1. Introduction

Drivano is the trading name used for the Platform. The legal operator identified in the site disclosure is the controller of personal data described in this policy. This policy covers the web marketplace and related Hirer and Contractor workflows. The iOS app is not yet launched.

Operator disclosure pending: The legal operator name and geographic service address must be configured before paid trading.

We process personal data only for specified Platform, safety, compliance, payment, legal, and business purposes and apply the lawful bases described below.

2. Information We Collect

We collect information you provide directly to us, including:

Account information: name, email address, phone number, role, password authentication data, and account settings
Hirer information: company name, trading details, billing details, team members, posted shifts, Contractor payment records, and support messages
Contractor information: profile details, HGV licence categories, Driver CPC, right-to-work status, uploaded compliance documents, shift applications, accepted shifts, contracts, timesheets, invoice details, and encrypted invoice payment instructions
Driving offence information: where necessary for lawful and safe HGV work, licence endorsements, penalty points, disqualification status, alleged document or licence fraud, and the recorded outcome/date of a DVLA or licence review. Drivano does not carry out general criminal-record checks
Tax-reporting information: where legally required, legal name, address, date of birth, tax identification number, business or company details, VAT number, payment account information available to us, transaction counts, fees, and quarterly amounts paid
Payment information: Drivano subscription, agreed pilot and legacy PAYG billing status, Stripe customer and Platform-payment identifiers, Contractor invoice numbers and amounts, optional bank or AP references, invoice-sent and payment-status statements, and Contractor-confirmed receipt amounts. Stripe handles full card details for Drivano Platform billing. Contractor invoice payment instructions are stored by Drivano in encrypted form so the Contractor can generate its invoice; Drivano does not use those instructions to move money
Usage and analytics data: pages visited, sign-up/demo events, shift actions, attribution/UTM data, device/browser information, IP address, session identifiers, and support/audit logs
Communications: emails, support requests, dispute notes, verification notes, and operational messages

3. How We Use Your Information

We use your information to:

Provide and maintain the Platform
Create accounts, authenticate users, and protect accounts
Support shift posting, applications, bookings, contracts, timesheets, and payment workflows
Review HGV licence, identity, right-to-work, CPC, tachograph, and other compliance records
Generate and retain contracts, timesheets, audit logs, and compliance evidence
Send notifications about shifts, payments, support, compliance, and platform updates
Provide customer support
Improve our services and develop new features
Comply with legal obligations
Carry out digital-platform seller due diligence and report prescribed identity and payment information to HMRC or another competent authority where required

4. Lawful Bases

Under UK GDPR, we rely on different lawful bases depending on the processing:

Contract: to create accounts, provide platform features, record engagements, manage timesheets, and support payment workflows
Legal obligation: to keep accounting, tax, audit, safety, dispute, and compliance records where required
Legitimate interests: to prevent fraud, secure the Platform, improve the product, measure business performance, and support users
Consent: where required for optional cookies, marketing communications, or optional data uses

For criminal offence data connected with driving entitlement, endorsements, disqualification, or suspected licence/document offences, Drivano relies on an Article 6 lawful basis and an applicable condition in Schedule 1 of the Data Protection Act 2018. The working condition for targeted licence checks is preventing or detecting unlawful acts. We keep an appropriate policy document covering necessity, safeguards, access, challenge, retention, and erasure.

5. Information Sharing

We share your information in the following circumstances:

Between users: Contractor information may be shared with Hirers for applications, accepted shifts, compliance checks, timesheets, replacement decisions, and safety/operational needs. Hirer information may be shared with Contractors for shift details, contacts, payment status, and disputes
Service providers: vendors who help us run the Platform, including Supabase for database/auth/storage, Stripe for Drivano subscription billing, Resend for email, Vercel for hosting/analytics, and Sentry for error monitoring where enabled
Public authorities: HMRC, courts, regulators, law enforcement, or other authorities where disclosure is required by law or necessary to establish, exercise, or defend legal rights
Business transfers: professional advisers and a buyer, investor, or successor where needed for a genuine financing, restructuring, sale, or transfer, subject to appropriate confidentiality and legal safeguards

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encrypted transport connections and provider-supported encryption at rest
Authentication, role-based access controls, and restricted administrative access
Application, audit, error, and infrastructure logging where enabled
Incident handling, dependency checks, backups, and access review proportionate to the Platform's risk

7. Your Rights (UK GDPR)

If you are in the UK or EU, you have the following rights:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data (subject to legal obligations)
Restriction: Restrict processing of your data
Portability: Receive your data in a portable format
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent at any time (where applicable)

8. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. Typically:

Account data: while the account is active, then deleted or anonymised unless needed for legal, security, dispute, or accounting reasons
Financial, billing, and tax records: normally up to 7 years
Digital-platform reporting records: at least 5 years after the end of the relevant reportable period where those rules apply
Contracts, timesheets, compliance, and dispute records: normally up to 6 years after the relevant engagement or dispute, unless a longer period is legally required
Raw DVLA check codes: until used or expired and no longer than the 21-day operational window; current endorsement/eligibility results are reviewed at least annually, with unnecessary detailed offence data erased or de-identified after 12 months unless a live dispute, investigation, legal claim, or legal duty requires it
Marketing attribution and analytics: kept only as long as useful for business reporting, then deleted or aggregated

9. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. See our Cookie Policy for details.

10. Children's Privacy

Our Platform is not intended for individuals under 18. We do not knowingly collect information from children.

11. International Data Transfers

Some service providers may process data outside the UK. Where this happens, we expect appropriate transfer safeguards to be used, such as UK-approved transfer mechanisms or equivalent processor safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or platform notification.

13. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

Drivano
Email: privacy@drivano.co.uk
Data protection contact: privacy@drivano.co.uk