Privacy Policy

1. Who We Are

Fleet Comply is operated by Aurel Paraschiv (Sole Trader), trading as Fleet Comply.

1a. Our Role: Controller and Processor

Fleet Comply acts as Data Controller for personal data we collect to run the business: account, authentication and login data of our direct users, billing and contact data, support correspondence, security and audit logs, and website analytics where consented.

Fleet Comply acts as Data Processor under Article 28 UK GDPR for fleet personal data that customer workspace owners upload or generate inside their workspace — including driver identity and licence data, vehicle and tachograph data, infringements, DVSA events and uploaded compliance documents. For that data, the customer organisation (workspace owner) is the Controller and Fleet Comply processes it only on their documented instructions. The Article 28 terms are set out in the Data Processing Agreement, which workspace owners accept in Settings.

2. Information We Collect

Fleet Comply collects and processes the following information:

• Name
• Email address
• Company information
• Vehicle information
• Compliance records
• Uploaded documents
• User account activity required for platform operation

3. How We Use Your Information

Information is collected for:

• Account management
• User authentication
• Compliance reminders
• Audit pack generation
• Platform administration
• Service improvement and support

4. Communications We Send

Fleet Comply sends:

• Password reset emails
• Account notifications
• Compliance reminders
• Essential service communications
• Platform update emails (with an unsubscribe option where applicable)

5. Legal Basis for Processing

We process personal data on the basis of contract (to provide the service), legitimate interests (security, fraud prevention and service improvement), legal obligation, and consent where required. You may withdraw consent at any time by contacting us or using unsubscribe links.

6. Data Storage & Security

Data is stored using secure cloud infrastructure. Access is restricted to authorised users and administrators. We implement appropriate technical and organisational measures, including encryption in transit and at rest, access controls and regular security reviews. No system is completely secure, and we cannot guarantee absolute security.

7. Data Sharing and Sub-Processors

Fleet Comply does not sell user data to third parties. We share data only with:

• Other users within your organisation as authorised by the Account Owner.
• Lovable Cloud — application hosting, managed database, authentication, storage and transactional email delivery.
• Cloudflare — content delivery, edge security and encrypted off-platform R2 backups.
• Google (Gmail API) — outbound transactional email transport for operational notifications.
• Regulators or law enforcement when legally required.

The current sub-processor list is also published in the Data Processing Agreement and the Record of Processing Activities. Workspace owners receive at least 30 days' prior notice of any change.

7a. International Transfers

Processing is configured for UK or EEA locations where available. Any restricted transfer outside the UK is made under either UK adequacy regulations or the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), supported by supplier due diligence, encryption in transit and at rest, and least-privilege access controls.

7b. Automated Decision-Making

Fleet Comply does not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on data subjects within the meaning of Article 22 UK GDPR. Reminders, expiry calculations and dashboards are informational and do not, by themselves, take decisions about individuals.

8. Your Rights

Under UK data protection law, users may request:

• Access to their data
• Correction of inaccurate information
• Account deletion
• Removal of personal information where legally applicable
• Restriction of, or objection to, certain processing
• Data portability

To exercise any of these rights, contact notify@fleetcomply.co.uk.

9. Data Retention

The following fixed schedule applies unless a legal claim, investigation, enforcement action or regulatory request requires a temporary legal hold:

• Compliance records: 6 years.
• Security and audit logs: 7 years.
• Failed login records: 12 months.
• Routine operational emails: 12 months.
• Support tickets: 3 years after closure.
• Deleted user accounts: identifiers anonymised within 30 days where no legal obligation requires retention.
• Encrypted off-platform backups: 52 weeks with automated pruning.

10. Cookies

The platform uses essential browser storage for authentication, security and preferences. Optional analytics are disabled until consent. “Manage Cookies” in the footer lets you withdraw or change consent at any time. We do not use advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. The “Last updated” date at the top of this page indicates when it was last revised.

12. Privacy Contact, DPO and Complaints

General, privacy, data protection and data-subject-rights enquiries should be sent to notify@fleetcomply.co.uk. Fleet Comply has not appointed a Data Protection Officer because it is not legally required to appoint one under UK GDPR; all privacy enquiries are handled through this address.

Please contact us first if you are dissatisfied. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.