Privacy Policy

1.1 Controller. For the data described in Clauses 3.1 to 3.4, the data controller is [INSERT registered company name], a company registered in England and Wales with company number [INSERT company number], whose registered office is at [INSERT registered office address] (“Tachyo”, “we”, “us”). We trade as Tachyo.

1.2 Registration. We are registered with the Information Commissioner’s Office (ICO) under registration number [INSERT ICO registration number].

1.3 Contact. For any privacy question or to use your rights, contact our data protection contact at privacy@tachyo.co.uk, or write to us at our registered office above. We have not appointed a statutory data protection officer.

2.1 When we are a controller. We decide why and how we use: details of people who contact us or visit our website; account, billing and security records about our customers and their administrators; and support correspondence.

2.2 When we are a processor. When a customer uses Tachyo to run its fleet, the customer is the controller of the driver, vehicle, shift, location, inspection, fuel, parking, delivery and pay data in its account, and we process that data only on its instructions under our Data Processing Addendum. If you want to exercise your rights over that data, start with the customer. Clause 9 explains how we help.

3.1 People who visit the website or contact us.

• The details you type into the contact form: name, company, work email, optional phone number, fleet size range and your message.
• Technical data in our hosting provider’s server logs when you load a page: IP address, browser and device type, pages requested and time.
• Anything you send us by email, and our replies.

3.2 Customer administrators and office staff.

• Name, work email address, role and permissions.
• Sign-in and security records: when you sign in, failed attempts, password and two-step verification changes, and the IP address from which they happened.
• Your actions in the Admin Platform that change records (for example approving a claim or resolving an alert).
• Preferences kept in your browser, such as a remembered email address and alert-sound settings (see Clause 13).

3.3 Account and billing records. Company name and address, billing contacts, plan, number of drivers, invoices and payment records. Card or bank details are entered with our payment provider; we receive confirmation of payments and basic details such as the card type and last four digits, and we do not store full card numbers.

3.4 Support. Messages and attachments you send to our support mailboxes and what we need to resolve the issue.

3.5 Data about drivers and fleet operations (we process this for customers). So that you can see what is in the product, this is the kind of data a customer may hold in Tachyo about its drivers and operations:

• Driver profile: full name, driver ID, phone number, a hashed PIN (we cannot read it), company code, active status, and when the driver accepted the in-app terms.
• Shifts: start and end times, depot, vehicle and trailer used, load and revenue details and notes.
• Location during a shift: latitude, longitude, speed, accuracy and time, reported about every three minutes while the driver is clocked in; the last known position when signal is lost.
• Alerts: idle, GPS-offline and SOS events, whether the driver was notified and what the employer’s settings did.
• Walkaround checks and defects: checklist results, notes, photographs and incident reports.
• Fuel, AdBlue and overnight-parking claims: receipt photographs, a dashboard photograph, litres, cost, vendor, odometer reading and the device location at submission, plus the employer’s review decision.
• Deliveries: proof-of-delivery photographs with time and device location, and the first name, last name and drawn signature of the person who received a load where a signature is taken. This is data about the person who signs, who is usually not our customer.
• Rota, rota confirmations and holiday requests.
• Pay: hourly, day or per-mile rates, extra payments, pay calculations and payroll records the employer chooses to keep in Tachyo.

3.6 What we do not intend to collect. The product does not use facial recognition or other biometric identification, does not record audio or video, and does not collect location outside a clocked-in shift. It is not designed to hold special category data (such as health information) or criminal-offence data. Incident reports and notes are free text, however, and could contain such details, for example about an injury. We do not look for or use that information; the customer is responsible for having a lawful basis and any further condition the law requires for anything of that kind it or its drivers enter.

4.1 People who contact us (Article 6(1)(b) and (f)). To reply to your enquiry, arrange a walk-through, set up a free trial and create your company’s account. This is necessary to take steps at your request before a contract, and is in our legitimate interest in running our business.

4.2 Providing the Services to customers (Article 6(1)(b)). Creating and maintaining accounts, authenticating users, sending sign-in links and service emails, providing support, and sending the scheduled reports a customer switches on.

4.3 Billing and legal compliance (Article 6(1)(b) and (c)). Invoicing, collecting payment, and keeping accounting and tax records.

4.4 Security, fraud prevention and service improvement (Article 6(1)(f)). Monitoring for misuse, investigating incidents, keeping audit logs, fixing faults, and producing aggregated and de-identified statistics. Our legitimate interest is a secure, reliable product; we limit this use to what is needed and do not use it to profile individuals.

4.5 Legal claims and obligations (Article 6(1)(c) and (f)). Establishing, exercising or defending legal claims and responding to lawful requests from authorities.

4.6 Marketing. We only send marketing in line with PECR (see Clause 13). Where we rely on consent you can withdraw it at any time.

4.7 Driver and fleet data. We process it only on a customer’s instructions. The customer is responsible for having its own lawful basis, which we expect to be legitimate interests, compliance with legal obligations or performance of a contract rather than consent, given the imbalance of power in employment.

5.1 Our sub-processors. We use these providers to run Tachyo. Each is bound by a data processing agreement:

• Supabase, Inc. (infrastructure: Amazon Web Services) — Database, user authentication, private file storage and server functions for the Tachyo platform. Location: Data stored in the AWS London region (eu-west-2), United Kingdom. Supabase server functions run on a global edge network, so data in transit (for example a sign-in request) may be handled outside the UK before it reaches the London database. Data involved: All Customer Data held in the platform, including driver records, shift and location records, photographs, signatures, pay-rate and payroll records, and administrator account data.
• Vercel Inc. — Hosting and delivery of the Tachyo admin dashboard and this website, and running the website's contact-form handler. Location: Global edge network; server functions may run in the United States. Data involved: Technical request data (IP address, browser type, pages requested) and the contact-form details a prospective customer submits. Vercel does not hold the platform database.
• Resend, Inc. — Sending service emails: account set-up and sign-in links, access-request notifications and scheduled analytics report emails. Location: Sending region: EU (Ireland). Resend, Inc. is a United States company. Data involved: Recipient email address, sender and the content of the email being sent (for example, a sign-in link or a weekly profit summary).

5.2 Third-party services your browser or phone contacts directly. To show maps and load typefaces, the product contacts these services, which receive technical data (at least your IP address) directly from your browser or phone:

• OpenFreeMap / OpenStreetMap contributors — Map tiles and map styles for the live map and journey history in the dashboard, and the map in the driver app. Data involved: IP address and the map area being viewed. Driver identities are not sent.
• OpenStreetMap Foundation (Nominatim and embedded map) — Address look-up when an administrator uses a location to fill in an address, and the map preview shown when an administrator compares a fuel receipt's recorded location. Data involved: IP address and the coordinates being looked up or displayed.
• Google Fonts (Google LLC) — Delivers the typefaces used by the admin dashboard. Data involved: IP address and browser details of the person loading the dashboard.

5.3 Payment provider. Our third-party payment provider processes subscription payments, which includes your billing contact details and payment method. We will name it when you set up payment.

5.4 Your employer or our customer. If you are a driver or office user, your employer’s authorised administrators can see the data in their account, including activity records.

5.5 Professional advisers and insurers. Lawyers, accountants, auditors and insurers, under confidentiality duties.

5.6 Authorities. Courts, regulators, the police and tax authorities where the law requires or allows (Clause 14).

5.7 Business changes. A buyer or investor in a merger, sale or financing, who must respect this policy.

5.8 We do not sell personal data, and we do not share it for third-party advertising.

6.1 Where data is stored. The platform database and uploaded files are stored in the United Kingdom (AWS London region).

6.2 Transfers outside the UK. Some providers in Clause 5 are United States companies or process data in other countries: for example, Vercel may handle contact-form submissions and request logs on servers outside the UK, Resend sends email from an EU region but is a United States company, and our database provider’s staff may access systems from outside the UK to support them, and its server functions run on a global edge network. Where personal data is transferred outside the UK we rely on an adequacy regulation, the UK International Data Transfer Addendum or another safeguard recognised by UK law, as set out in the provider’s data processing terms. You can ask us for details at privacy@tachyo.co.uk.

7.1 Enquiries. Contact-form and email enquiries: while we are dealing with them and for up to 24 months after our last contact, then deleted or anonymised. If you become a customer, the details join your account record.

7.2 Accounts and security records. For as long as the customer account exists. When the account is deleted the data is deleted as set out in the Customer Terms (Clause 6.8).

7.3 Billing records. For six years after the end of the financial year to which they relate, to meet tax and accounting needs and the limitation period for claims.

7.4 Server and email logs. For the short periods set by our hosting and email providers.

7.5 Driver and fleet data. The customer decides how long it needs each kind of record. We keep the data in a customer’s account for as long as the account is active and do not automatically delete operational records on a fixed timetable. The customer can delete records through the Admin Platform and ask us to delete accounts. When the account ends, the end-of-agreement process in the Customer Terms (Clauses 6.8 and 6.9) applies. Customers must set their own retention periods and are responsible for keeping the records the law requires, which include:

• Vehicle safety inspections, driver defect (walkaround) reports and the repair records that follow them: at least 15 months (DVSA Guide to maintaining roadworthiness).
• Working-time records (hours and shifts worked): 2 years (Road Transport (Working Time) Regulations 2005).
• Pay, payroll, expense and tax records: generally 6 years (HMRC record-keeping requirements and the Limitation Act 1980).

7.6 Photographs and files. Defect and walkaround photographs, delivery proofs and receipts can form part of those records. They are therefore kept in restricted, private storage for 24 months from the date they were uploaded, even if the driver account, driver record or customer account they belong to has been deleted. They are then deleted. Once the record they belong to has been deleted they are no longer linked to it in the platform, and the driver’s profile no longer exists. We rely on legal obligation and legitimate interests for this, as the customer has instructed us, and it is why deleted drivers’ photographs do not disappear at once. Customers can ask us for a copy of the files we hold, or for earlier deletion, in writing.

You have these rights over personal data we hold about you as a controller:

• to be told about our use of it (this policy);
• to access a copy (Article 15);
• to have inaccurate data corrected or completed (Article 16);
• to have it erased in some situations (Article 17);
• to restrict our use of it in some situations (Article 18);
• to receive data you gave us in a portable form where we rely on contract or consent (Article 20);
• to object to processing based on legitimate interests, and to direct marketing at any time (Article 21); and
• to withdraw consent where we rely on it.

To use a right, email privacy@tachyo.co.uk. We may ask for proof of identity. We will respond within one month, which the law allows us to extend by up to two further months for complex or numerous requests, and we will tell you if we do. There is no fee unless a request is manifestly unfounded or excessive. Rights are not absolute; we will explain if we cannot fully comply, for example where we must keep a record by law.

9.1 Requests from drivers. If a driver contacts us to see, correct or delete their data, we are not the controller and cannot lawfully decide that on our own. We will tell the driver who the controller is, and within three business days pass the request to the customer’s administrator, who is responsible for answering within the legal time limit. We will give the customer the technical help it needs to do so.

9.2 Account deletion. Drivers can ask the app to delete their account. The request goes to the employer’s administrator, who confirms it. See Delete Your Account.

9.3 Employer duties. Our customers must give drivers their own privacy notice, have a lawful basis, and do any required impact assessment before using Tachyo. Our Telematics & GPS Policy explains exactly when and how location is collected.

9.4 Our own access. Tachyo staff do not browse customer data routinely. We access it only to provide support the customer asked for, to keep the Services secure or working, or where the law requires, and our staff are bound by confidentiality.

10.1 What the product does automatically. To be open about it, the product carries out some automatic processing:

• It marks vehicle and inspection status (for example red, amber or green) from recorded dates and results.
• It flags fuel entries that look unusual by comparing receipts, odometer readings, tank capacity and submission location.
• It raises idle, GPS-offline and SOS alerts to the employer’s office.
• If the employer switches the setting on, it can deduct an idle or GPS-offline stretch from paid hours, or end a shift automatically after a loss of GPS signal. These actions are off by default.
• It automatically approves a fuel or parking claim that the employer has not reviewed within 10 hours, and an approved parking claim is added to the linked shift’s extra payments.

10.2 Who decides. These features operate on settings and thresholds the employer chooses, and the employer remains responsible for pay and disciplinary decisions. Tachyo does not decide to discipline, dismiss or pay any person. Under Article 22 UK GDPR a person has the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on them. Our terms require customers to ensure a person reviews the record before taking significant action based on a flag or calculation, and to give the driver the chance to respond. If you are a driver and a calculation affects your pay, you can ask your employer for a human review and an explanation.

We use technical and organisational measures appropriate to the risk, described in full in the Data Processing Addendum (Annex 2). They include encryption in transit and at rest provided by our hosting provider, separation of each customer’s data so that one customer cannot read another’s, private file storage, hashed PINs with lock-outs after repeated wrong attempts, single-use activation codes, two-step verification for administrators, and security audit logs. No system is perfectly secure and we cannot guarantee absolute security.

12.1 Customer data. If we confirm a personal data breach affecting data we process for a customer, we will tell the customer without undue delay and, where we can, within 48 hours of confirming it, with the information it needs to meet its own duties.

12.2 Our own data. If a breach affects data we control and is likely to result in a risk to people’s rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it and will tell affected people where the risk is high.

13.1 Cookies. Our website does not set advertising or analytics cookies. The Admin Platform keeps sign-in session information and a few preferences in your browser’s local storage. See the Cookie Policy.

13.2 Marketing. We use the details you give us to respond to your enquiry and to run your trial. We will only send you marketing emails where PECR allows it (for example to a business contact, about similar services, with a clear opt-out), or with your consent, and every marketing email will include a way to unsubscribe. You can also tell us at privacy@tachyo.co.uk.

14.1 Requests. We disclose personal data to a court, regulator, the police or another authority only where the law requires it, or allows it and we are satisfied the request is valid and proportionate. We check each request and disclose no more than needed.

14.2 Customer data. Where a request concerns data we process for a customer, we will normally refer the authority to the customer, and will tell the customer about the request unless the law prevents us.

14.3 Regulators. Customers may be asked by DVSA or a Traffic Commissioner for records held in Tachyo. Customers are responsible for producing them, and our exports are there to help.

Our services are for businesses and their staff. They are not aimed at, and we do not knowingly collect personal data from, anyone under 16.

16.1 Changes. We may update this policy. The date at the top shows when it was last changed, and we will tell account administrators about material changes.

16.2 Complaints. Please contact us first at privacy@tachyo.co.uk so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113.