Privacy policy
Updated on 6 October 2026
This policy explains which data the GPAfleet platform of GPS Platform Albania (the systems s1.gpa.al, s2.gpa.al and s3.gpa.al, and the GPAfleet app for Android and iPhone) collects, why, who it is shared with and how you control it.
1. Who we are
The service is provided by GPS Platform Albania (gpa.al), which is responsible for the data described here. Contact: info@gpa.al, phone/WhatsApp +355 68 600 0909.
GPS Platform Albania runs three systems (s1.gpa.al, s2.gpa.al and s3.gpa.al). Each account is on one of them, and the same company runs all three.
GPAfleet is a fleet management service. Our customers (companies) are responsible for their vehicles and drivers; we process the vehicle data on their behalf.
2. Data we collect
- Account data: username, e-mail and, when you fill them in, name, company, address and phone numbers. The password is stored only as a hash, never as text.
- Vehicle data sent by the GPS devices installed in the vehicles: location, speed, heading, mileage, sensors (e.g. fuel, temperature, voltage), events (zones, overspeed, alarms) and, where used, driver identification (RFID).
- Devices you sign in on: device and browser/app name, IP address, date of sign-in and of last use, to keep you signed in and for the "My devices" list.
- Push notifications: when you allow them in the app, a device identifier from Firebase Cloud Messaging (Google), to send you the event notifications you chose.
- Face ID / passkeys: when you turn them on we store only the public key. Your fingerprint or face never leaves your phone.
- Cookies: only those needed for the session and for staying signed in. No advertising cookies.
Signing in to your system. When you sign in from the GPAfleet app, your username and password may be checked on our systems s1, s2 and s3, so that the system your account is on opens. The check uses HTTPS only, and the password is never stored as text on our servers. After the first sign-in the phone remembers your system, and later the password goes only there.
The password on the phone (s2 and s3). For accounts on s2 and s3 the app can keep the password only on your phone, protected by Face ID or your fingerprint (the iPhone Keychain, the Android Keystore), so that you can sign in without typing it again. It is deleted when you log out or switch system.
Notifications for accounts on s2 and s3. So that notifications reach you even when the app is closed, the phone gets the account's API key from your system and gives it to the s1 system, together with the push notification identifier. When your system gives the key only through an address (URL), the username and password are sent once over HTTPS to that system and may be written in that server's log. s1 stores the key encrypted and uses it only to read the account's events of the last 30 minutes, so that it can send you the new ones as notifications; for these accounts the events your system records for the account are notified. The key is deleted when you log out or switch system in the app, and your system's administrator can stop it by changing the key.
3. Why we use it
- to show the vehicles on the map, their history, reports, events and maintenance;
- to send the notifications you chose (in the platform, e-mail, SMS or push);
- for account security (sign-in, signed-in devices, protection against unauthorised access);
- for technical support and our legal and contractual obligations.
We do not sell data and do not use it for advertising.
4. Who we share it with
Only the services we need to run the platform, and only as far as needed:
| Service | Why |
|---|---|
| Google Firebase Cloud Messaging | delivering push notifications to the phone |
| OpenStreetMap, Google Maps and other map providers | showing the map (the phone loads the map tiles) |
| Address service (geocoder) | turning coordinates into addresses |
| E-mail provider and SMS gateways | sending the e-mail and SMS notifications you chose |
The data is stored on our servers. We give it to authorities only when the law requires it.
5. How long we keep it
- Vehicle history: as many days as set for your account (usually 60), then deleted automatically.
- Signed-in devices: 30 days after last use; "Log out" ends the device at once.
- Push notification identifier: deleted when you log out of the app or after 60 days without use.
- The API key of accounts on s2 and s3 (for notifications): until you log out of the account in the app, or after 60 days without use; the events read are kept on s1 for no more than a day.
- The account: until you close it or the contract ends.
6. Security
Every connection uses HTTPS. Passwords and sign-in keys are stored only as hashes. Each account sees only its own vehicles; sub accounts see only the vehicles given to them. The API keys of accounts on s2 and s3 are stored on s1 sealed with a key that only the notification service holds, not the web server.
7. Your rights
You can ask to see, correct or delete your data, or object to its processing. Most account data you can change yourself in My account. For anything else write to info@gpa.al. You may also complain to the Albanian Commissioner for the Right to Information and Personal Data Protection.
8. Deleting your account
You can request the deletion of your account in the app (More → My account → Delete account) or on the page Delete your account, which also explains what is deleted.
9. Children
GPAfleet is a business service and is not directed at children under 16.
10. Changes
When we change this policy we update the date above. We announce important changes in the platform.