mDrive Autosõit Privacy Policy

A closed employee service, not a public account service

Although anyone may download mDrive from an app store, downloading the app does not provide access to any account or driving data. There is no public registration. Accounts are created internally by OÜ Autosõit only for authorised Autosõit personnel. An active OÜ Autosõit business employee account is required to access mDrive or any route record.

• Authorised Autosõit instructors use the mobile app to record driving lessons.
• Authorised Autosõit managers and administrators use the protected PC website to view and manage drive records.
• Unauthenticated users and people outside OÜ Autosõit cannot obtain or view route records through mDrive.
• Each user must authenticate and receives access appropriate to their work role.

These access restrictions do not limit a person’s statutory data protection rights, including the right to request access to personal data concerning them.

Data controller

Data we collect

Depending on the lesson and use of the service, we process:

• Precise location and route data: latitude, longitude, location timestamps, speed, calculated distance, duration, and the sequence of points forming a driving-lesson route.
• Lesson information: drive identifier, lesson date and time, instructor, student, vehicle, lesson status, observations, assessments, and other information logically connected with the relevant lesson record.
• Account and authentication information: identity, work role, account identifiers, login session information, and security cookies required to provide the authenticated service.
• Technical and diagnostic information: app version, device and operating-system information, crash reports, error details, network information, IP address, and timestamps associated with security, operation, and troubleshooting.

Location is obtained from the instructor’s device. Account, student, vehicle, and lesson associations come from Autosõit’s internal records and from authorised personnel using the service. Students do not need an mDrive mobile-app account, but a route may form part of their driving lesson record.

How background location works

• An instructor deliberately starts a drive in mDrive.
• During that active drive, the app accesses precise location in the foreground and background so that locking the device, changing apps, or closing the app does not interrupt the lesson record.
• Selected route points and their timestamps, speed, and calculated distance are transmitted over HTTPS to the mDrive service.
• Location collection for that drive stops when the drive is ended.

mDrive does not use location to serve advertisements or to track an instructor outside an active instructor-started drive.

Why we use the data

• to record the route, distance, duration, and timing of driving lessons;
• to provide reliable lesson history and administrative records;
• to allow authorised instructors, managers, and administrators to review lessons;
• to support driving instruction, quality control, and resolution of questions about a lesson;
• to authenticate users, protect accounts, prevent misuse, and maintain service security;
• to diagnose crashes, correct technical problems, and maintain mDrive; and
• to establish, exercise, or defend legal claims and comply with applicable law.

Legal bases

Depending on the processing activity, Autosõit relies on:

• performance of contracts and the employment or working relationship connected with providing driving instruction;
• Autosõit’s legitimate interests in accurately documenting lessons, administering its driving school, providing a reliable service, ensuring security, and resolving disputes;
• compliance with applicable legal obligations; and
• consent where the law specifically requires consent.

Device permission allows the app to access location technically. It does not remove any rights that a person has under data protection law.

Who can receive or process data

We do not make mDrive data public, sell it, or provide route history to unauthenticated users or external driving schools. Data may be accessed or processed only as follows:

• authorised OÜ Autosõit instructors, managers, administrators, and technical personnel, to the extent required by their work;
• OÜ Autosõit’s production server in Estonia, on which Autosõit operates the mDrive service and database. Network connectivity and related infrastructure are provided by Aktsiaselts WaveCom;
• Google Firebase Crashlytics, which processes crash and technical diagnostic information to help us identify and repair app failures;
• Google Maps, which is used to display maps and lesson routes and may process map requests, route coordinates, IP address, and device or browser information needed to provide map content; and
• public authorities or other recipients when disclosure is required by law or necessary for legal claims.

We require service providers that receive or process user data to use it only for their contracted services and to provide the same or an equivalent level of privacy and security protection described in this policy. They are also subject to their contractual and legal obligations. Google’s processing is also described in the Google Privacy Policy and Firebase privacy information.

How long we keep data

Driving-lesson routes and their associated lesson records are currently retained for an open-ended period and are not automatically deleted after a fixed number of days or years. This supports long-term lesson history, administration, and the resolution of later questions about recorded lessons. In practice, a route may remain for the entire operating life of the mDrive service.

A record is deleted or anonymised when Autosõit determines that it is no longer necessary, when a valid erasure request must be fulfilled, or when the service and its storage are permanently decommissioned, unless continued retention is required by law or necessary for legal claims. Account, security, and diagnostic information is retained for as long as reasonably needed for the relevant operational, security, legal, or troubleshooting purpose.

Security

We use measures intended to protect personal data, including HTTPS transmission, authenticated accounts, work-role-based access, restricted administrative access, and server security controls. No method of electronic transmission or storage is completely secure, so absolute security cannot be guaranteed.

Users must keep account credentials confidential and must not allow another person to use their account.

Location permissions and choices

The device asks the instructor to grant precise foreground and background location permission. Permission may be declined or revoked in device settings. Without the required permission, mDrive cannot reliably record a complete driving-lesson route while the app is not visible.

Your data protection rights

Subject to applicable law, a person may request access to, correction of, deletion of, or restriction of their personal data; object to processing based on legitimate interests; request portability where applicable; and withdraw consent where processing is based on consent. Some rights may be limited where retention or processing is required by law or necessary for legal claims.

Requests may be sent to info@autosoit.ee. We may need to verify the requester’s identity and connection with the relevant lesson before responding.

A person may also lodge a complaint with the Estonian Data Protection Inspectorate: www.aki.ee.

Children and students

The mDrive app is an employee work tool and is not intended for use by children or for public account creation. A driving student, including a minor where legally permitted to take instruction, may nevertheless be associated with a lesson and its route in Autosõit’s records. Such data is used only for the driving-instruction and administrative purposes described in this policy.

Changes to this policy

We may update this Privacy Policy when mDrive, our processing, or legal requirements change. The current version and effective date will be published on this page. Material changes will be communicated through an appropriate channel.

Contact

Questions or requests concerning this policy or personal data may be sent to info@autosoit.ee or to the postal address listed under “Data controller”.