DriverFirst Privacy Policy

Version
1.0.2
Effective date

This Privacy Policy explains how DriverFirst (DriverFirst, we, us or our), a trading name of Midlands Car & Van Leasing Ltd, collects, uses, stores and shares personal data in connection with the DriverFirst website, web portal, mobile application and related services.

It also explains when we act as a controller of personal data and when we act only as a processor on behalf of our business customers.

1. Who we are

DriverFirst is operated by Midlands Car & Van Leasing Ltd, a company incorporated in England with company number 05872219 and registered office at 6 Parkside Court, Greenhough Road, Lichfield, England, WS13 7FE.

For privacy-related queries, please contact us at:

Email: [email protected]

2. What this Privacy Policy covers

This Privacy Policy applies to personal data we collect or receive in connection with:

  • our website;
  • sales enquiries and business contacts;
  • the DriverFirst web portal and mobile app;
  • account setup, onboarding and support;
  • service usage, device and technical information; and
  • communications with us.

This Privacy Policy does not replace any privacy notice that one of our customers may provide to its own employees, drivers, contractors or other personnel.

3. Controller or processor: who is responsible for the data?

The role we play depends on the type of personal data and how it is used.

3.1 When we act as controller

We act as a controller where we decide why and how personal data is used, including for:

  • operating our website;
  • handling enquiries, demos and sales discussions;
  • setting up and administering customer accounts;
  • billing, payment administration and business records;
  • providing customer support;
  • maintaining security, preventing misuse and investigating incidents;
  • improving the performance, reliability and security of our services; and
  • complying with legal and regulatory obligations.

3.2 When we act as processor

We generally act as a processor where one of our business customers uses DriverFirst to manage its own drivers, staff, vehicles, records, inspections, incidents, compliance workflows or other operational data.

In those cases, the relevant customer is usually the controller and is responsible for deciding why that personal data is processed, what lawful basis applies, how long the data should be kept, and how individuals are informed of that processing.

If you are a driver, employee or other user whose organisation has given you access to DriverFirst, and your query relates to the information your organisation has placed into DriverFirst or instructed us to process, you should usually contact your organisation first.

4. The personal data we may collect

The types of personal data we may collect or receive include the following.

4.1 Website and enquiry data

If you contact us, request a demo, complete a form or otherwise interact with our website, we may collect:

  • name;
  • business name;
  • job title;
  • email address;
  • telephone number;
  • company address;
  • enquiry details; and
  • records of your communications with us.

4.2 Account and customer relationship data

If your organisation uses DriverFirst, we may collect:

  • account owner and administrator details;
  • user names and work contact details;
  • login credentials and authentication-related information;
  • role and permission information;
  • billing and payment administration details;
  • contract, account and support records; and
  • onboarding and account configuration information.

4.3 Service data entered into DriverFirst

Depending on how our customers use the service, we may process data such as:

  • driver and employee identification details;
  • work contact details;
  • vehicle allocations and related records;
  • licence, compliance, inspection, defect, incident or training records;
  • submitted forms, notes, documents, images and attachments; and
  • other operational records uploaded to or generated within the service.

The exact categories of service data will depend on how each customer configures and uses DriverFirst.

4.4 Technical and usage data

When you access our website, portal or app, we may collect technical information such as:

  • IP address;
  • device type;
  • operating system;
  • browser type;
  • app version;
  • log data;
  • date and time of access;
  • pages, screens and features used; and
  • crash, diagnostic and performance data.

4.5 Support and communications data

If you contact us for support or otherwise communicate with us, we may keep:

  • the content of the communication;
  • support tickets and correspondence;
  • records of actions taken; and
  • feedback, complaints and follow-up information.

5. How we collect personal data

We may collect personal data:

  • directly from you;
  • from your employer or organisation;
  • from other authorised users within your organisation;
  • automatically through your use of our website, portal or app;
  • from service providers who support our operations; and
  • from publicly available sources where appropriate for business-to-business contact and account administration.

6. How we use personal data and our lawful bases

Where we act as controller, we process personal data in accordance with applicable data protection law, including the UK GDPR and the Data Protection Act 2018.

6.1 Contract

We may process personal data where necessary to enter into or perform a contract, including to:

  • provide access to DriverFirst;
  • create and manage accounts;
  • onboard customers and users;
  • provide support;
  • manage subscriptions and service delivery; and
  • administer payments and related records.

6.2 Legitimate interests

We may process personal data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests. This may include:

  • operating and improving our services;
  • maintaining platform security and reliability;
  • preventing fraud, misuse and unauthorised access;
  • managing customer relationships;
  • responding to business enquiries;
  • maintaining internal records;
  • analysing service performance and usage trends; and
  • defending or establishing legal claims.

6.3 Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations, including accounting, tax, fraud prevention, law enforcement requests, legal proceedings and regulatory compliance.

6.4 Consent

Where required, we rely on consent, for example in relation to certain cookies or similar technologies, or where we send marketing communications that require consent.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

7. How personal data is shared

We may share personal data where necessary with:

  • the relevant customer organisation and its authorised users;
  • our hosting, infrastructure and technology providers;
  • email, support, analytics, authentication and communications providers;
  • professional advisers such as lawyers, accountants, auditors and insurers;
  • payment processors and finance administration providers;
  • regulators, courts, law enforcement agencies or public authorities where required; and
  • a buyer, investor or successor in connection with a merger, acquisition, investment or sale of all or part of our business.

We require service providers acting on our behalf to process personal data only on our instructions, to keep it secure and to use it only for appropriate purposes.

8. International transfers

We may store or process personal data in the UK or in other countries where we or our service providers operate.

Where personal data is transferred outside the UK, we will take appropriate steps to protect it in accordance with applicable data protection law. Depending on the circumstances, this may include relying on adequacy regulations or approved contractual safeguards.

9. Data retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the services, comply with legal obligations, resolve disputes, enforce agreements and maintain appropriate business records.

Retention periods may vary depending on the type of data, the nature of the relationship, legal requirements and the relevant customer’s instructions.

Where we process personal data on behalf of a customer, we generally retain and delete that data in line with the customer’s instructions, the applicable contract and our standard backup and retention practices.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Where we act as a controller, you may have the following rights, subject to applicable law:

  • the right to be informed about how your personal data is used;
  • the right of access to your personal data;
  • the right to request correction of inaccurate personal data;
  • the right to request erasure in certain circumstances;
  • the right to request restriction of processing in certain circumstances;
  • the right to object to processing in certain circumstances;
  • the right to data portability in certain circumstances; and
  • where we rely on consent, the right to withdraw consent.

If you would like to exercise any of these rights, please contact us using the details in this Privacy Policy.

If your request relates to data that we handle on behalf of one of our customers, we may refer your request to that customer or ask you to contact them directly, because they may be the controller responsible for responding.

12. Complaints

If you have a concern about how we use personal data, please contact us first and we will try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

13. Cookies and similar technologies

Our website and, where applicable, parts of our services may use cookies and similar technologies.

Some cookies are strictly necessary for the operation of the website or service. Others, such as analytics or preference cookies, may only be used where permitted by law and, where required, with your consent.

14. Third-party services and links

Our website, portal or app may contain links to third-party websites, services or content. We are not responsible for the privacy practices of those third parties. You should review their privacy policies separately.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or business practices.

When we make material changes, we will take reasonable steps to bring the update to the attention of affected users where appropriate.

16. Contact us

If you have any questions about this Privacy Policy or our handling of personal data, please contact us at:

Midlands Car & Van Leasing Ltd

6 Parkside Court, Greenhough Road, Lichfield, England, WS13 7FE

Email: [email protected]