--- title: "Security & GDPR — equipment rental software" description: "How Toitrack protects your business data: European infrastructure, encrypted connections, backups with restore testing, role-based access and attention to GDPR." url: "https://en.toitrack.com/security" lang: "en" --- Security & GDPR # Your business data, kept safe Your record of orders, units and customers is your asset. Here's how we protect it, no fluff. How we protect your data ## Security, in concrete terms The measures that underpin the protection of your work records. ### Encrypted connections All traffic runs over HTTPS/TLS: your data is protected in transit between your browser and Toitrack. ### Infrastructure in Europe Servers, databases and backups are hosted in European data centers. Some third-party services we use for specific features, such as payments and address geocoding, may process data outside the European Union: we list them below. ### Backups with restore testing Automated, encrypted backups, kept in multiple copies, with periodic restore checks. ### Role-based access Secure authentication and role-based permissions: everyone on your team sees and does only what their role allows. ### Designed with GDPR in mind We process data with the GDPR in mind, collecting only what is needed to run the service. ### Your data stays yours Your work data is yours: no hidden use, no reselling to third parties. GDPR ## Transparency about your data We collect only the data the service needs and process it lawfully and transparently. As the data controller for your business, you decide what to enter into Toitrack. We safeguard it and put it to work for your business, without using it for any other purpose. ### Export your data, instantly Access and portability are self-service: from your profile, under "Privacy and personal data", you can download a full copy in JSON format on your own, no need to write to us. ### Request erasure The erasure request also starts from the same profile section. It is not an instant deletion: the request is logged and forwarded to your company's administrator, the data controller, who handles it by anonymizing the account within 30 days, as stated in the app. Some data cannot be erased on request because the law requires keeping it: the waste loading and unloading register and transport documents are kept for 3 years (36 months) from the last entry. When a customer of yours or a user asks for erasure, their other personal data is made anonymous (pseudonymized) and only what the law requires to be kept remains. To deliver the service we rely on providers that process data on our behalf: hosting in European data centers, transactional email, payments (Stripe), address geocoding (Google) and, when you send or receive invoices through the SdI, an intermediary for transmitting invoices. Google (Maps and geocoding, reCAPTCHA, Analytics) and Stripe may process data outside the European Economic Area; transfers rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses, as declared by these providers. When you use maps and route calculation, your browser also contacts third-party services directly, which receive your IP address and the coordinates of the area or points shown: Google (maps, address search and geocoding), OpenStreetMap (map tiles) and the public OSRM service (route calculation). The up-to-date list of sub-processors is provided on request. Providers' official information on data transfers: [Google: data transfer frameworks](https://policies.google.com/privacy/frameworks) · [Stripe: privacy policy](https://stripe.com/privacy) · [Stripe: Data Processing Addendum](https://stripe.com/legal/dpa) For data rectification or any other request about your rights, you can write to us at [amministrazione@toitrack.com](mailto:amministrazione@toitrack.com). Full details on data processing are in our Privacy Policy. Do you have specific security or compliance needs for your company? Write to us during your free trial: we'll explain in detail how your data is handled. End of trial and closure ## What happens to your data if you stop No surprises: here is what happens to the account when the trial ends or a payment fails. ### At the end of the trial After the free trial expires there is a 3-day grace period. Then the account becomes read-only: you can sign in, view and export your data, but not add new data. ### Cancellation or failed payment You can cancel any time from the app: the subscription stays active until the end of the paid period, then the account is no longer accessible. If a payment fails the account may be suspended until the situation is resolved. ### Export before closure Before your subscription ends, export your company data, such as invoices and registers, from the app sections; from your profile you can download your personal data in JSON format. For retention times after termination, contact us. ## Questions about the security of your data? Try it free for 14 days and ask us anything about how we handle and protect your information. [Try it free for 14 days](https://en.toitrack.com/contact) Reply within 24 hours · no obligation We set up your trial account for you For support or a tailored proposal write to us: [info@toitrack.com](mailto:info@toitrack.com) [WhatsApp +39 378 443 5327](https://wa.me/393784435327)