Privacy Policy

This Privacy Policy may be updated or modified from time to time. Any updates will be posted on this page, and your continued use of the Services constitutes your acceptance of the changes. Where required by applicable data protection law, we will notify you in advance and, where appropriate, seek your consent to material changes. We encourage you to review this policy periodically to stay informed about how we are protecting your data. If you are our customer, we will notify you of any important changes to this policy.

You can jump to particular topics by going to the headings below:

Personal Information/Data refers to any information that identifies, relates to, or is reasonably capable of being associated with an identifiable individual or household. This includes, but is not limited to names, addresses, geolocation data, online identifiers, and other unique characteristics. Personal Information can also include indirect identifiers such as device identifiers and aggregated data if it can reasonably be linked to an individual.

An identifiable natural person, or "Data Subject," is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location information, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

If you provide us with personal information about other people, or if others give us your information, we will only use that information for the specific reason for which it was provided to us. By submitting the information, you confirm that you have the right to provide us with the data and to allow us to collect, use, process and store it. You are responsible for providing accurate, up-to-date information and ensuring its continued accuracy while using our services.

Consult this Privacy Policy periodically to check for updates.

If our products and services collect data about you but you are not our Customer (including for example if you are an employee or contractor of one of our Customers, or you receive our device via your insurance company), you should consult the business that operates our devices to learn about their privacy practices. This Privacy Policy applies only when the purposes and means of processing your personal data are determined by One Step GPS, meaning when we are a “controller” or “business” as defined by applicable data protection laws. It does not apply to any of your personal data that we process on behalf of our customers, meaning when we are a “processor” or “service provider” as defined by applicable data protection laws.

Please contact the relevant controller or business (this would be your employer if you are an employee or contractor of a One Step GPS Customer, or your insurance company if they provided your device) for more information about their privacy practices.

We act as a processor (or “service provider”) when we process Customer Data on behalf of our Customers in connection with providing our fleet tracking devices, software platform, and related Services. In these cases, the Customer determines the purposes and means of processing the personal information collected through the Services.

If you are a driver or other end user whose information is processed through our Services on behalf of a Customer (for example, your employer or insurer), that organization is generally responsible for responding to requests regarding your personal information. We assist our Customers in responding to verified requests as required by applicable law and our contractual obligations.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

In addition to the information that we collect from you directly, we may also receive information about you from other sources, including third parties, Business Partners, our affiliates, or publicly available sources. For example, if you submit a job application, or become an employee, we may conduct a background check.

Through your account settings, you can control location tracking, data sharing, and notifications. You can opt-out of marketing emails or personalized ads easily. You have the right to access or delete your data by contacting us. For sensitive data uses, we will always request your explicit consent.

We collect precise geolocation data (within 1,750 feet or less) about your vehicles in order to provide our services to you. We do not sell geolocation data or use it for advertising purposes, although we may share such information with Business Partners, suppliers and service providers that are engaged in providing our, or their services, directly to our Customers.

Under certain U.S. state privacy laws, “sensitive personal information” may include precise geolocation data, account login credentials, government identifiers, financial account information, and certain other categories. We do not sell sensitive personal information. We process sensitive personal information only as reasonably necessary to provide our Services, comply with legal obligations, or with your consent where required by law.

We do not collect any other “sensitive data” (like racial or ethnic origin, political opinions, religious/philosophical beliefs, union membership, genetic data, biometric data, health data, data about your sex life or orientation, or criminal history) except when we have your specific consent, or when the law requires us to. We ask that you not provide us with sensitive data or use our products to process sensitive data.

Depending on where you reside, you may have the right to opt out of the sale, sharing, or processing of your personal information for targeted advertising purposes under applicable U.S. state privacy laws.

We do not sell personal information for monetary consideration. However, certain disclosures of personal information to advertising or analytics partners (including through cookies and similar technologies) may be considered a “sale,” “sharing,” or “targeted advertising” under applicable law.

You may exercise your opt-out rights by:

If you cancel your service or your account is suspended for non-payment, your access to the platform and stored data through the service will terminate. We are not obligated to retain operational or device-level data beyond our standard retention periods.

However, nothing in this section limits your right to submit a verified request to access, obtain, or delete your personal information as provided under applicable privacy laws.

If you or a consumer whose data you have provided asks for access to their personal data, information about the categories of sources from which it is collected, or information about the categories or specific pieces of personal data, we will cooperate, including by providing the requested information in a portable and, to the extent technically feasible, readily useable format.

If we are unable to delete personal data for a valid legal reason, we will tell you why, we will only retain the personal data for that reason, and we will delete the personal data after the reason for keeping it no longer exists.

If you have a concern about how we are using your data, please see the “How to Contact Us” information at the bottom of this policy.

Access to your personal information is limited to authorized personnel who require the data to perform their duties and who are trained on the importance of maintaining its confidentiality. Our service providers and business partners are contractually obligated to protect personal information and are prohibited from using it for unauthorized purposes.

In the event of a data breach, we will notify affected users without undue delay and, where applicable, within 72 hours of becoming aware of the breach. We will also take all necessary measures to mitigate the impact of the breach.

We will promptly delete and cease actively using any personally identifiable information about you or any individual upon your request for removal. We will retain your personal data only for as long as it is necessary to achieve the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

The specific retention period depends on the nature of the personal information and the reasons for which it was collected. When determining how long to retain personal information, we consider several factors, including:

When we no longer have a legitimate business need to process your personal information, we will either delete or anonymize it. If immediate deletion is not possible (for example, because the information is stored in backup archives), we will securely store and isolate it from further processing until deletion becomes feasible.

In some cases, we may anonymize your personal information (so that it can no longer be associated with you) for research, statistical, or other business purposes. Aggregated, anonymized, or de-identified data may be retained indefinitely. Additionally, we may retain personal data for a commercially reasonable period to meet backup, archival, audit, dispute resolution, or legal compliance needs.

One Step is responsible for the processing of personal data it receives and subsequently transfers to a third party acting as an agent on its behalf. One Step GPS complies with the EU-U.S. DPF Principles, the UK Extension to the EU- U.S. DPF and the Swiss-U.S. Data Privacy Framework Principles for onward transfers of personal data, including the onward transfer liability provisions.

One Step GPS remains responsible and liable under the EU-U.S. DPF Principles, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles unless One Step GPS proves that it is not responsible for the event giving rise to the damage.

Under Annex I of the EU-U.S. Data Privacy Framework (DPF) Principles, One Step GPS provides you with the right to pursue binding arbitration if you believe your personal data has been mishandled and other dispute resolution methods have been unsuccessful. This arbitration mechanism ensures an independent review of claims related to violations of the DPF Principles, offering a fair and transparent resolution process for your concerns.

The Federal Trade Commission has jurisdiction over One Step GPS’ compliance with the EU-U.S. DPF, the UK Extension to the EU- U.S. DPF and the Swiss-U.S. Data Privacy Framework. In certain situations, One Step GPS may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We use cookies and similar technologies, including pixels, web beacons, and local storage, to operate our website and Services, analyze usage, improve performance, and support marketing and advertising activities.

Some of these technologies may collect personal information such as online identifiers, IP address, browser type, device information, and interactions with our website. Certain cookies and tracking technologies may be used for analytics or targeted advertising purposes, including cross-context behavioral advertising as defined under applicable U.S. state privacy laws.

You may manage your cookie preferences through our cookie consent banner at any time. In addition, where required by applicable law, we recognize and honor Global Privacy Control (GPC) signals and other legally recognized opt-out mechanisms.