
- billing of its own services;
- security and proper functioning of the platform;
- support and administrative communications;
- compliance with legal obligations;
- direct marketing, where legally permitted.
This processing is based on legal bases appropriate to each purpose — usually performance of the contract, a legal obligation or legitimate interest, and consent only where it is truly necessary (for example certain marketing communications or non-essential cookies). Details are in the Privacy Policy.
3. Routena as processor
For the data that the Client enters, imports or generates in the platform — including the data of employees, drivers, partners and their contacts — the Client is the Controller and Routena is the Processor, in accordance with art. 28 GDPR.
In this capacity, Routena:
- processes the data exclusively on the basis of the Client’s documented instructions;
- ensures the confidentiality of the persons authorized to process the data;
- applies technical and organizational security measures;
- assists the Client with data-subject requests and security incidents;
- upon termination of the services, deletes or returns the data in accordance with the Contract.
This relationship is governed by the DPA.
4. GPS location and driver monitoring
The GPS location and vehicle/driver monitoring functionalities are configured and activated by the Client, as Controller and, where applicable, as employer or the entity that determines the purposes of the monitoring. The Client establishes the legal basis, informs the data subjects and complies with the principles of minimization and proportionality, including the obligations provided by art. 5 of Law no. 190/2018. Routena provides the technical functionality as a Processor and does not determine the purposes of the monitoring; data-retention rules are set out in the DPA.
5. Sub-processors
To provide the Services, Routena uses third-party suppliers that may process personal data as sub-processors, contractually bound to comply with equivalent obligations. The up-to-date list is available at /en/subprocessors.
6. Data protection contact
For questions regarding data protection or to exercise the rights of data subjects, you can contact us at [email protected].
7. Data-subject rights
Under the GDPR, data subjects have rights such as: access, rectification, erasure, restriction, objection and portability. For the data entered by a Client into the platform (for example the data of an employee or driver), requests are addressed primarily to that Client, as Controller. Routena assists the Client in resolving these requests.
8. International transfers
International data transfers are governed by the DPA, the List of Sub-processors and, for Routena’s own processing, the Privacy Policy.
9. Documents and contacts
- Data Processing Agreement (DPA)
- Privacy Policy
- List of Sub-processors
- Questions regarding data protection or data-subject requests: [email protected]