Periva Solutions Inc. (“Periva”, “we”, “us”) provides fleet management and telematics services to businesses in Canada and the United States. This policy explains what personal information we handle, why we handle it, and what choices you have.
It covers our website at periva.io, the Periva GPS platform at gps.periva.io and its driver portal, our API, and the sales and support conversations that go with them. Our consumer GPS tracker and app are covered by a separate Consumer Privacy Policy, published on periva.app.
Last updated November 2, 2026
Our responsibilities differ depending on whose information is involved.
For visitors to periva.io, people who contact us or request a quote, newsletter subscribers, and the people who administer a customer account, we decide why and how the information is used. This policy governs that processing, and you can exercise your rights with us directly.
The data inside the Periva GPS platform belongs to the organization that operates the fleet. That customer decides which vehicles are tracked, which people get accounts, which features are switched on, what is recorded and how it is used. We process it on the customer's instructions under our agreement with them.
Customers are responsible for giving drivers and other individuals the notices, and obtaining the consents, that the law requires for vehicle tracking, driver monitoring and any camera recording.
If you are a driver or employee of a Periva customer and you want to access, correct or delete your information, or understand why your vehicle is tracked, please contact your employer first. They control that data. If you contact us instead, we will refer your request to them and help them respond.
Handled on behalf of our customers, as described in section 1:
This data travels from the tracking device in a vehicle over a cellular network to our servers. The device manufacturer's firmware management service and the connectivity provider that carries the traffic are listed on our subprocessors page.
We do not currently offer features that identify people from their facial or other biometric characteristics. If we introduce any, we will update this policy before they become available.
Aggregated and de-identified data. As our customer agreements permit, we use platform data that has been aggregated and de-identified, so that it no longer identifies a customer, an individual or a vehicle, to improve our services, for benchmarking and analytics, and for product development. We use it internally, do not publish it, and do not attempt to re-identify it.
We do not sell personal information, and we do not use platform data to train AI models or to build advertising profiles.
We are based in British Columbia. Our handling of personal information is governed principally by Canada's Personal Information Protection and Electronic Documents Act and British Columbia's Personal Information Protection Act. We rely on your consent, which may be express or implied by the circumstances, and on the exceptions those laws allow, including where information is needed to perform a contract or meet a legal obligation.
For our US customers, we act as a service provider or processor for platform data, under contract terms that restrict our use of it to providing the services. We also comply with the US state privacy laws that apply to information we decide how to use.
Where the EU or UK General Data Protection Regulation applies to a particular customer or individual, our legal basis is the performance of our contract, our legitimate interest in operating and securing our services, your consent for marketing, or compliance with a legal obligation. For platform data in that situation, our customer is the controller and we act as their processor.
You can withdraw consent for marketing at any time by using the unsubscribe link in any marketing email or by writing to [email protected]. Withdrawing consent does not affect service messages we need to send to operate the platform.
The Periva GPS platform and its backups are hosted in Canada, in the Amazon Web Services Canada (Central) region in Montréal. Under our customer agreements, we do not move platform data outside Canada except to providers listed on our subprocessors page, as required by law, or with the customer's consent.
This marketing website is separate from the platform and is hosted in the United States, as is the database holding the quote requests and newsletter sign-ups submitted through it. Traffic to our website and platform passes through Cloudflare, a security and content delivery network that processes requests on servers around the world, including in the United States. Some of our communication and support tools, including AI tools, are hosted in the United States. The subprocessors page sets out the location of each provider.
Information stored or processed in another country is subject to the laws of that country, and may be accessible to its courts, law enforcement and national security authorities. Where information crosses a border, we protect it through the data protection terms in our contract with each provider.
| Information | How long we keep it |
|---|---|
| Location, sensor and driving data from tracking devices | 24 months from when it is recorded, then deleted or anonymized |
| Vehicle, driver and user records | For as long as the customer uses our services |
| Platform data after a customer agreement ends | Available for export for 30 days, then deleted in our ordinary deletion cycle, normally within 90 days |
| Enquiries and quote requests | As long as needed to respond, and up to 2 years afterwards as a business record |
| Newsletter subscriptions | Until you unsubscribe |
| API request logs | 90 days |
| Backups | Overwritten on a rolling basis within 30 days |
| Other logs | On a rolling basis, for security and troubleshooting |
We keep information longer only where a law, a regulator, or an actual or expected legal claim requires it.
We use safeguards appropriate to the sensitivity of the information, including:
No system is completely secure. If we confirm unauthorized access to customer data, we notify the affected customer without undue delay, and in any event within 72 hours. Where a breach affects personal information we control and creates a real risk of significant harm, we will notify the affected individuals and the relevant regulators as required by law.
Subject to the limits in applicable law, you can ask us to:
Residents of US states with comprehensive privacy laws also have the right to receive a copy of their information in a portable format, to appeal if we decline a request, and not to be treated differently for exercising their rights. If we deny your appeal, you can contact your state attorney general.
Write to [email protected]. We respond within the time your law allows, which in Canada is normally 30 days and in most US states 45 days. We may need to verify your identity first. If your request concerns platform data held on a customer's behalf, see section 1.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or the Office of the Information and Privacy Commissioner for British Columbia. If you are in the EEA or the UK, you can complain to your local supervisory authority.
Our website and platform are intended for businesses and the people who work for them. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
We update this policy when our practices change. The date at the top shows when it was last revised. If a change materially affects how we handle your personal information, we will take reasonable steps to tell you before it takes effect.
Our legal team is accountable for the personal information in our care and for our compliance with this policy.
See also our Terms of Use, Cookie Policy and subprocessors page.