Products
HyghFleet01 HyghTrack02 HyghCheck03 HyghRent04 HyghHosting & HyghMail05 Telematics & tracking06 Configurator07
Around the product
Live demo Feature comparison Availability & countries Downloads
Studio & Co
Custom development References Testimonials About us FAQ Contact Legal notice Privacy policy Terms
Start a project
contact@hyghsoft.de
+49 152 56017759
DEEN
Home/Privacy

Privacy policy

The short version: this website sets no tracking cookies, loads no ad networks and sells no data. Our products run on servers in Germany. Where we work for customers, we do so on their instructions as a processor, not on our own account.

This policy covers the website hyghsoft.com and our services HyghFleet, HyghTrack, HyghRent, HyghCheck and HyghsoftID. Which section applies to you depends on the role in which you meet us. Section 2 explains that.

This is a translation for convenience. In case of doubt the German version prevails.

1. Controller

HyghSoft
Owner: Samet Gülhan
Voßweg 18
45896 Gelsenkirchen
Germany

Email: datenschutz@hyghsoft.de
Phone: +49 152 56017759

We have not appointed a data protection officer because the thresholds of Art. 37 GDPR and section 38 BDSG are currently not met. For any privacy question, reach us at the address above.

2. Two roles, and why the difference matters

We process personal data in two fundamentally different roles. Who is responsible for what also determines whom you address with your rights.

As controller

For this website, for entering into and performing contracts with our customers, and for the HyghsoftID account, we are the controller within the meaning of Art. 4 no. 7 GDPR. Here we determine purposes and means ourselves, and we handle your rights.

As processor

Where a rental company operates HyghFleet, HyghTrack or HyghRent, the data processed there belongs to that company. It decides which customer data it records, how long it keeps it and what it uses it for. We provide the software and the operation, on its instructions under Art. 28 GDPR. If you are a renter, driver or employee of such a company, please address your request to that company first. Requests that reach us are forwarded without delay, and we support the controller in answering them.

HyghCheck is a special case and is described separately in section 12.

3. Your rights

Under the GDPR you have the right to:

  • access to the data processed about you (Art. 15)
  • rectification of inaccurate or incomplete data (Art. 16)
  • erasure (Art. 17) and restriction of processing (Art. 18)
  • data portability in a common format (Art. 20)
  • object to processing based on a legitimate interest (Art. 21)
  • withdraw consent with effect for the future (Art. 7(3))
  • lodge a complaint with a supervisory authority (Art. 77)

The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany. You may contact any supervisory authority.

Send requests informally to datenschutz@hyghsoft.de. We reply within one month. To avoid disclosing data to the wrong person, we verify your identity first.

4. Hosting and server log files

Website and products are operated on a rented server in a data centre in Germany. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A processing agreement under Art. 28 GDPR is in place with that provider.

On every request the server processes technically necessary data: IP address, date and time, the address requested, volume transferred, status code, referring page and details about browser and operating system. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation and in defending against attacks. Log files are rotated daily and deleted automatically after twelve months. We base this comparatively long period on our legitimate interest in investigating and preventing abuse, attempted fraud and attacks on our systems. Such incidents often only come to light months later and cannot be reconstructed without the corresponding logs. Where a specific incident is under investigation, we keep the affected log files until that investigation is complete.

5. Contacting us

If you write to us by email, phone, Telegram, Instagram or through the contact form, we process your details to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. The form on this website opens your own email program, no transfer to our servers takes place. We delete enquiry data as soon as it is no longer needed and no commercial or tax retention period applies.

6. Cookies and local storage

This website sets no cookies for analytics, reach measurement or advertising. Your browser's local storage only holds your language choice. That information never leaves your device.

In the signed-in areas of our products, cookies and local storage are technically necessary to maintain the session: a session cookie for HyghsoftID and, in HyghFleet and HyghTrack, an access and a refresh token in local storage. Without them, signing in does not work. The legal basis is section 25(2)(2) TDDDG together with Art. 6(1)(b) GDPR.

7. Fonts and embedded libraries

For consistent presentation we load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your browser connects to Google servers and transmits your IP address.

In the signed-in product areas we also load libraries for displaying and editing PDF files and for QR codes through the cdnjs network (Cloudflare, Inc.). Your IP address is transmitted to that provider as well.

The legal basis in each case is Art. 6(1)(f) GDPR, our legitimate interest in a consistent, fast and maintainable presentation.

8. HyghsoftID

HyghsoftID is the personal account for all our services. We are the controller for it.

Mandatory at registration: username, email address and password. The password is stored only as a scrypt hash, we never see it in clear text.

Optional: phone number, date of birth, first and last name, nationality, address, language preference, Instagram handle and a profile picture.

Identity and licence data: if you want to connect to a rental company, you can store your ID card and driving licence numbers and images of those documents. These files are stored encrypted. You decide per rental company which groups of details are released.

Further data: the time of registration, of email confirmation and of accepting the terms, sign-in times, two-factor security codes and any lock notes.

The legal basis is Art. 6(1)(b) GDPR for creating and operating the account, Art. 6(1)(a) GDPR for optional details and for releasing them to a rental company, and Art. 6(1)(f) GDPR for abuse prevention. You can delete the account at any time in the settings.

9. HyghFleet

HyghFleet is the rental company's management platform. The respective rental company is the controller for the data stored there, we are the processor.

Depending on the customer's configuration, this includes in particular:

  • renter master data: salutation, name, date and place of birth, nationality, address, email, phone, ID card and driving licence numbers, notes
  • bookings with period, vehicle, mileage, deposit, prices and payment status
  • invoices, payments, outstanding claims and reminders
  • contractual penalties and their evidence
  • digital signatures on the rental contract and the handover and return protocols. To prove authenticity we record the time, IP address, browser identification, the consent text and document checksums in a continuous chain.
  • staff accounts of the rental company with name, email, role and permissions

Each customer's data sits in its own database, separated from other customers' data.

10. HyghTrack and telematics

HyghTrack processes data from telematics devices in vehicles. Here too the rental company is the controller and we are the processor. Because this data allows conclusions about the behaviour of individuals, we describe it in detail.

Recorded: position data with timestamps, ignition and motion state, satellite count, speed, engine revolutions, engine load, coolant temperature, fuel level and odometer reading, plus trips derived from these with start, destination, duration and distance.

Events: the system detects, among others, strongly elevated speed, long high-revolution phases, high engine load on a cold engine, as well as suspected accidents, signal jamming and disconnection of the power supply. If the rental company has configured it, such events can lead to a warning or a contractual penalty.

Important note for drivers and renters: whether and how a vehicle is tracked is decided by the rental company, not by us. It must inform you in advance and needs a sound legal basis. Where employees are affected, section 26 BDSG and works council codetermination rights apply as well. Questions about a specific vehicle are answered by the company that rents out or operates it.

Map display: to show positions on a map we embed the Google Maps JavaScript API (Google Ireland Limited). The coordinates to be displayed and the viewer's IP address are transmitted to Google. Transfer to the USA cannot be ruled out, see section 15.

11. HyghRent

HyghRent is the portal for renters. You sign in with your HyghsoftID and link your account to your customer record at a rental company. Linking requires that the email address matches and has been confirmed.

You then see your bookings, offers, invoices, documents, extension requests and the chat with the rental company. Messages and attachments in the chat, and locations you choose to share, are stored for the duration of the business relationship. The respective rental company is the controller for this data.

You control which groups of your HyghsoftID profile are transmitted to a rental company, and you can undo the link at any time.

12. HyghCheck

HyghCheck is a cross-company warning and information system. Rental companies can record people with whom there has been a serious breach of contract, and check people against the database before entering into a contract. This is the most intrusive processing we operate, so we describe it in full.

Roles: the recording company is the controller for the decision to record and for the accuracy of the details. The querying company is the controller for the query and for the decision based on it. For operating the central database, the matching procedure and the sharing between companies, we assume joint controllership under Art. 26 GDPR between us and the participating companies. We make the essence of that arrangement available to data subjects on request.

Data: first and last name, date of birth, where applicable ID card and driving licence numbers, email and phone number, the reason from a fixed list (payment default, damage, fraud, theft, behaviour, other), a free text, a severity level, and the time and status.

Legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in protection against payment defaults, vehicle damage and criminal offences. A documented balancing test exists for this processing, and we disclose its essential findings on request.

Retention, counted from the date of entry and graded by severity: minor one year, moderate three years, serious five years, extreme ten years. After that the entry is deleted or anonymised. If the claim is settled or the reason ceases to apply, we withdraw the entry without delay, regardless of these periods. Withdrawn entries stop matching immediately and are deleted after twelve months. Query logs are kept for 24 months for billing and abuse control.

No automated decision: HyghCheck returns a search result, not an assessment and not a score. Whether a contract is concluded is always decided by a human at the respective rental company.

Your rights here: you can request information on whether and with what content you are recorded, have inaccurate entries corrected, and object to the processing under Art. 21 GDPR. Contact datenschutz@hyghsoft.de. We will name the recording company and forward your objection.

13. Mobile apps and notifications

Our iOS apps deliver notifications through the Apple Push Notification service (Apple Inc. and Apple Distribution International Ltd., Ireland). For this we store a device token, the app identifier, details of app version and language setting, and the time of registration. Notification content may include a subject and a short text, such as a hint about a new message or a confirmed booking.

The legal basis is Art. 6(1)(b) GDPR where the notification is part of performing the contract, otherwise your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time in your device settings.

14. Recipients and processors

We pass on data only where necessary to provide the service or where we are legally obliged to. We use:

  • Hetzner Online GmbH, Gunzenhausen, Germany: server operation, processor
  • Avoro: operation of the mail server mail.hyghsoft.de for confirmation, notification and invoice emails, processor
  • Google Ireland Limited: Google Fonts on the website, Google Maps in the products
  • Cloudflare, Inc.: delivery of the PDF and QR libraries via cdnjs
  • Apple: delivery of notifications to iOS devices
  • Anthropic PBC: optional mapping assistance when setting up PDF forms. Only the form's field labels and the list of possible target fields are transmitted, no renter or booking data.
  • Tax advisors, payment service providers and authorities, where legally required

Agreements under Art. 28 GDPR are in place with all service providers that process personal data on our behalf.

15. Transfers to third countries

Our own servers are located in Germany. With the services named in section 14 from Google, Cloudflare, Apple and Anthropic, processing in the USA cannot be ruled out. Such transfers rely on standard contractual clauses under Art. 46(2)(c) GDPR and, where the provider is certified, on the adequacy decision for the EU-US Data Privacy Framework under Art. 45 GDPR.

16. Retention

We delete personal data once the purpose no longer applies and no statutory retention duty stands in the way. As a rule:

  • server log files: twelve months, see section 4
  • HyghsoftID: until you delete the account
  • data in HyghFleet, HyghTrack and HyghRent: as instructed by the respective rental company, at the latest after our contract ends and any agreed retrieval period expires
  • HyghCheck: per the periods in section 12
  • invoices and accounting records: six or ten years under section 257 HGB and section 147 AO

17. Data security

We secure transmission with TLS. Passwords are stored as scrypt hashes, uploaded identity documents are stored encrypted. Each customer's data sits in its own database with its own credentials. Access in the internal area is bound to a permission system and is logged. Backups are created every working day.

18. No automated decision-making

There is no solely automated decision producing legal effects or similarly significant effects under Art. 22 GDPR. This expressly includes HyghCheck and the event detection in HyghTrack: both provide indications, humans decide.

19. Changes to this policy

We adapt this policy when our services or the legal situation change. The version published on this page applies.

Last updated: 30 August 2026. The marked placeholders must be filled with the real company details before publication. This policy is written to match how the software actually behaves, but it is not legal advice and should be reviewed by a lawyer before going live. That applies in particular to section 12.