Privacy Policy

Version 1.1

This explains how Saracen Commercial Contracting Ltd (SCC Ltd), trading as OperatorSafe (company number 05479787) ("we") handles personal data. Contact: hello@operatorsafe.co.uk, 72 Avocet Close, Rugby, CV23 0WU.

1. Two roles

We handle personal data in two different ways:

As controller for the details of the people who sign up and use OperatorSafe for their business, and for visitors to our website. We decide why and how that data is used.
As processor for the operator (our customer) when we store and process their drivers' and staff data inside the service. The operator is the controller of that data, and we act only on their instructions under the Data Processing Agreement.

2. What we collect

Who	What	Where it comes from
Users (transport managers, owners, mechanics)	Name, email, role, encrypted password, login times, IP address, activity log	The user and the operator
Drivers	Name, licence number, phone, email, tachograph card number, walkround checks, defect reports, photos, signatures, driver card downloads and the activity data in them	The operator and the driver
Vehicles	Registration, make, model, tests and inspection dates, documents, vehicle unit downloads, calibration records	The operator
Subscribers	Billing contact, payment details held by our payment provider, Stripe	The subscriber
Website visitors	Technical data such as IP address and browser type in server logs	The browser

We do not knowingly collect special category data, such as health or criminal records, and operators should not upload it. The one exception is an accident report: it records whether anyone was hurt (yes, no or not sure) and anything the driver chooses to type about it. That information belongs to the driver's employer, is visible only within the employer's account, and is used only to deal with the accident.

2A. The driver app

The OperatorSafe Driver app for Android and iPhone uses:

Camera and photo library, only when a driver chooses to add a photo to a defect, accident or licence record. The photo is stored against that record.
Face, fingerprint or screen-lock sign-in (passkeys), if the driver turns it on. The phone itself checks your face or fingerprint. We never receive or store your face or fingerprint, only a public key that cannot be used to recreate it. You can remove it at any time, and it is removed if you delete your account.
Notifications, if the driver allows them. We store a device identifier so that alerts reach the right phone, and delete it when the driver signs out or deletes their account.

The app does not track your location and contains no advertising or analytics.

3. Why we use it and our legal basis

To provide the service and our contract with you (performance of a contract): running accounts, logins, reports and support.
To keep the service secure and fix faults (legitimate interests): logs, audit trail, preventing misuse.
To take payment and keep accounts (contract and legal obligation).
To tell you about changes or problems (contract and legitimate interests).

For drivers' data inside the service, the operator decides the purpose and legal basis, typically its legal duties under operator licensing, tachograph and working time rules, and its legitimate interest in running a safe fleet.

We do not sell personal data. We do not use it for advertising. We do not make decisions about people by computer alone: reports are leads for a person to review.

4. Who we share it with

Only the companies that help us run the service (our "sub-processors"), and only as needed:

UpCloud, for server hosting.
Our web and email hosting provider, for sending the service's emails.
Stripe, for taking subscription payments by Direct Debit.

We may also share data where the law requires, for example with a court or regulator. If our business is sold, the data may pass to the new owner under the same protections.

5. Where it is kept

Data is stored on servers in the United Kingdom or the European Economic Area. If anything is transferred outside the UK, we make sure there are proper safeguards, such as UK adequacy regulations or the UK addendum to standard contractual clauses.

6. How long we keep it

Account and billing details: while you subscribe, then 6 years for accounting.
Operator content (driver, vehicle, tachograph and document records): while you subscribe and for 30 days after you leave, to allow an export. We then delete it permanently. Operators are responsible for how long they need to keep records under the law.
Backups: removed within 35 days after deletion from the live service.
Activity logs: 12 months.

When a user deletes a document in the service, the stored file is deleted permanently.

7. How we protect it

Traffic is encrypted (HTTPS). Passwords are stored as one-way hashes. Each operator can only see its own data. Access to servers is limited and controlled, software is kept up to date, and backups are kept. No system is perfectly secure, and we will tell you promptly if there is a breach that affects you.

8. Your rights

You can ask to see your personal data, correct it, have it deleted, restrict or object to its use, or receive it in a portable format. Drivers can delete their own account inside the app, or follow the steps at portal.operatorsafe.co.uk/account-deletion. Contact us at hello@operatorsafe.co.uk. If your data is held for an operator (for example you are a driver), we will pass your request to them, and you may also write to them directly.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Cookies and similar technology

We use only the cookies and browser storage the service needs to work: a login session cookie, a security token, and small settings such as whether you hid a help box. We do not use advertising or tracking cookies.

10. Changes

We will update this policy when we change how we use data, and show the date at the top. We will tell account holders about important changes.