Data Processing
Last updated: 5 October 2026
1. Controller / processor model
For business account, security, support and commercial administration, Lytheron OÜ generally acts as controller. For passenger, booking, dispatch and driver data processed on behalf of an independent taxi operator, the operator generally acts as controller and Lytheron provides the FleTaxi platform as processor, subject to the agreed service terms.
2. Processing instructions
FleTaxi processes customer data to provide the configured booking, dispatch, fleet, driver, tracking, support and security functions. Lytheron does not use one operator's passenger data to build a competing taxi marketplace.
3. Confidentiality and access
Access is limited through organisation membership and role-based controls. Business customers are responsible for assigning appropriate roles; Lytheron personnel and service providers receive access only where needed to operate, secure or support the service.
4. Security measures
The platform uses tenant isolation controls, row-level database security, authenticated access, least-privilege service roles, rate limiting, audit/security logging and encrypted transport. Security measures evolve with the service and risk profile.
5. Service providers
FleTaxi uses specialist providers for cloud hosting, database/authentication, transactional email, routing/geocoding and map delivery. Lytheron assesses providers according to the service they perform and applies contractual or technical safeguards where required.
6. Assistance and incidents
Lytheron will provide reasonable assistance to business customers for data-subject requests and regulatory obligations that relate to processing performed through FleTaxi. Security incidents involving customer personal data are handled under applicable legal and contractual notification duties.
7. Return and deletion
At the end of the service, customer data is deleted or returned according to the applicable agreement, customer instructions, legal retention requirements and normal backup/security cycles.
8. Contractual DPA
This page is an operational summary and is not a substitute for a signed Data Processing Agreement. A binding DPA is required where Lytheron acts as an operator’s processor. Before processing live passenger or driver data, business customers should contact legal@lytheron.com.