Privacy notice

Draft · version privacy-2026-10-23 · effective 23 October 2026. This draft has not yet been reviewed by a solicitor and may change. FleetMate does not hold any security certification.

Who we are and our role

FleetMateUK is operated by Ion-Silviu Mihai, a UK sole trader trading as FleetMateUK. For privacy enquiries about data FleetMateUK controls, contact privacy@fleetmate.uk.

FleetMate (fleetmate.uk) provides software to vehicle collection, delivery and transfer companies. For the operational data a customer company puts into FleetMate — jobs, staff, drivers, vehicle registrations, addresses, photos, inspections, GPS — that company is the controller and FleetMate is its processor under UK GDPR. For our own account, security and support records, FleetMate is the controller.

What we process

• Account data: name, email, phone, sign-in records, role in a company.
• Operational data entered by the customer: jobs, customer contacts, addresses, registrations, inspection results, photos and optional recorded signatures.
• Driver location, only while a driver has started tracking on an active work job; it stops when the job or shift ends.
• Support tickets: the error code, severity, app/browser version and a random reference; your description only if you choose to share it. Text is automatically redacted of emails, phone numbers, postcodes, registrations, locations, links and keys.
• Technical diagnostics without message contents, file names or customer values.

Who can see customer data

Only active members of the same company, according to their role. FleetMate's platform operators use a separate console that shows company names, account status, plan/trial, storage totals, counts and redacted support metadata — not jobs, drivers, GPS, registrations, photos, documents or prices. Our infrastructure providers and a small number of engineers could technically access stored data in an emergency (for example, restoring service); such access is not routine and should be logged.

Lawful basis

For our own records: contract and legitimate interests (security, fraud prevention, support). For customer operational data: the customer's instructions under the data processing agreement. Employers using GPS must give drivers clear information and complete a DPIA.

Retention

Customers set retention within limits; GPS history defaults to 90 days. Support tickets expire after 12 months. Records under legal holds or required for tax/claims are kept as needed. See the retention schedule in the DPA.

Your rights

You can request access, correction, erasure, restriction, objection and portability. If you are a driver or a customer of a FleetMate company, contact that company first; we will help them respond. You can complain to the ICO (ico.org.uk).

Privacy contact and requests

For privacy questions or requests concerning information FleetMateUK controls, including account and support records, contact privacy@fleetmate.uk. This address is also available if you no longer have access to your account. For driver, customer and vehicle-job records controlled by a company using FleetMateUK, contact that company first; we can help route a request when appropriate. We may ask for proportionate identity verification. Do not include passwords, access tokens or unnecessary sensitive information in the initial email. See our data deletion instructions.

Privacy enquiries emailed to FleetMateUK may contain the sender's address, message, attachments and delivery information. Cloudflare Email Routing forwards incoming messages to a Google-hosted Gmail mailbox used by the operator; replies are sent through Resend SMTP. These providers may process the information people choose to send in order to handle the correspondence. This separate privacy email service does not mean that in-app job email or push notifications have been enabled.

Cookies and storage

We use only what's needed for sign-in and to keep the app working (session storage in your browser). No advertising or third-party analytics cookies. Map tiles are loaded from OpenStreetMap servers, which see your IP address.

International transfers

Some providers may process data outside the UK; where they do, we rely on UK adequacy regulations or the International Data Transfer Addendum.

Security

Encryption in transit, company-separated access rules in the database, private file storage with short-lived links, and audited administrative actions. This is not end-to-end encryption, and no system is perfectly secure. We will notify affected customers without undue delay if a breach affects their data.