Tracking
Tracking Consent
Pointeron requires informed consent before tracking any individual. When you create a Person-type asset, a consent request is automatically sent to the tracked person. Tracking only begins after they explicitly accept.
How consent works
When you create an asset with type Person, Pointeron enforces a consent flow before any location data is collected:
- You enter the tracked person's name and email address during asset creation
- Pointeron sends a consent request email with full GDPR disclosure
- The tracked person clicks the link and sees a public consent page
- They choose to accept or decline the request
- If accepted, tracking activates. If declined, the asset remains inactive.
The tracked person can later pause, resume, or withdraw consent at any time by revisiting their consent link.
Consent is mandatory
Person-type assets are created with tracking disabled (is_active = false). Location data is not collected until the tracked person provides consent. This is a legal requirement under GDPR Article 6 and cannot be bypassed.
Creating a person asset
When you select Person as the asset type in the create form, two additional fields appear:
| Field | Required | Description |
|---|---|---|
| Person's Full Name | Yes | The name of the individual being tracked |
| Person's Email | Yes | Where the consent request will be sent |
After creation, the asset appears in your asset list with a Consent Pending badge. Tracking will not begin until the person responds.
The consent request email
The email sent to the tracked person includes:
- The organization name requesting the tracking
- What data will be collected: GPS coordinates, speed, heading, battery level, timestamps
- Who can access the data: authorized members of the organization
- Data retention period: according to the organization's plan
- GDPR rights (Articles 15-21): access, rectification, erasure, restriction, portability, objection, withdraw consent
- A link to the public consent page where they can accept or decline
Resending invitations
If the tracked person hasn't responded, you can resend the invitation from the asset detail page. There is a 5-minute cooldown between resends, with a maximum of 5 resends per consent request.
The public consent page
The consent page is a standalone public page (no login required) at /consent/{uuid}. It shows:
- Organization name and what tracking involves
- Detailed data collection disclosure
- GDPR rights with actionable instructions for each
- Accept and Decline buttons
After accepting, the page becomes a consent management panel where the tracked person can:
- Pause location sharing temporarily
- Resume sharing after a pause
- Withdraw consent permanently (stops all tracking)
Bookmark the link
The tracked person should bookmark their consent page URL. It is their permanent portal for managing consent. The link is also included in every notification email.
Consent statuses
| Status | Meaning | Tracking active? |
|---|---|---|
| Pending | Consent request sent, awaiting response | No |
| Accepted | Person accepted, tracking is active | Yes |
| Accepted (Paused) | Person paused sharing temporarily | No |
| Declined | Person declined the request | No |
| Withdrawn | Person withdrew previously given consent | No |
| Revoked | Organization owner cancelled the consent | No |
| Expired | Consent expired after 12 months | No |
Managing consents
Consents dashboard
Navigate to Consents in the sidebar to see all consent records across your organization. The page shows:
- Stats cards: Total, Pending, Accepted, Declined, Revoked
- Tab filters: Filter by status
- Expandable timeline: Click any row to see the full chronological history of that consent
From the asset detail page
For any Person-type asset, the detail page shows:
- A consent status banner with the person's name, email, and current status
- Resend button (when pending, with cooldown indicator)
- Revoke Consent button (opens a confirmation modal)
Changing the tracked person
From the asset edit page, you can change the person's name and email. When saved with different details:
- The existing consent is automatically revoked
- A new consent request is sent to the new email
- The asset returns to inactive until the new person accepts
Consent expiry and renewal
- Consents automatically expire 12 months after acceptance
- A renewal reminder email is sent 30 days before expiry
- When a consent expires, the asset's tracking is automatically deactivated
- To resume tracking, create a new consent request from the asset edit page
These are platform defaults (configurable by the Pointeron team for custom deployments):
| Setting | Default | Description |
|---|---|---|
TRACKING_CONSENT_EXPIRY_MONTHS | 12 | Months until consent expires |
TRACKING_CONSENT_RENEWAL_DAYS | 30 | Days before expiry to send reminder |
TRACKING_CONSENT_RESEND_COOLDOWN_MINUTES | 5 | Minutes between resend attempts |
Audit trail
Every consent action is permanently recorded in the organization's Activity Log:
- consent_requested -- consent invitation sent
- consent_accepted -- person accepted
- consent_declined -- person declined
- tracking_paused -- person paused sharing
- tracking_resumed -- person resumed sharing
- consent_withdrawn -- person withdrew consent
- consent_revoked -- organization owner revoked consent
- consent_resent -- invitation resent
Consent records are never deleted. Even when revoked, the record is preserved with full timestamps for legal compliance.
Employee tracking
Additional requirements for employee tracking
If you use Pointeron to track employees, additional legal requirements apply beyond basic consent:
- A Data Protection Impact Assessment (DPIA) must be conducted before deployment
- Tracking must generally be limited to working hours unless specific justification exists
- Employees must be informed in writing about what data is collected, for what purpose, and how long it is retained
- An internal policy document governing GPS tracking should be adopted
- The works council or trade union should be consulted where applicable
These requirements come from GDPR Article 35, the ePrivacy Directive, and national employment law. Consult a data protection specialist for your jurisdiction.
Criminal law notice
Using Pointeron to track any person without their informed consent may constitute a criminal offense under EU Directive 2024/1385 on combating violence against women and domestic violence (cyberstalking provisions), as well as under the Slovenian Criminal Code (KZ-1 Article 134a), which carries penalties of up to 3 years imprisonment.
Age requirements
The tracked person must be at least 15 years old to provide their own consent (age of digital consent in Slovenia under ZVOP-2). If the tracked person is under 15, consent must be provided by a parent or legal guardian. It is the organization's responsibility to verify the age of tracked individuals.
GDPR rights for tracked persons
Tracked individuals can exercise their data rights directly from their consent page -- no email required:
| Right | How to exercise |
|---|---|
| Pause/stop tracking | Use the Pause or Withdraw buttons on the consent page |
| Access your data | Click Request My Data on the consent page. A JSON export is generated automatically and a download link is provided (valid for 7 days) |
| Erasure (right to be forgotten) | Click Request Data Deletion on the consent page. All location data is permanently deleted. The organization must respond within 30 days |
| Data portability | The data export (above) is provided in structured JSON format per GDPR Article 20 |
| Rectification | Contact privacy@pointeron.com to correct inaccurate personal data |
| Restriction / Objection | Contact privacy@pointeron.com or the Slovenian Information Commissioner |
All data requests are tracked with full audit trail: submission date, 30-day deadline, fulfillment status, and response notes. Both the tracked person and the organization owner can see the status at all times.
For more details, see our Privacy Policy.