Legal

Privacy policy

Last updated: 10-10-2026

This privacy policy applies to the VYS Tacho Simulator: the website www.vystacho.nl, the browser simulator and the mobile apps (iOS and Android). The simulator is a service of VYS Scheduling BV, based in the Netherlands. We process as little personal data as possible and never sell data to third parties.

1. Who is responsible

VYS Scheduling BV is the data controller for processing on vystacho.nl and in the VYS Tacho Simulator apps. Privacy questions: info@vysscheduling.nl.

2. What we process and why

Access and accounts

  • Access codes (issued through a training provider or employer): we process the code, the country and, where applicable, the company or trainer name and the email address the code was issued to, and when you sign in with a code the IP address with the country and place that belong to it. Purpose: providing access and preventing abuse.
  • Passwordless sign-in: business environments and the analysis portal use one-time codes by email (OTP). For this we process your email address. No passwords are stored.

In-app purchases

  • 24-hour or 1-week access is bought through the App Store (Apple) or Google Play. Payment is handled entirely by Apple or Google; we do not receive or store any payment details.
  • To validate a purchase we store: platform (iOS/Android), the purchased product, the store transaction id, the price and the time of purchase. With the purchase we also store the IP address, the country, browser or device characteristics, the simulator user number and where the purchase came from (see below).

Technical data and logs

  • When you use the simulator we keep technical logs: IP address, country (derived from the IP address), browser or device characteristics, a randomly generated device id and error messages. Purpose: running the service, fixing errors and preventing abuse.
  • Error logs are deleted automatically after about 30 days.
  • Visitor statistics are collected first-party, without ad networks and without sharing data with external analytics providers.
  • When you buy access in the app, we check whether the same IP address visited the website in the week before. That shows in our statistics where the purchase came from, for example a campaign.
  • To determine the country and place of an IP address (for the language choice, the statistics, the error logs, purchases and contact requests) we keep the IP address with that country and place in a lookup table, so we do not have to look it up again on every visit. We keep an IP address there for three months; after that it is deleted automatically. Country and place come from our own database on our server; the IP address is not sent to any external service for this. IP geolocation by DB-IP (licence CC BY 4.0).

E-learning code 95 (vyselearning.nl and vystacho.nl/elearning)

  • Learners: for an e-learning course run by a training provider, that provider is the controller and we are the processor. We process first names, surname, date of birth (as on the identity document), e-mail address and language, progress and active time per section, answers and scores on the tests, messages to the teacher or the helpdesk, and the certificate. Purpose: running the e-learning, issuing the certificate and reporting to the provider. If you take a course from VYS itself, VYS is the controller.
  • Supervision by the CBR: the CBR Framework for continuing training courses requires that the CBR and other supervisors can inspect course data. They get read-only access for that purpose.
  • Training providers: anyone who submits a request or has a provider account gives a company name, Chamber of Commerce number, name, e-mail address, phone number, CBR provider number and optionally a message. Purpose: assessing the request, staying in touch and managing the account. For each request we keep an abbreviation (hash) of the IP address, only to limit abuse of the form.

Tachograph files (analysis tool)

  • Tachograph files (.ddd) you upload for analysis are processed in memory only to show the report. They are not stored on our servers.

3. Cookies

We only use functional cookies: session cookies to sign you in and keep you signed in. There are no tracking, advertising or third-party analytics cookies, which is why vystacho.nl shows no cookie banner. The fonts are hosted on our own server, so no data goes to Google or any other third party for that either.

4. Who we share data with

  • Apple and Google: to validate in-app purchases (the transaction id the store already holds).
  • Hosting: our servers run with a European hosting provider (Strato/IONOS, Germany).
  • E-mail: we send e-mail with login codes, reminders and the e-learning certificate through Postmark (ActiveCampaign, United States). That transfer is covered by standard contractual clauses and the EU-US Data Privacy Framework. If Postmark is unavailable, e-mail goes through Brevo (European Union).
  • Training provider and CBR: a learner's data are visible to the provider of the course and, for supervision, to the CBR.
  • Simulator day planner: what you type there and the points of your route go through our server (so without your IP address) to map services. Search terms go to Google (Places), to suggest addresses; route points and vehicle data, and the search terms if Google does not respond, go to HERE Global B.V. (Eindhoven, the Netherlands), to calculate the route. Google and HERE may also use this data for their own services and are the controllers for that use, under the Google privacy policy and the HERE privacy policy and end user terms. Please do not enter names or other personal data in the day planner.
  • Maps in the analysis portal: the map tiles come from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). Your browser fetches them directly, and OpenStreetMap sees your IP address when it does.
  • We do not share personal data with anyone else, unless legally required to do so.

5. Retention

  • Error logs: about 30 days.
  • IP addresses with country and place in the lookup table: three months.
  • The IP address stored with an in-app purchase: three months; after that it is erased and the rest of the purchase record is kept.
  • Purchase and access data: as long as needed for the service and our administration, respecting statutory retention periods.
  • Uploaded analysis files: not retained.

6. Security

All connections are encrypted (TLS). Access to data is limited to what is needed for administration and support.

7. Your rights

You have the right to access, rectify and erase your personal data, and to object to or restrict processing. Send requests to info@vysscheduling.nl. You can also lodge a complaint with your data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

8. Changes

We may update this policy, for example when features change. The current version is always available at www.vystacho.nl/en/privacy, with the date of the last change at the top.

Vragen? App ons