Stratio Automotive

GDPR overview

GDPR implementation is documented rather than merely claimed. The privacy notice states that Stratio follows the requirements of the GDPR and of COPPA, sets the minimum age at 18, and sets out a legal basis per purpose: contract negotiation and consent for recruitment, legitimate interest for contact, security and legal defence. It names the rights in full, information, access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making and profiling, with consent withdrawable at any time and complaints directed to the EDPB list of supervisory authorities. A separate Data Processing Agreement, published as a PDF under article 28.3 and dated October 2021, adds an annual audit right (10.1) and standard contractual clauses for any sub-processor outside the EEA (11.3). Personal data requests go to marketing@stratioautomotive.com. No DPO is named, and no article 27 representative is needed since the company is established in the EU.

Who owns the data?

Stratio's terms are explicit on ownership: the customer keeps its data. Clause 16.1 states that the customer or end user retains all rights, title and interest in its Customer Data, including intellectual property, and clause 16.2 makes the customer alone responsible for its accuracy and lawfulness. Under 16.7 the customer grants STRATIO a non-exclusive licence to copy, store, distribute, export, adapt, edit and translate that data as far as reasonably required to perform the contract. The platform, its documentation and any derivative works stay STRATIO's property (8.1, 8.3). The DPA casts STRATIO as processor and the customer as controller; invoices unpaid for 90 days or more can trigger irreversible deletion (16.6).

Reuse rights

Nothing in the terms restricts what customers do with their own telematics data. They keep title to it under clause 16.1, and the Stratio API add-on exists precisely to pipe vehicle data into their own systems, with no further permission needed. The vendor's side of the licence is wider than it first looks. Clause 16.8 lets STRATIO use and modify, though not disclose, Customer Data in order to deliver the service, to test, improve and operate its own services, and to generate Aggregated Data, which the terms define as data in aggregated, non-characterised form that cannot be traced back to an individual. It then adds that STRATIO may freely use and make available Aggregated or anonymous Data for STRATIO's business purposes. The privacy notice separately allows anonymous information to be supplied to third parties for marketing, advertising or similar uses, while ruling out any sale or exchange of personal data without a legitimate basis; sharing with affiliates, commercial partners and authorities stays possible. No clause addresses AI model training explicitly, and no opt-out from these uses is documented.

Data retention & training

Hosting summary

The contract runs under Portuguese law, with the courts of Coimbra having jurisdiction. Clause 11.1 of the Data Processing Agreement commits Stratio to processing only within the European Economic Area, with no transfer outside it without the controller's prior written agreement, and clause 11.3 requires standard contractual clauses (EU implementing decision 2021/914) for any sub-processor established outside the EEA. Appendix I.c, covering the general sub-processing authorisation, lists exactly one sub-processor: AWS, for cloud services covering storage and software hosting, entity country Ireland, onward transfers marked No. An independent technical check agrees, since the site's IP address, 54.75.199.89, geolocates to Dublin on Amazon's AS16509. The DPA also describes physical data centre measures: access control, fire detection and suppression, redundant generators. One nuance deserves a question before signing: the privacy notice reserves the possibility of processing data outside the EEA given the company's global reach, under standard contractual clauses or an equivalent mechanism where no adequacy decision applies.