Draft for review. This notice was written to match what this site and product actually do, but it has not been reviewed by a solicitor and it contains items only the business can complete — each marked [REVIEW] below. Do not treat this as final until those are resolved and someone qualified has read it.
Privacy notice
This notice explains what personal data Fleet Management System collects, why we collect it, how long we keep it, and what rights you have. It covers both this website and the Fleet Management System application.
If you are a driver using the Fleet CRM driver app, the app has its own driver app privacy policy.
Who we are
[REVIEW] Fleet Management System Ltd, registered in England and Wales, company number [REVIEW: company number], registered office [REVIEW: registered address]. We are the data controller for the data described in "Data we collect about you" below. Contact us at [REVIEW: privacy contact email].
[REVIEW] Whether registration with the Information Commissioner's Office is required, and the registration number if so.
Controller and processor: which one we are
This distinction matters and is easy to get wrong, so it is stated first.
- For this website and your account with us — demo requests, newsletter signups, your login, your billing — we are the controller.
- For the fleet data you put into the application — your drivers, their licence and medical details, vehicle records, positions — you are the controller and we are the processor. You decide what goes in and why; we hold and process it on your instructions. Your own privacy notice, not this one, governs what you tell your drivers.
Data we collect about you
| What | When | Lawful basis |
|---|---|---|
| Name, work email, phone, company name, fleet size | You submit a demo request or contact form | Legitimate interests — responding to a business enquiry you made |
| Email address | You subscribe to the newsletter | Consent, which you may withdraw at any time |
| Name, email, hashed password, company membership | An account is created for you | Contract — we cannot provide the service without it |
| Billing name, address and card details | You subscribe | Contract. Card details are typed into Stripe's own card fields and never reach our servers. |
| Failed login count and lockout time | Automatically, on failed sign-in | Legitimate interests — protecting accounts from brute-force attempts |
| Usage and device data via Google Analytics | You browse this site and accept analytics cookies | Consent — see the cookie policy |
| Server logs including IP address | Automatically, on every request | Legitimate interests — security, diagnostics and abuse prevention |
We do not buy contact lists, and we do not carry out automated decision-making or profiling that has legal effects.
Special category data
Fleet operation involves data that needs care. Driver medical examination dates and any fitness-to-drive information you record may amount to health data, which is a special category under UK GDPR. Where you record it, you are the controller and you need your own lawful basis and condition for processing it — usually employment-related. We process it only to provide the service to you.
Vehicle position history can reveal an identifiable driver's movements, including outside working hours. If you use tracking, tell your drivers what is recorded and why. The system stores positions with the speed reported by your telematics provider; it does not infer driver behaviour scores from them unless you enable that.
How long we keep it
[REVIEW: retention periods] These are decisions for the business, not defaults we can set on your behalf. Our current position:
- Demo requests and contact enquiries — [REVIEW] months after last contact.
- Newsletter subscribers — until you unsubscribe, then removed.
- Account and fleet data — for the life of your subscription. On termination, see "Your data when you leave" in the terms of service.
- Billing records — six years, as UK tax law requires.
- Server logs — [REVIEW] days.
Note that closing a company account currently marks it deleted and stops access rather than erasing the underlying rows. A full hard deletion on request is not built yet; we do it by hand when asked, and the terms say so.
Who we share it with
We do not sell personal data. We use these processors:
| Processor | For | Where |
|---|---|---|
| Stripe | Payments, subscriptions and invoices | UK/EU and US, under Stripe's own transfer safeguards |
| Google Analytics | Website usage statistics, only with your consent | US, under the UK extension to the EU–US Data Privacy Framework |
| [REVIEW] Hosting provider | Running the service | [REVIEW: hosting region] |
We also disclose data where we are legally required to.
Your rights
Under UK GDPR you may request access to your data, correction of it, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where we rely on consent you may withdraw it at any time. Exercise any of these by writing to [REVIEW: privacy contact email]; we respond within one month.
If your data is in a customer's fleet records — if you are a driver, for example — direct your request to that company, which is the controller. Pass it to us and we will forward it to them.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.
Security
Passwords are stored hashed, never in plaintext. Payment card details never touch our servers. Access to the application is permission-gated per module and per action, and each company's data is isolated at the query level. Payment provider keys, and the keys for the other services we connect to, are held encrypted at rest. No system is perfectly secure, and we will tell you and the ICO within 72 hours if a breach affects your data and meets the reporting threshold.
Changes
We will update this notice as the product changes — email notifications and a full data export are both planned, and both will change what is written here. Material changes will be notified to account holders.
[REVIEW] Last updated: to be set on publication.