Privacy Notice

Who we are

FleetSafe (“we”, “us”) is the data controller of the personal data set out below. Where your employer uses FleetSafe, your employer is the controller of the records it keeps about you as a driver or employee, and we act as its processor for those records.

What we collect

• Account details — your name, work email address, password (stored only as a secure hash), your company role (manager or employee), separate platform-owner status where applicable, and the company you belong to.
• Company details — the company name entered when the account was created, and the emails of people we have invited to join.
• Fleet and operational records — information you and your team enter: vehicle registrations, make and model, MOT, service, insurance and tax due dates, assigned drivers, daily walkaround check results and mileage, defects and their severity, tool names, serial numbers, damage notes and movement history, and stock item counts.
• Activity and security data — the time a check, defect report, tool move or stock change was made and by whom, sign-in events, IP address, and device or browser information used to keep accounts secure and to spot misuse.
• Support messages — anything you send us when you ask for help or report a problem.

Payment card details are not collected or stored by us. Billing, card details, tax and invoicing are handled by Paddle as Merchant of Record under its own privacy notice.

Why we use it, and our legal basis

• To provide the service you signed up for — creating and managing your account, showing each van’s tools, checks, stock and reminders, and keeping each company’s data separate from every other company. Basis: performance of a contract.
• To keep the service secure — authenticating users, preventing unauthorised access to another company’s data, and detecting fraud, abuse and automated scraping. Basis: legitimate interests (the safe running of the service).
• To support you — answering questions, investigating a fault you have reported, and following up on a refund request. Basis: legitimate interests and, where you contact us, performance of a contract.
• To improve FleetSafe — in aggregate and in a form that does not identify your company wherever practicable. Basis: legitimate interests (developing and improving the product).
• To meet legal duties — including tax, accounting and record-keeping obligations, and responding to a valid request from a public authority. Basis: legal obligation.
• Where consent is needed — for example optional marketing emails. Basis: consent, which you can withdraw at any time without affecting the service.

Who we share it with

• Service providers and sub-processors — suppliers that host and store the application, send sign-in and notification emails, and provide the database and infrastructure that run the service. They act on our instructions and may only use data to deliver their part of the service.
• Our Merchant of Record, Paddle — for the sale of the product, subscription management, payments, tax compliance and invoicing. Paddle acts as an independent controller for that processing.
• Professional advisers — our lawyers and accountants, where they need to see information to advise us.
• Authorities — the police, a court, a regulator or another public body, where we are required by law or by a valid legal process to disclose information.

We do not sell your personal data, and we do not share it for advertising.

Manager-approved owner support access

The platform owner is not a company manager. Without an approved support request, the owner can see company names, van counts and trial or subscription status, but cannot open a company’s fleet data. A company manager can request support with an optional note and separately approve access for 24 hours. A request alone does not grant access. Managers can revoke approval at any time; approvals expire automatically after 24 hours and cannot be extended without a new approval.

While approval is active, the owner can view that company’s vehicles, assigned-driver names, tools, consumables, safety checks, defects and tool movements, and make emergency corrections without manager rights. We use this access only to provide approved support and investigate faults, acting on the company’s instructions for its fleet records. The legal basis for our support-access administration and security records is legitimate interests in providing safe, accountable support. Dangerous defects can still only be cleared by a company manager.

We keep the request note, requesting and approving manager, approval and expiry times, and any revocation. Every owner fleet view or edit is logged and visible to company managers; edit logs include the actor, time, reason and before-and-after values. These support records follow the company-record retention period described below. Owner access is checked separately from company permissions and does not allow another company to access your data.

Where your data is kept

Your data is hosted on our infrastructure. Some of our suppliers process data outside the UK and the European Economic Area. Where that happens we rely on safeguards such as the UK’s adequacy regulations or the EU Standard Contractual Clauses, together with technical and contractual controls, to make sure the same level of protection applies.

How long we keep it

We keep account and fleet records while your subscription is open. When your access ends you have 30 days to ask for your records, after which we delete or anonymise your company’s data, unless we have to keep something for a legal reason such as tax records. Support messages are kept for a short period after an issue is closed.

How we protect it

We use appropriate technical and organisational measures: data is encrypted in transit, passwords are stored only as salted hashes, access to production systems is restricted to the small number of people who need it, and every record in the database is tied to a single company so that one company cannot read another’s vans, tools, checks, stock or staff. We review these measures as the service grows.

Your rights

Under UK data protection law you can ask to:

• see a copy of the personal data we hold about you (access);
• have incorrect data corrected (rectification);
• have your data erased where there is no lawful reason to keep it (erasure);
• limit how we use your data (restriction);
• receive your data in a portable format, or have it sent to another provider (portability);
• ask us to stop processing your data in certain circumstances (objection); and
• withdraw a consent you have given, at any time.

We will respond within one month. If you are unhappy with how we have handled a request, you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority. If you are a driver or employee, speak to your manager first — they control your fleet records and can make changes to them directly in the app.

Cookies and local storage

FleetSafe uses strictly necessary browser storage to keep you signed in and to remember the company account you are using. These are essential for the service to work and cannot be turned off. We do not use advertising, tracking or marketing cookies, and we do not run third-party advertising trackers on the site.

Children

FleetSafe is a business tool for organisations and is not directed at children. We do not knowingly collect data from anyone under 18.

Changes to this notice

We may update this notice. If we make a material change we will tell you in the app or by email, and the date at the top of the page will change.

Contact

To exercise a right, ask a question about this notice, or raise a concern, contact us through the app or by replying to any email we have sent you about your account.