Privacy Policy

Agile Fleet, Inc.

Version: 2026.4 Effective: September 11, 2026, Supersedes: the prior FleetCommander Privacy Policy and the separate website data sharing and cookie policies.

1. About this policy

Agile Fleet, Inc. (“Agile Fleet,” “we,” “us”) provides FleetCommander, a fleet and motor pool management platform, together with related hardware, implementation, and support services.

This policy explains what personal information we collect, how we use it, who we share it with, and what rights you have. It covers:

• our website, agilefleet.com;
• the FleetCommander application and related services; and
• our marketing, sales, support, and event activities.

Two different roles. Most personal information inside FleetCommander belongs to our customers — a government agency, university, municipality, utility, or company that uses FleetCommander to run its fleet. For that information, the customer decides what is collected and why, and we process it on the customer’s instructions under our Data Processing Addendum. If you are a driver, employee, or student of one of our customers and you want to access, correct, or delete your information, contact that organization first. We will refer your request to them.

For information we collect directly — website visitors, prospects, event attendees, support contacts, and our own account and billing contacts — we decide the purposes, and this policy governs.

Where you are matters. Sections 9 through 12 set out rights and commitments that differ by region. Section 10 covers the United States, Section 11 covers Canada, and Section 12 covers the European Economic Area, United Kingdom, and Switzerland.

2. Information we collect

2.1 Information you give us directly. Name, business email address, business telephone number, employer and job title, and the content of messages you send us — through web forms, email, telephone, support tickets, webinars, demonstrations, and trade shows.

2.2 Information our customers enter into FleetCommander. FleetCommander is configurable, so the exact fields vary by customer. The minimum set required by the system is first name, last name, email address, and telephone number. Customers commonly also store department or cost centre, employee or student identifier, driver’s licence status and expiry, vehicle assignments, reservation and trip records, mileage, and approval history.

2.3 Information we collect automatically. When you use our website or the application, we collect IP address, browser and device type, operating system, pages viewed, referring page, dates and times of access, and similar technical information, together with application access logs, authentication events, and audit records.

2.4 Information from third parties. Business contact information from marketing data providers, event organisers, cooperative purchasing programs, and publicly available sources, and referral information from partners and resellers.

2.5 Hardware and device data. Where a customer uses our key control, kiosk, or keyless hardware, we receive records of transactions at those devices — for example, which key was taken, when, and by which credentialed user.

3. How we use information

We use personal information to:

• provide, operate, secure, maintain, and improve FleetCommander and our other services;
• authenticate users and administer accounts;
• provide customer support and respond to enquiries;
• process orders, invoices, and payments;
• monitor system utilisation, capacity, performance, security, and licence compliance;
• send service and administrative communications, including notices about changes to this policy or our agreements;
• send marketing communications, webinar invitations, and training announcements, where permitted by law and subject to your right to opt out or withdraw consent;
• comply with legal obligations and enforce our agreements; and
• evaluate, negotiate, and complete corporate transactions.

Legal basis. In Canada, we rely on consent as described in Section 11.2. Under the GDPR and similar laws we rely on: performance of a contract, for account administration and service delivery; legitimate interests, for security, service improvement, and business-to-business marketing; consent, where required, for certain marketing and non-essential cookies; and legal obligation, where the law requires it.

4. Aggregate and de-identified information

We analyse usage in aggregate to plan capacity, schedule maintenance, monitor performance and security, and improve the product. Typical questions we ask of aggregate data include how many users logged in by day or hour, when peak utilisation occurs, how many active vehicles are in a system, how many reservations were completed in a period, the average duration of a reservation, and how many failed login attempts occurred in a given window.

These analyses do not include personal information or identifying information, and we do not attempt to re-identify de-identified data.

5. Artificial intelligence

Some FleetCommander features use artificial intelligence to generate insights, summaries, and suggestions from data a user is already permitted to see, and we use an AI assistant to help answer support questions.

• We do not use customer data to train third-party AI models, and we do not permit our AI providers to do so.
• AI-generated output can be wrong. It is intended to assist a person, not to replace their judgement, and it should not be the sole basis for a decision that significantly affects an individual.
• We do not use AI to make decisions about individuals without human involvement. If that ever changes, we will say so here and notify customers in advance.
• The AI providers we use are listed on our subprocessor page.
• Full terms are in our AI Addendum.

6. How we share information

We share personal information with:

• Service providers and subprocessors who host, secure, support, or help us deliver our services, under contracts that restrict their use of the information. Our current list is at [agilefleet.com/subprocessors].
• Our customers, where the information relates to that customer’s use of FleetCommander.
• Professional advisors — auditors, lawyers, insurers, and bankers — under duties of confidentiality.
• Our parent company, Banyan Software, and its affiliates, for corporate administration, reporting, and shared services.
• Authorities, where required by law, subpoena, or court order. Where the information belongs to a customer and we are legally permitted to do so, we will give the customer advance written notice and a reasonable opportunity to object.
• Acquirers, in connection with a merger, acquisition, financing, or sale of assets. Personal information transferred in such a transaction remains subject to the commitments made in the privacy policy in effect when it was collected, unless the individual agrees otherwise.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in U.S. state privacy laws. We do not disclose personal information for consideration in Canada.

7. Cookies and similar technologies

We use cookies and session identifiers on our website and in the application.

Within the FleetCommander application, cookies and session identifiers are used exclusively for security, application functionality, and system administration. They are not used for advertising.

You can control cookies through your browser settings and, where we offer one, through the cookie preference control on our website. Blocking strictly necessary cookies will prevent the application from working.

8. Retention

We keep personal information only as long as we need it for the purpose it was collected, or as long as our customer instructs us to.

Customer Data is different from our own records. For the personal information our customers put into FleetCommander, the customer decides how long it is kept. FleetCommander is their system of record for fleet operations, and many of our customers — government agencies, public universities, transit authorities — are subject to their own records retention schedules that require them to keep vehicle, reservation, and driver records for defined periods. We retain that information for as long as the customer’s subscription is active and the customer instructs us to hold it, and we do not delete it on our own initiative during the relationship.

If you are an individual whose information is in a customer’s FleetCommander system and you want it deleted, that decision belongs to that organisation. See Section 1.

Legal holds. Where we are required to preserve information because of litigation, an investigation, or a regulatory or public records obligation, we suspend deletion of the affected information for as long as the obligation lasts, and we resume the normal schedule when it ends.

9. Your rights — everyone

Wherever you are, you can:

• ask what personal information we hold about you and get a copy;
• ask us to correct information that is wrong or incomplete;
• ask us to delete information, subject to our legal and contractual obligations;
• opt out of marketing communications at any time; and
• ask a question or make a complaint about how we handle personal information.

How to make a request. Email privacy@agilefleet.com or write to our Privacy Officer at the address in Section 15. We will verify your identity before acting, and we will respond within the period required by the law that applies to you — generally 45 days in the United States, 30 days in Canada, and one month under the GDPR, each extendable where the law permits.

You may use an authorised agent or representative where the law allows. We will not discriminate against you for exercising a privacy right.

Again: if your information is in a customer’s FleetCommander system, contact that organisation. They decide what is collected and why. We will forward your request to them.

10. Additional rights — United States

Depending on your state, you may also have the right to: confirm whether we process your personal information; obtain a portable copy; correct inaccuracies; delete; limit the use of sensitive personal information; opt out of sale, sharing, or targeted advertising; and not be subject to profiling with legal or similarly significant effects. As stated above, we do not sell or share personal information for cross-context behavioural advertising, and we do not conduct profiling that produces legal or similarly significant effects about individuals.

If we deny your request, you may appeal by replying to our response with the word “Appeal.” You may also lodge a complaint with your state attorney general.

11. Canada

Agile Fleet serves customers in Canada, including municipalities, utilities, and public institutions. This section describes how Canadian privacy law applies to us.

11.1 Laws that apply

We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Alberta’s Personal Information Protection Act (PIPA), British Columbia’s Personal Information Protection Act (PIPA), and Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

Where our customer is a Canadian public body — a municipality, a provincial agency, a public university, a transit authority, or a public utility — that customer is also subject to public sector access and privacy legislation such as Alberta’s FOIP Act, Ontario’s FIPPA and MFIPPA, British Columbia’s FIPPA, and equivalent legislation in other provinces. We support those customers in meeting their obligations under our Data Processing Addendum and Public Sector Addendum.

11.2 Consent

We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise.

• We obtain express consent for sensitive information and for commercial electronic messages, as described in Section 11.6.
• We rely on implied consent where the purpose is obvious from the circumstances and a reasonable person would expect it — for example, when you give us your business card at a trade show, or when your employer enters your details into FleetCommander so you can reserve a vehicle.
• We identify the purposes for collection at or before the time we collect, and we do not use information for a new purpose without fresh consent unless the law allows it.

Withdrawing consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Contact our Privacy Officer. Withdrawing consent may mean we can no longer provide some or all of a service — for example, a fleet user who withdraws consent to the processing of reservation records may not be able to reserve a vehicle. We will explain the consequences before acting.

11.3 Your information is stored and processed in the United States

This is important and we want it stated plainly. Agile Fleet is a U.S. company. FleetCommander is hosted in the United States, and our support, engineering, and administrative personnel are located primarily in the United States. Personal information about individuals in Canada is transferred to, stored in, and processed in the United States.

While it is in the United States, that information is subject to United States law, and may be accessible to U.S. courts, law enforcement, and national security authorities under U.S. legal process, including lawful access mechanisms that have no Canadian equivalent. This is true of any service provider that stores Canadian personal information outside Canada.

We use contractual, technical, and organisational measures to give that information a comparable level of protection to what it would receive in Canada, including the security measures described in Section 13 and the obligations in our Data Processing Addendum. Where we receive a legal demand for a customer’s data and we are permitted to do so, we notify the customer and give them a reasonable opportunity to object.

If you have questions or concerns about this transfer, including about our policies and practices for service providers outside Canada, contact our Privacy Officer at the address in Section 15. You have the right to that information under PIPEDA and Alberta PIPA.

11.4 Access and correction

You may request access to the personal information we hold about you and information about how it has been used and to whom it has been disclosed. We will respond within 30 days, or tell you if we need an extension the law permits.

There is no charge for a reasonable request. If a request would require substantial work, we will tell you the estimated cost in advance and give you the opportunity to withdraw or narrow it.

We may refuse access in the limited circumstances the law allows — for example, where granting access would reveal personal information about another individual, where the information is protected by solicitor-client privilege, or where it would compromise an investigation. If we refuse, we will tell you why and how to challenge the decision.

If you show us that information is inaccurate or incomplete, we will correct it and, where appropriate, notify third parties who have the information.

11.5 Accountability and our Privacy Officer

PIPEDA requires us to designate an individual accountable for our compliance, and Quebec’s Law 25 requires us to publish that person’s title and contact information. Ours is:

Dave Kennerley Vice President, Engineering — designated Privacy Officer and Security Officer Agile Fleet, Inc. 14101 Willard Road, Suite D Chantilly, Virginia 20151, United States privacy@agilefleet.com

The Privacy Officer is accountable for our privacy program, for responding to access and correction requests, for answering questions about our practices — including our use of service providers outside Canada — and for liaising with privacy regulators.

Day-to-day intake, tracking, and response scheduling for privacy requests are handled by our customer support and administration team under the Privacy Officer’s direction. Accountability stays with the Privacy Officer; the clock-watching does not have to.

11.6 Commercial electronic messages (CASL)

Canada’s Anti-Spam Legislation governs the commercial electronic messages we send to recipients in Canada. We send marketing email to Canadian recipients only where we have express or implied consent under CASL. Every such message identifies Agile Fleet, gives our mailing address and contact information, and includes an unsubscribe mechanism that works for at least 60 days and that we action within 10 business days.

Service and administrative messages about your account or a transaction are not commercial electronic messages and will continue regardless of your marketing preferences.

11.7 Breach of security safeguards

If we experience a breach of security safeguards involving personal information under our control and it is reasonable to believe the breach creates a real risk of significant harm to an individual, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and we will notify any organisation that may be able to reduce the risk of harm. Where the personal information belongs to one of our customers, we notify the customer within 72 hours under our Data Processing Addendum and support the customer’s own notification obligations.

We maintain a record of every breach of security safeguards involving personal information for 24 months, whether or not it created a real risk of significant harm, and we will provide those records to the Commissioner on request.

Where Quebec or Alberta law applies, we will also notify the Commission d’accès à l’information or the Alberta Information and Privacy Commissioner as those laws require.

11.8 Quebec

We serve customers in Quebec, so Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to our handling of personal information about individuals in Quebec.

• Person in charge. Dave Kennerley, identified in Section 11.5, is the person in charge of the protection of personal information. Responsibility for the protection of personal information rests with the person exercising the highest authority in the enterprise and has been delegated to the Privacy Officer in writing.
• Privacy impact assessments. We conduct a privacy impact assessment before communicating personal information outside Quebec, and before implementing a project involving the acquisition, development, or overhaul of an information system that involves personal information. Our assessment of the transfer of personal information to the United States, described in Section 11.3, is documented and available to customers on request.
• Automated decisions. Where a decision about an individual would be based exclusively on automated processing, we will inform the individual at the time of the decision and, on request, tell them what personal information was used, the principal factors and parameters that led to the decision, their right to have that information corrected, and give them the opportunity to submit observations to a member of our personnel who can review the decision. We do not currently make decisions about individuals based exclusively on automated processing. Our AI features assist people; they do not decide.
• Portability. You have the right to receive the computerised personal information you provided to us in a structured, commonly used technological format, and to have it communicated to another person or body.
• Confidentiality by default. We apply the highest level of confidentiality by default in any product setting that involves personal information, without any intervention by you.
• Confidentiality incidents. Where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information and the affected individuals promptly, and we maintain a register of confidentiality incidents.
• Language. A French version of this policy is available at [agilefleet.com/confidentialite]. Where the French and English versions differ, the French version prevails for Quebec residents.

11.9 Complaints

If you are not satisfied with our response, you may complain to:

• the Office of the Privacy Commissioner of Canada — priv.gc.ca
• the Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• the Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca
• the Commission d’accès à l’information du Québec — cai.gouv.qc.ca

We ask that you raise the concern with our Privacy Officer first so we have the chance to resolve it.

12. European Economic Area, United Kingdom, and Switzerland

Where the GDPR, UK GDPR, or Swiss data protection law applies, you have the rights described in Section 9 and, in addition, the right to restrict or object to certain processing, the right to data portability, the right to withdraw consent, and the right to lodge a complaint with your supervisory authority.

Where personal information originating in the EEA, the United Kingdom, or Switzerland is transferred to us in the United States, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum and the Swiss addendum as applicable, as described in our Data Processing Addendum.

13. Security

We design our systems with security and privacy in mind. We protect information in storage and in transit using encryption, and we maintain physical, network, server, application, database, and procedural safeguards. Our security practices are described at [agilefleet.com/security]. We may request proof of identity before disclosing personal information to you.

No system is perfectly secure. If we experience a security incident affecting personal information, we will notify affected customers and individuals as required by law and by our agreements, as described in Section 11.7 and our Data Processing Addendum.

14. Children and students

Our services are not directed to children, and we do not knowingly collect personal information from children under 13. Where a university, college, or school district customer stores information about students in FleetCommander, that customer is responsible for its own obligations under FERPA, COPPA, applicable state student privacy laws, and, in Canada, applicable provincial education and privacy legislation. We process that information as a service provider on the customer’s instructions.

15. Changes and how to contact us

We may update this policy. We will post the updated version here with a new effective date and, where the change is material, we will notify customers in accordance with the applicable agreement — at least 30 days in advance for commercial customers and 60 days for public sector customers.

Privacy questions, rights requests, and complaints: Dave Kennerley, Privacy Officer privacy@agilefleet.com

Security concerns and vulnerability reports: security@agilefleet.com

Agile Fleet, Inc. 14101 Willard Road, Suite D Chantilly, Virginia 20151 United States

Product support: fcsupport@agilefleet.com Customer success: cs@agilefleet.com