How GPS360 collects, uses and protects your data

GPS360 Systems (a trading name of GPS360 LTD, Port Moresby, Papua New Guinea) operates the GPS360 fleet-tracking platform, the track360.com.pg website, the customer portal, the technician portal, and our GPS360 mobile applications. This Privacy & Data Collection Policy describes the information we collect, how we store it, how we use it, and the choices you have. It applies to anyone who uses our products — fleet owners, drivers, vehicle owners, customer-side admins and contact persons.

We collect only the data we need to operate the service:

• Vehicle telemetry — GPS coordinates, speed, heading, altitude, ignition state, fuel level (where the sensor is fitted), distance travelled and harsh-driving events. Data is reported by the GPS360 hardware fitted to each customer vehicle.
• Trip and event history — derived from raw telemetry: trip start/stop, idle periods, geofence entry/exit, speeding events, panic-button presses and crash alerts.
• Dashcam video (GPS360 View customers only) — short event clips when the camera AI detects driver-attention issues, harsh braking, or on driver request. Video is retained for the period in your service contract.
• Customer account information — business name, contact person, email address, phone number, physical address, tax number, and any contact persons you record.
• Payment information — invoice records, payment amounts, dates, methods and reference numbers. Card details are processed entirely by Stripe; we never receive or store the card number, expiry, or CVC.
• Authentication data — email + password hash for customer and technician portal logins. Passwords are stored hashed (bcrypt); we cannot read your plaintext password.
• Communications — content of email, WhatsApp and in-app chat conversations between you and our team or our automated assistant. Used for service delivery and conversation history.
• Server-side logs — IP address, user-agent, request paths, response codes, timestamps, and error traces. Used to diagnose issues and detect abuse.

We use the information above to:

• Run the fleet-tracking platform — show you live locations, trip history, and reports for vehicles you own.
• Send service notifications — payment receipts, payment reminders, work-order updates, scheduled-service alerts, and security or compliance notices.
• Process subscriptions and invoices — including issuing PDFs, recording payments, and reconciling against bank records.
• Authenticate you when you log into the customer or technician portal.
• Respond to support enquiries you initiate by email, WhatsApp or chat.
• Improve the service — aggregate and de-identified data is used to spot regressions and prioritise feature work.
• Comply with legal obligations — tax records, financial reporting, lawful information requests from PNG authorities.

Production data is stored on managed PostgreSQL on a DigitalOcean droplet hosted in Asia-Pacific, behind an Nginx reverse proxy with TLS via Let's Encrypt. Vehicle telemetry is mirrored to and processed by Wialon Hosting on their production infrastructure. Email is sent via Brevo (Sendinblue). WhatsApp is sent via the Meta Cloud API. Payments are processed by Stripe.

Access to production systems is restricted to authenticated GPS360 staff using key-based SSH. Customer portal access is restricted to the account holder and the GPS360 admin account; passwords are bcrypt-hashed. We retain operational tracking data for up to 90 days online; older data may be summarised or pruned.

We do not sell your information. We share it only in these specific cases:

• Service providers we depend on — Wialon (telemetry processing), Stripe (payments), Brevo (email), Meta WhatsApp (messaging), DigitalOcean (hosting). Each receives only the minimum data needed to do its job and is bound by its own privacy terms.
• With your explicit consent — e.g., if you authorise us to share fleet reports with your finance department or insurer.
• Legal compliance — when required by PNG law, a court order, or to investigate fraud or abuse.
• Business transfer — if GPS360 LTD merges, is acquired, or sells its assets. Any successor will be bound by this policy or an equivalent.

As a GPS360 customer you can:

• View and update your contact details in the customer portal.
• Request a copy of the personal information we hold about you by emailing support@track360.com.pg.
• Request deletion of your account; we will delete personal data and retain only what we are legally required to keep (financial records, etc.).
• Opt out of marketing email by clicking unsubscribe; transactional email (invoices, alerts) cannot be opted out of while you have an active service.

Our mobile applications request the same access as the web portal — and may request additional device permissions where the user explicitly opts in (e.g., camera access to upload payment-receipt photos to the admin assistant, location access for navigation to a tracked vehicle, push-notification permission for alerts). Permissions can be revoked at any time in the device's settings. The mobile app communicates only with GPS360 servers and the service providers listed in section 5.

GPS360 is a business-to-business fleet service and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it.

We may update this policy from time to time. Material changes will be communicated by email to active customers and announced on this page. Continued use of the platform after a change indicates acceptance of the revised terms.

Questions, requests, or complaints about this policy:
GPS360 Systems / GPS360 LTD
Vanama Crescent off Lawes Road, IBBM, Port Moresby, NCD 1211, Papua New Guinea
Email: support@track360.com.pg
Phone: +675 7249 7905