Privacy Notice
If you are a driver or member of staff at one of our customers: the company you work or drive for decides how your information is used in Vilmak Fleet Operations. It is the controller of that information and we process it on its behalf. Please read its privacy notice and contact it first about your information. Section 3 below explains what the system holds about you.
1. Who we are
Vilmak Ltd (company number 17425133, registered office Bowen Suite, The Globe Centre, 1 St. James Square, Accrington, BB5 0RE) provides the Vilmak Fleet Operations service (the Service) and this website, and is the data controller for the personal data described in sections 4 to 9 of this notice (we, us, our).
This notice explains how we use personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us about privacy at info@vilmak.co.uk. We have not appointed a data protection officer because we are not required to; the contact above handles all privacy matters.
2. Our two roles
- Controller. We are the controller for personal data about visitors to this website, people who contact us, and the account and billing contacts of our customers, and for the security records we keep to protect the Service. Sections 4 to 9 cover this data.
- Processor. Our customers (courier companies, delivery service partners and fleet operators) use the Service to manage their own drivers, staff, vehicles and operations. For that data, each customer is the controller and we act as its processor under a Data Processing Agreement. We use it only on the customer's instructions to provide the Service. Section 3 explains what this data includes.
3. Information held in the Service on behalf of our customers
Depending on how a customer uses the Service, it may hold the following about drivers and staff:
- identity and contact details: name, email address, phone number, user role, depot;
- driving licence number and expiry date, and identifiers used by delivery networks;
- shift and attendance records: rosters, assigned vehicles and routes, check-in times, start and finish times;
- vehicle check records: answers, declarations, mileage, notes and photographs of vehicles (which may incidentally show people or locations), with dates and times;
- defect reports, repairs, rechecks and release decisions;
- debriefs, incidents and notes;
- delivery figures, screenshots and files uploaded, and scorecards and performance metrics imported by the customer;
- pay rules, earnings estimates, approved amounts, adjustments and statements;
- notification settings and, if enabled on a device, a push notification address for that browser;
- an audit log of actions taken in the Service, with the user, date, time and IP address.
The customer is responsible for telling you how it uses this information and for having a lawful basis to do so. If you contact us about this data we will pass your request to the customer and assist it in responding, as required by our agreement with it. The Service does not record your location and does not make decisions about you automatically; reviews, approvals and decisions are made by people at the customer.
4. Information we collect as controller
| Who | What we collect | Source |
|---|---|---|
| Website visitors | Server logs containing IP address, date and time, page requested, referring page and browser type. | Your browser, automatically |
| People who contact us | Name, email address, company, job title, and what you tell us. | You |
| Customer account contacts (company administrators and managers) | Name, business email, role, sign-in records, and records of their use of the Service. | You or your employer |
| Billing contacts | Name, business email, billing address, VAT number, subscription and invoice history. Card details are entered directly with Stripe; we see only the card brand, the last four digits and the expiry date. | You, your employer, Stripe |
| All users of the Service | Security records: sign-in attempts, IP address, browser, failed requests and error logs. | Automatically |
5. How we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing the Service to our customers, managing accounts and subscriptions, taking payment and providing support | Contract (Art. 6(1)(b)) where you are the contracting party; otherwise legitimate interests (Art. 6(1)(f)) in running our business and serving our customers |
| Keeping the Service and website secure, preventing fraud and misuse, and investigating faults | Legitimate interests (Art. 6(1)(f)) in protecting our systems and our customers' data |
| Replying to enquiries and demo requests | Legitimate interests (Art. 6(1)(f)) in responding to people who contact us |
| Telling customers about changes to the Service, prices or these terms | Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Sending business-to-business marketing about our own similar services | Legitimate interests (Art. 6(1)(f)). You can opt out at any time, and we will always honour that. |
| Keeping accounting and tax records, and responding to lawful requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered and balanced your rights. You can ask us for more information about this assessment. We do not use personal data for profiling or automated decision-making that has legal or similarly significant effects.
6. Who we share it with
We share personal data only as needed with:
- our service providers acting on our instructions, including our hosting provider and the browser push services, as listed on our Sub-processors page;
- Stripe, which processes payments. Stripe acts as an independent controller for some payment data and its own privacy notice applies to that;
- our professional advisers, such as accountants, lawyers and insurers, under duties of confidentiality;
- the police, courts, regulators or other authorities where we are required to by law, or where necessary to protect rights, property or safety;
- a buyer or successor if our business, or part of it, is sold or restructured, under equivalent protections.
We do not sell personal data and we do not share it for advertising.
7. International transfers
The Service is hosted in the United Kingdom. Some of our providers, including Stripe and the browser push services, may process data outside the UK, including in the European Economic Area and the United States. Where personal data is transferred outside the UK, we ensure that it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by another safeguard permitted by UK GDPR. You can ask us for a copy of the relevant safeguard.
8. How long we keep it
| Data | How long |
|---|---|
| Website server logs | Up to 30 days, unless needed to investigate a security incident |
| Enquiries from people who do not become customers | Up to 24 months after our last contact |
| Customer account contacts | For the life of the account, then deleted with the customer's data as described in our Terms of Service |
| Billing, invoice and tax records | 6 years after the end of the financial year they relate to, as required by UK tax and company law |
| Security and audit logs | For the life of the customer account, as part of the customer's records; application error logs up to 90 days |
| Backups | Overwritten in the normal cycle, currently no longer than 60 days |
Data we process for customers is kept according to the customer's instructions and retention settings and our Terms of Service.
9. Your rights
Under UK GDPR you have the right, in certain circumstances, to:
- be informed about how your data is used (this notice);
- access a copy of your personal data;
- have inaccurate data corrected and incomplete data completed;
- have your data erased;
- restrict how your data is used;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability, for data you provided to us that we process by automated means on the basis of contract or consent;
- withdraw consent, where we rely on consent.
To exercise a right, contact info@vilmak.co.uk. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you. There is normally no fee. For data we hold on behalf of a customer, we will refer your request to that customer and help it respond.
10. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), hashed passwords, separation of each customer's data enforced on every request, role-based permissions, short-lived signed links for evidence files, rate limiting of sign-in attempts, audit logging, regular backups and restricted administrative access. No system is completely secure; if a personal data breach occurs we will act in accordance with UK GDPR, including notifying the ICO and affected individuals or customers where required.
11. Cookies
This website and the Service do not use advertising or analytics cookies. See our Cookie Notice for the storage used to keep you signed in.
12. Children
The Service is for businesses and their workers and is not intended for anyone under 18. We do not knowingly collect personal data from children.
13. Complaints
If you have a concern, please contact us first at info@vilmak.co.uk so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
14. Changes to this notice
We may update this notice from time to time. The effective date at the top shows when it was last changed. If we make significant changes, we will tell our customers by email or in the Service.