Privacy Policy

Who we are and our roles

The legal operator, postal address and privacy contact appear in the legal details below. Incomplete details are explicitly marked and block production availability. BeeTrac is generally controller for website enquiries, account administration, billing, security/audit and legal/compliance records. Customers are generally controllers for fleet/driver data supplied for BeeTrac to administer; BeeTrac generally processes those records under their documented instructions and the DPA.

People and information covered

Website visitors: connection information and browser requests involved in providing and securing pages. Prospects: name, company, work email, phone, fleet size and enquiry text. Customer contacts: names, contact details, company information, account access and communications. Drivers: name, contact details, assigned vehicles, optional licence number, check status and review dates.

Fleet information includes registrations, vehicle details, lease terms, mileage, fuel, maintenance and service records, supplier bookings, documents and four-angle inspection photos with timestamps and notes. Photos may incidentally show people, number plates or other personal data. Avoid unrelated people and unnecessary personal information where reasonably practicable. Do not upload special-category or unrelated sensitive data without an agreed need and lawful basis.

Account/security data includes authentication identifiers, sign-in events, MFA status and audit records. Billing data includes invoices, payment/subscription identifiers, statuses and billing details. Card payment details are entered with the payment provider; BeeTrac does not store full card numbers or security codes. Requests and incidents may include identity-verification evidence, affected persons and investigation records.

Purposes and lawful bases

As controller, BeeTrac uses contact/account data to deliver a business contract and administer it. Where the contact is an employee rather than the contracting individual, legitimate interests in providing business services may apply. Enquiry handling, security, fraud prevention, proportionate audit and service improvement generally rely on legitimate interests, subject to balancing individuals' rights. Accounting and applicable legal obligations rely on legal obligation. Consent is used where required for non-essential tracking or optional marketing, not as a substitute for another lawful basis.

As processor, BeeTrac uses fleet, driver, document and photo data only to provide administration, reminders, reports, checks and coordination under the customer's instructions. The customer determines and communicates the lawful basis and any additional conditions required for its employee/driver data. We do not sell personal data or use it for unrelated advertising.

Sources, recipients and sharing

Information comes from users, customer organisations, authorised drivers, suppliers and authorised vehicle lookup services where configured. Access is limited by company, role and assignment. Customer-designated contacts and fleet staff may view relevant checks and records. Share only data needed with instructed suppliers or where law requires.

Hosting, authentication, storage, payment and optional AI providers may process relevant information. See the Sub-processor Register for verification status; technical integration is not proof of a completed contractual assessment. Document extraction and Fleet Assistant requests may send relevant document text/images and fleet context to model providers. Review data necessity before using those features.

International transfers

Provider hosting locations, onward processing and transfer safeguards remain pending verification where marked in the register. BeeTrac does not claim that all processing stays in the UK or that transfer compliance has been established. Before production processing, verify locations and any required adequacy decision, UK IDTA/Addendum, contractual safeguards and transfer risk assessment; provide relevant information on request.

Retention

We apply the approved configured retention period and end action for each category, considering purpose, contractual instructions, legal obligations and disputes. No statutory retention period is invented here. Draft settings require review and do not authorise routine deletion. Offboarding considers exports, deletion, anonymisation, restriction and lawful holds separately; retained invoices and audit history are not automatically erased.

Rights and complaints

Subject to legal conditions, you may request access, correction, erasure, restriction, objection and portability, and withdraw consent for consent-based processing without affecting earlier lawful use. Contact the verified privacy contact below or use the contact page while those details are pending. We verify identity proportionately and normally respond within one calendar month, subject to lawful extensions.

Driver/employee requests about a customer's controlled data will normally be referred to that customer and supported under the DPA. You can complain to the Information Commissioner's Office at ico.org.uk. You need not complain to BeeTrac first.

Security and automated tools

BeeTrac maintains technical and organisational measures designed to protect personal data, including role/company restrictions, private storage, expiring document links, staff MFA and audit records. No system is absolutely secure. Malware scanning, independently verified backups, penetration testing and restore testing are not claimed unless verified and recorded.

AI suggestions and extracted fields require human verification. The current service does not intend to make solely automated decisions with legal or similarly significant effects; customers remain responsible for their decisions.

Changes and contact

This policy carries a version and preparation date. Material changes will be communicated where appropriate. Current legal identity and verified contacts must be completed before launch. Use the data protection contact page for requests; do not treat an unverified address as a monitored inbox.