Privacy Policy
Version 1.1 · Effective 01 September 2026
This policy explains how Fleeta Limited (trading as OperatorCompliance; company number 16675897; 50 Princes Street, Ipswich IP1 1RJ) uses personal data when you visit operatorcompliance.co.uk, create an account, or use the Service. For drivers whose data is processed on behalf of an operator, please also read the Driver Privacy Notice.
Contact: privacy@operatorcompliance.co.uk. Fleeta Limited is registered with the Information Commissioner's Office as a data controller, registration number ZC229278.
1. When we are the controller
We decide why and how personal data is used for:
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Operating your account (login, roles, support) | name, email, phone, password hash, IP, login history | contract | account life; a verified deletion request is completed within 30 days, subject to limited legal-retention exceptions |
| Billing | billing contact, invoices, last 4 card digits (card data is held by Stripe) | contract; legal obligation (tax) | 7 years |
| Security and audit logs | user actions in the Service, IP, device | legitimate interests (security, evidencing compliance) | 24 months |
| Transactional email (alerts, digests, reports) | email, name | contract | log 12 months |
| Marketing to business contacts | name, email, company | legitimate interests (B2B); you can opt out any time | until opt-out |
| Contact forms and enquiries | name, email, company, message | legitimate interests | 24 months |
| Cookie-less website analytics | aggregated page, country and referring-site statistics | legitimate interests | 26 months |
| Optional Google Analytics | pseudonymous browser, page, campaign and signup-event data; no account or driver details | consent | the period configured in the GA4 property (Google's standard options are 2 or 14 months for user and event-level data); aggregated reports may be retained longer |
| Signup campaign attribution | approved UTM source, medium, campaign, ID, content and term values, plus capture time, when an account is created | legitimate interests (measuring B2B campaigns) | account life; removed with the account, subject to limited legal-retention exceptions |
| Driver consent & mandate declarations signed through the Service | driver name, last 8 of licence, signature, IP, timestamps | operator's legal obligations and legitimate interests in retaining auditable evidence | period required by the operator's approved DVLA arrangement and evidence needs, up to 7 years |
2. When we are a processor
Vehicle, driver and tachograph records that operators enter or upload are processed on the operator's instructions under our Data Processing Agreement. The operator is the controller; requests about that data should go to the operator first, and we will assist them.
3. Where data comes from
From you (forms, uploads), from your users, from public and government sources we query on your behalf (DVSA MOT history, DVLA vehicle enquiry, DVSA operator-licence open data, DVLA driver data where you have enabled it and hold the driver's mandate), and from our service providers (payment and email status).
4. Who we share data with
Sub-processors listed at /legal/subprocessors (hosting and backups, email delivery, optional public-site analytics, map services, payments and user-requested licence-photo text extraction); professional advisers; authorities where legally required. Report and consent signing takes place inside OperatorCompliance rather than through an external signing provider. We do not sell personal data. DVSA/DVLA receive the registration numbers, trailer IDs and (with mandate) licence numbers needed to answer a query.
5. International transfers
Data is hosted in the United Kingdom, with encrypted backup copies held with OVHcloud in the EU. Some providers (Microsoft 365 email, Stripe, OpenAI for licence-photo reading, Ahrefs Web Analytics, optional Google Analytics and Google Maps on the free DVS page) may process data in the EEA, Singapore or USA under the UK International Data Transfer Addendum, adequacy regulations or standard contractual clauses. Our website uses Google Fonts and, on the DVS zone map page only, Google Maps; those requests disclose your IP address to Google. Ahrefs derives coarse location from the IP address and then discards the raw address. Google Analytics is not loaded until you consent.
6. Security
Encryption in transit (TLS), field-level encryption of driving-licence numbers and National Insurance numbers in the database, encrypted off-site backups, role-based access with per-operator isolation, an activity log of changes to vehicles, drivers and reports, nightly backups, least-privilege infrastructure access and staff confidentiality obligations. Optional two-factor authentication (authenticator app) is available for every customer account.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent where consent is the basis. Email privacy@operatorcompliance.co.uk; we respond within one month. You can complain to the ICO at ico.org.uk.
Deleting your account. Operators, team members and drivers using our Android apps can have their account and data deleted at any time: see Delete your account for the steps, what is removed, what we must keep by law and how long it takes.
8. Cookies and analytics choices
See the Cookie Policy for the necessary application cookies, cookie-less Ahrefs statistics, optional Google Analytics cookies and how to change or withdraw your analytics choice. Google Analytics is blocked until you actively accept it.
9. Changes
We will post changes here and, for material changes, email account holders 30 days in advance.