Privacy Policy
About this Privacy Policy
At Fleet Operations Limited (also trading as Traxall UK), we take the protection of your personal information seriously.
This policy explains what information we collect, why we need it, how we use and protect it, and what rights you have. We want to make it as easy as possible for you to understand how your information is handled.
We sometimes process personal information on behalf of our customers, for example when providing fleet management services to their employees and drivers. In these cases, our customer is generally responsible for deciding how that information is used, and their own privacy policy will usually apply.
When we use personal information for our own business purposes, such as managing customer relationships, recruitment or operating our website, we are responsible for that information and this policy applies.
In data protection terms, this means we act as a data controller for the activities covered by this policy and usually as a data processor when acting on our customers’ instructions. Where we act as controller, we follow the UK GDPR, Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).
1. What information do we collect?
The information we collect depends on your relationship with us. It may include:
- Contact and business details: name, title, address, email, phone number, employer, job role and correspondence with us.
- Driver and vehicle information: driving licence details, endorsements, date of birth, employment status, vehicle needs and, where used, telematics information such as location, selected trip history, safety events and trip categories.
- Information about support needs: relevant disability, health or mobility information where necessary to arrange suitable vehicles, assistance or reasonable adjustments.
- Financial information: billing and payment details and, where a credit application or financial check is needed, banking, income, expenditure, credit history and relevant home ownership information.
- Website and service activity: pages visited, referral sources, device information, usage statistics, portal and app activity, feedback, complaints, surveys and competition entries.
- Recruitment and employment information: application and employment records, identity documents, nationality, immigration or visa information, Right to Work share codes, photographs and relevant verification results.
- Security and communications records: emails, system access records, CCTV or visitor logs where used, and calls that may be recorded for service, training, quality or dispute resolution.
We only collect information relevant to the purpose concerned. Some information, including health data and biometric information used to identify a person, is special category data and needs additional protection. Driving licence endorsements may also reveal information about offences or penalties; where we act as controller, we assess and handle this information in line with applicable data protection requirements.
2. Where does the information come from?
Most information comes from you, including through conversations, emails, our website, portals and apps. We may also receive it from your employer or another customer, someone acting on your behalf, the DVLA, identity and due diligence providers, credit reference agencies, financial institutions, marketing partners, social media or our service suppliers, as appropriate. We also collect information from cookies and security or access-monitoring systems.
When we process information on a customer’s instructions, that customer generally determines what is collected and the purpose for which it is used.
3. Why do we use it, and what is our lawful basis?
Data protection law requires us to have a lawful reason for using personal information. The main purposes and lawful bases below apply where we act as controller. Where we act only as a processor, our customer decides the purposes and lawful bases.
| Purpose | Lawful basis |
|---|---|
| Providing and managing services, customer accounts, enquiries, contracts, vehicle-related support and records | Contract, where we have a contract with you personally. Otherwise, legitimate interests in providing and managing services to business customers, responding to enquiries and maintaining customer relationships, where applicable. |
| Running our business, improving services and digital channels, training, quality control, administration and handling correspondence | Legitimate interests in operating, administering and improving our business and services. |
| Safety, security, preventing fraud and crime, protecting confidential information, managing disputes and legal claims | Legitimate interests in protecting people, systems and our business, preventing fraud and managing legal claims. Legal obligation where processing is required by law. |
| Checks, regulatory enquiries, audits, statutory reporting, employment and Right to Work compliance | Legal obligation where checks, reporting or employment compliance are required by law. Legitimate interests in relevant internal assurance and due diligence activities not specifically required by law. |
| Billing, credit checks, recovering debts and managing financial risk | Contract where we contract directly with you; otherwise legitimate interests in assessing creditworthiness, recovering debts and protecting our business from financial loss. Legal obligation where required by law. |
| Marketing our own services and managing marketing preferences | Legitimate interests in promoting our business where permitted; consent where required, including under PECR for relevant electronic marketing. |
Legitimate interests means we have a genuine business reason to use information, balanced against your interests and rights. Where we rely on consent, you can withdraw it at any time. Withdrawal does not make earlier processing unlawful.
For special category information, we also need a separate condition under Article 9 of the UK GDPR. For example, disability or health information used to arrange support may require explicit consent or another condition relevant to the particular circumstances. For Right to Work biometric checks, we assess whether processing is necessary for employment law obligations and rights, subject to the required safeguards. The condition used depends on the activity and must be reflected in our processing records.
4. Driver information and individual support
Our customer, often your employer, will usually be the controller for driver and fleet management records. We process those records under our agreement with that customer, which may include driving licence checks, risk management, vehicle checks, maintenance, accident support and other fleet services. For questions about why your employer requires particular checks or records, its privacy notice is normally the best starting point.
Where a driving restriction or a particular mobility need is relevant, we use only the information needed to help arrange a suitable vehicle or support. We do not routinely request disability information where it is not needed. Where we act as controller and use health or disability information, we identify an appropriate additional legal condition and apply safeguards.
5. Recruitment, employment and Right to Work checks
When you apply to work for us or work for us, we use information needed to consider your application, manage employment and meet our legal obligations, including verifying identity and Right to Work. We may use a specialist digital identity provider for these checks.
Depending on the check, you may provide a passport or other identity document, a Right to Work share code and a live selfie. Checks may include document validation, facial matching and liveness detection. Where biometric data is used to uniquely verify your identity, it is special category information. We use it only where an appropriate legal condition applies, with safeguards, including those required for employment-related processing.
We review check results as part of our recruitment or employment process. We will not make an adverse employment decision solely on an unexplained automated result, and a manual or alternative checking route may be available where appropriate. We keep the evidence required to demonstrate compliance with Right to Work and other record-keeping obligations.
6. Marketing and cookies
We may contact business contacts and people who have enquired about our services with relevant updates or offers where the law permits. We follow data protection law and PECR, including any consent requirements. You can unsubscribe through an email link, a STOP instruction where offered, or by contacting us. We do not sell or share your information with other organisations for their marketing.
You have the right to object to direct marketing at any time. If you ask us to stop, we will stop using your information for that purpose.
Our website uses cookies and similar technologies for its operation and, where applicable, to understand use of our website. We ask for consent before setting non-essential cookies where required. You can also manage cookies through your browser, although some features may stop working. See our Cookies Policy: Cookies Policy
7. Who do we share information with?
We share information only where there is a proper reason to do so. Depending on the circumstances, recipients may include customers (often your employer), vehicle and fleet service providers, IT and hosting suppliers, payment providers, credit reference and identity verification providers, marketing providers, professional advisers, auditors, insurers, banks, regulators, law enforcement bodies and courts. We may also share information with prospective buyers or advisers in connection with a business sale or restructuring, subject to appropriate confidentiality protections.
We expect suppliers handling personal information for us to apply appropriate security and confidentiality protections. When we act as a processor, our sharing of customer data is governed by our agreements and instructions from the relevant customer.
8. Where is information stored and is it sent abroad?
Information may be stored or accessed at our offices and by the service providers we use. Some providers, or their support operations, may be outside the UK or European Economic Area.
When an international transfer is subject to UK data protection transfer rules, we use an appropriate legal mechanism, which may include UK adequacy regulations, an International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses or another permitted safeguard. Contact us if you would like further information about the safeguards relevant to your information.
9. How long do we keep information?
We keep personal information only for as long as necessary for the purpose for which it was collected, including applicable legal, financial, contractual and record-keeping requirements. The period varies by the type of information and circumstances. Details are available from our retention policy on request.
When information is no longer needed, we delete it or anonymise it where appropriate. We consider the sensitivity of the information, the risks involved, the purpose for keeping it and any legal requirements when deciding how long to retain it.
10. What rights do you have?
Depending on the circumstances and the legal basis used, you can:
- Ask for access to your personal information and a copy of it.
- Ask us to correct inaccurate or incomplete information.
- Ask us to delete information or restrict how it is used in certain circumstances.
- Object to processing based on legitimate interests, and object to direct marketing at any time.
- Request transfer of certain information you provided to us, where the right to data portability applies.
- Withdraw consent where consent is the basis for processing.
- Exercise the protections that apply to decisions made solely by automated means that have a legal or similarly significant effect.
These rights are not absolute and exemptions may apply. We may need information to confirm your identity or authority to act for someone else. There is normally no charge for making a request. If your request relates to information we hold solely on behalf of your employer or another customer, we may direct it to that controller or help them respond.
11. How do we protect information?
We use technical and organisational safeguards to protect personal information against loss, unauthorised access, alteration and disclosure. Access is limited to people who need the information for their work and are subject to confidentiality obligations. We have procedures to investigate security incidents and make any legally required notifications.
Our website may link to other websites. Their operators are responsible for their own privacy practices, so please review their notices before providing information.
12. How can you contact us or complain?
If you have any questions, want to exercise your rights or are unhappy about how we have handled your information, you can contact our Data Protection Officer through our Data Protection Team using the details below. We would welcome the opportunity to look into your concern.
Email: data.protection@fleetoperations.co.uk
Telephone: 0344 567 8000
Post: Data Protection Team, Fleet Operations Limited, Fleet House, Maries Way, Silverdale Business Park, Newcastle-under-Lyme, Staffordshire, ST5 6PA
You also have the right to complain to the UK data protection regulator, the Information Commission. Complaints information is available via https://ico.org.uk/concerns or by calling 0303 123 1113.
Changes to this policy
Originally published 11 October 2018. Last updated 13 October 2026. We may update this policy from time to time and will publish the current version on our website.