Driver Privacy Notice
Version 1.2 · Effective 28 September 2026
The English version of this document is the legally binding one; a translation is not yet available.
Documentele noastre legale sunt publicate în engleză. Dacă există vreo neconcordanță între o traducere și textul în engleză, versiunea în engleză se aplică.
This notice is for drivers whose details are held in OperatorCompliance by the transport operator they drive for (their employer, or the operator they work for through an agency or as a self-employed driver).
Who is responsible
- Your operator decides what is processed and why. It is the data controller. Contact your transport office first with any question or request.
- Fleeta Limited (trading as OperatorCompliance, company number 16675897, 50 Princes Street, Ipswich IP1 1RJ) runs the software and performs analysis on the operator's instructions. For most data we are a processor. For the signed consent declaration itself, and for messages we send you, we also keep our own record as a controller. Contact: privacy@operatorcompliance.co.uk.
What is processed and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, date of birth, contact details, employee reference, preferred language | to identify you and send you documents in your language | operator's legitimate interests / contract of employment |
| Driving licence number (encrypted), status, type, entitlements, endorsements and penalty points, disqualifications, photocard expiry, licence images you or the operator upload | to confirm you hold the right entitlement for the vehicles you drive and to manage risk - an operator-licence undertaking | operator's legal obligations and legitimate interests; your signed declaration for the DVLA enquiry |
| Driver CPC (DQC) card and expiry | legal requirement to drive professionally | legal obligation |
| Tachograph card number and expiry; tachograph download files (.DDD) with your activities, places and vehicles | drivers' hours record-keeping, 28-day download rule, infringement analysis required of operators by law | legal obligation (Regulation (EC) 561/2006 Art 10, Transport Act 1968) and legitimate interests |
| Right to work: the Home Office share code you give (stored encrypted) and your date of birth, and the check result - your right-to-work status, any time limit, permitted work and the Home Office reference number | to confirm you are allowed to work in the UK, which your employer must check by law | operator's legal duty to prevent illegal working (Immigration, Asylum and Nationality Act 2006); your signed declaration to obtain and use the share code |
| Infringement reports, your comments, your e-signature and its certificate (typed name, drawn signature, IP address, time) | to evidence the operator's driver debrief and your acknowledgement | legitimate interests; legal obligation |
| Emails and messages we send you and your replies | to communicate about checks, consent renewals and reports on the operator's behalf | legitimate interests |
- Licence photos and National Insurance number you may choose to submit when signing the consent form: used to verify your driving-licence details on the operator's behalf (the printed fields are read from the photos and compared with your record). Licence photos are kept in private, non-public application storage and served only after an authorised access check; licence and National Insurance numbers are field-level encrypted in the database. These items are deleted with your driver record unless the operator has a legal reason to retain the associated compliance evidence.
- Right-to-work share code. A share code, and the result the check returns, reveal your immigration status, which is sensitive personal data. Your share code is held encrypted, is used only to run and (where needed) repeat the right-to-work check, and is never used for anything else. Your employer must also confirm that the photograph the check shows is you, and keep the result for as long as you work for them and for two years afterwards.
Where the data comes from
You, your operator, the DVLA (when a check is made with your check code or under your signed mandate via DVLA's Access to Driver Data service), and your tachograph card and vehicle units. Consent and report-signing events are recorded directly by OperatorCompliance.
Who sees it
Your operator's authorised staff (transport manager, owners, users they add); OperatorCompliance analysts and support staff under confidentiality; email delivery providers; and the DVLA (your licence number when a check is requested). No one else unless the law requires it.
How long
Tachograph data and reports: at least 12 months after the record date (working-time records 2 years), typically 24 months. Licence-check results: while you drive for the operator plus 15 months. Your signed declaration: 7 years where the operator is required to retain it. Closing or cancelling a subscription pauses access but does not, by itself, authorise deletion of the operator's statutory records. A verified owner deletion request is handled under our account-deletion process.
Your rights
You may ask your operator (or us) for a copy of your data, to correct it, to erase it where no legal duty requires retention, to restrict or object to processing, and you may withdraw your consent to DVLA checks at any time by telling your operator or emailing privacy@operatorcompliance.co.uk. Withdrawal does not affect checks already done; the operator may still be legally required to keep existing records and may need to reconsider your driving duties. You can complain to the Information Commissioner's Office (ico.org.uk).
Security
Data is hosted in the UK with encrypted backup copies in the EU (OVHcloud); it is encrypted in transit; licence numbers and National Insurance numbers are encrypted in the database; access is role-based, limited to your operator and OperatorCompliance staff, and logged. Sign-ins to your driver app login (time, IP address and a short device description) are recorded to protect your account and deleted after 90 days. If your operator uses the "Read licence photo" feature, or you submit licence photos when signing the consent form, the photos are sent once to OpenAI (USA) to read the printed fields and are not retained by them for training.
Criminal offence data
Endorsements, penalty points, disqualifications and drivers'-hours infringement findings are "criminal offence data" under Article 10 UK GDPR. Your operator processes them because the law requires it to check and manage its drivers (Goods Vehicles (Licensing of Operators) Act 1995, Road Traffic Act 1988 and the drivers'-hours and tachograph rules) and under Schedule 1, Part 1 (employment) and Part 3 (regulatory requirements) of the Data Protection Act 2018. OperatorCompliance processes this data only on your operator's instructions.
Automated decisions
No decisions with legal effect are made about you automatically. Penalty-point "risk bands" only change how often a human re-checks the licence; reports are prepared and reviewed by people.