Privacy Policy

1. Data controller

Vehicle Handover is the data controller for personal data described in this policy. If you have questions about how we handle your data, contact us at [email protected].

2. Personal data we collect

We collect and process the following categories of personal data depending on how you interact with Vehicle Handover:

Account and profile data

• Name, email address and password (stored in hashed form)
• Company or organisation name, role and contact details
• User preferences, workspace settings and branding configuration

Job and handover data

• Vehicle details (registration, make, model, VIN where provided)
• Collection and delivery addresses, contacts and instructions
• Handover records, signatures, timestamps and job status
• Customer portal access details where customers track jobs

Photos and media

• Condition photographs, damage reports and proof-of-collection images captured during handovers
• Uploaded documents such as insurance or authorisation paperwork

Location (GPS) data

• GPS coordinates captured when drivers record handover events or upload photos via the mobile app, where location services are enabled on the device
• Approximate location derived from IP address for security and fraud prevention

Billing and payment data

• Subscription plan, billing interval and invoice history
• Payment method details processed by our payment provider (we do not store full card numbers)
• Billing address and VAT or company registration details where provided

Technical and usage data

• Device type, browser, operating system and app version
• Log data including IP address, access times and pages viewed
• Security events such as login attempts and bot-protection challenges

3. How we use your data

We use personal data to:

• Provide, operate and maintain the Vehicle Handover platform
• Create and manage user accounts and workspaces
• Process vehicle handover jobs, generate PDF reports and share status with authorised parties
• Store and deliver photos and handover evidence
• Process subscriptions, issue invoices and manage billing
• Provide customer support and respond to enquiries
• Improve platform performance, security and reliability
• Comply with legal obligations and enforce our terms
• Send service-related communications (account alerts, billing notices, security updates)

4. Legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Contract: processing necessary to provide the Vehicle Handover service you have signed up for, including account management, job processing and billing.
• Legitimate interests: platform security, fraud prevention, service improvement, internal reporting and responding to enquiries, balanced against your rights and freedoms.
• Legal obligation: where we must retain or disclose data to comply with applicable law, tax or regulatory requirements.
• Consent: where required for non-essential cookies or optional marketing communications. You may withdraw consent at any time.

5. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account data: retained while your account is active and for up to 90 days after closure, unless a longer period is required for legal or billing purposes.
• Job and handover records: retained for the duration of your subscription and for up to 7 years thereafter to support dispute resolution, insurance claims and legal requirements.
• Photos and media: retained in line with associated job records unless you request earlier deletion and we are not required to retain them.
• Billing records: retained for 7 years to meet UK tax and accounting obligations.
• Security logs: typically retained for up to 12 months.

When data is no longer needed, we securely delete or anonymise it.

6. Third-party processors

We use trusted third-party service providers who process personal data on our behalf under data processing agreements:

• Stripe — payment processing and subscription billing. Stripe may process payment card details, billing address and transaction metadata. See Stripe's privacy policy.
• Cloudflare — content delivery, DDoS protection, bot management (Turnstile) and edge security. Cloudflare may process IP addresses and request metadata. See Cloudflare's privacy policy.
• Cloudflare R2 — secure object storage for handover photos, PDFs and uploaded files. Data is stored in UK/EU regions where configured.
• Ninelytics (analytics.vehiclehandover.com) — self-hosted marketing analytics on vehiclehandover.com and signup pages. See our Cookie Policy for details.

We do not sell personal data to third parties.

7. International transfers

Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, Standard Contractual Clauses or equivalent protections approved under UK GDPR.

8. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your data in certain circumstances
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — we do not use automated decision-making that produces legal or similarly significant effects

To exercise any of these rights, email [email protected]. We will respond within one month. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Account and data deletion

Driver accounts are provisioned by your employer's Vehicle Handover workspace. To request deletion of your driver account and associated handover records, email [email protected] with your organisation name and username. Workspace owners can remove team members directly from app.vehiclehandover.com.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls, hashed credentials, secure cloud infrastructure and regular security reviews. No method of transmission or storage is completely secure; we encourage you to use a strong, unique password and keep your login credentials confidential.

11. Children

Vehicle Handover is a business-to-business service and is not directed at individuals under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes will be communicated via email or an in-app notice where appropriate.

13. Contact us

For privacy enquiries, data subject requests or questions about this policy, email [email protected].

See also our Terms and Conditions and Cookie Policy.