Privacy Policy
Version 1.0 · Effective 01 September 2026
This policy explains how Fleeta Limited (trading as OperatorCompliance; company number 16675897; 50 Princes Street, Ipswich IP1 1RJ) uses personal data when you visit operatorcompliance.co.uk, create an account, or use the Service. For drivers whose data is processed on behalf of an operator, please also read the Driver Privacy Notice.
Contact: privacy@operatorcompliance.co.uk. We are registered with the Information Commissioner's Office (registration number shown on the Company Information page once issued).
1. When we are the controller
We decide why and how personal data is used for:
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Operating your account (login, roles, 2FA, support) | name, email, phone, password hash, IP, login history | contract | account life + 90 days |
| Billing | billing contact, invoices, last 4 card digits (card data is held by Stripe) | contract; legal obligation (tax) | 7 years |
| Security and audit logs | user actions in the Service, IP, device | legitimate interests (security, evidencing compliance) | 24 months |
| Transactional email (alerts, digests, reports) | email, name | contract | log 12 months |
| Marketing to business contacts | name, email, company | legitimate interests (B2B); you can opt out any time | until opt-out |
| Contact forms and enquiries | name, email, company, message | legitimate interests | 24 months |
| Website analytics | aggregated, cookie-less page statistics | legitimate interests | 26 months |
| Driver consent & mandate declarations signed through the Service | driver name, last 8 of licence, signature, IP, timestamps | legal obligation (DVLA requires the record to be retained) and legitimate interests | 7 years |
2. When we are a processor
Vehicle, driver and tachograph records that operators enter or upload are processed on the operator's instructions under our Data Processing Agreement. The operator is the controller; requests about that data should go to the operator first, and we will assist them.
3. Where data comes from
From you (forms, uploads), from your users, from public and government sources we query on your behalf (DVSA MOT history, DVLA vehicle enquiry, DVSA operator-licence open data, DVLA driver data where you have enabled it and hold the driver's mandate), and from our service providers (payment and email status).
4. Who we share data with
Sub-processors listed at /legal/subprocessors (hosting in the UK/EEA, email delivery, payments, electronic signatures, error monitoring); professional advisers; authorities where legally required. We do not sell personal data. DVSA/DVLA receive the registration numbers, trailer IDs and (with mandate) licence numbers needed to answer a query.
5. International transfers
Data is hosted in the United Kingdom. Some providers (DocuSign, Stripe, email delivery) may process data in the EEA or USA under the UK International Data Transfer Addendum / adequacy regulations.
6. Security
Encryption in transit (TLS) and at rest, field-level encryption for driving-licence numbers, role-based access, two-factor authentication, audit logs, daily backups, least-privilege infrastructure access, and staff confidentiality obligations.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent where consent is the basis. Email privacy@operatorcompliance.co.uk; we respond within one month. You can complain to the ICO at ico.org.uk.
8. Cookies
See the Cookie Policy. We use only strictly necessary cookies on the public site and session cookies in the application.
9. Changes
We will post changes here and, for material changes, email account holders 30 days in advance.