Driver Privacy Notice
Version 1.0 · Effective 01 September 2026
This notice is for drivers whose details are held in OperatorCompliance by the transport operator they drive for (their employer, or the operator they work for through an agency or as a self-employed driver).
Who is responsible
- Your operator decides what is processed and why. It is the data controller. Contact your transport office first with any question or request.
- Fleeta Limited (trading as OperatorCompliance, company number 16675897, 50 Princes Street, Ipswich IP1 1RJ) runs the software and performs analysis on the operator's instructions. For most data we are a processor. For the signed consent declaration itself, and for messages we send you, we also keep our own record as a controller. Contact: privacy@operatorcompliance.co.uk.
What is processed and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, date of birth, contact details, employee reference, preferred language | to identify you and send you documents in your language | operator's legitimate interests / contract of employment |
| Driving licence number (encrypted), status, type, entitlements, endorsements and penalty points, disqualifications, photocard expiry, licence images you or the operator upload | to confirm you hold the right entitlement for the vehicles you drive and to manage risk - an operator-licence undertaking | operator's legal obligations and legitimate interests; your signed declaration for the DVLA enquiry |
| Driver CPC (DQC) card and expiry | legal requirement to drive professionally | legal obligation |
| Tachograph card number and expiry; tachograph download files (.DDD) with your activities, places and vehicles | drivers' hours record-keeping, 28-day download rule, infringement analysis required of operators by law | legal obligation (Regulation (EC) 561/2006 Art 10, Transport Act 1968) and legitimate interests |
| Infringement reports, your comments, your e-signature, DocuSign audit data (IP, time) | to evidence the operator's driver debrief and your acknowledgement | legitimate interests; legal obligation |
| Emails and messages we send you and your replies | to communicate about checks, consent renewals and reports on the operator's behalf | legitimate interests |
Where the data comes from
You, your operator, the DVLA (when a check is made with your check code or under your signed mandate via DVLA's Access to Driver Data service), your tachograph card and vehicle units, and DocuSign (signing events).
Who sees it
Your operator's authorised staff (transport manager, owners, users they add); OperatorCompliance analysts and support staff under confidentiality; DocuSign (for signing); email delivery providers; DVLA (your licence number when a check is requested). No one else unless the law requires it.
How long
Tachograph data and reports: at least 12 months after the record date (working-time records 2 years), typically 24 months. Licence-check results: while you drive for the operator plus 15 months. Your signed declaration: 7 years (DVLA requirement). Account of the operator closed: data exported to the operator and deleted after 90 days unless law requires retention.
Your rights
You may ask your operator (or us) for a copy of your data, to correct it, to erase it where no legal duty requires retention, to restrict or object to processing, and you may withdraw your consent to DVLA checks at any time by telling your operator or emailing privacy@operatorcompliance.co.uk. Withdrawal does not affect checks already done; the operator may still be legally required to keep existing records and may need to reconsider your driving duties. You can complain to the Information Commissioner's Office (ico.org.uk).
Security
Data is hosted in the UK, encrypted in transit and at rest; licence numbers are encrypted in the database; access is role-based and logged.
Automated decisions
No decisions with legal effect are made about you automatically. Penalty-point "risk bands" only change how often a human re-checks the licence; reports are prepared and reviewed by people.