WORKFORCE PRIVACY NOTICE

How we use driver and transport data

Last updated: 22 September 2026

Controller and contact details

RoadTech Logistics LTD, trading as AFilipTrans, is the controller of personal information processed through this service. Company number 15489855. Registered office: 19 Lowther Street, Stoke-on-Trent, England, ST1 5JE.

Privacy and data-rights enquiries: support@afiliptrans.co.uk or 07468 766727.

Information we process

We process account and contact details; employment or contractor details; driving-licence, entitlement, penalty-point, Driver CPC, tachograph-card and ADR records; shifts, breaks, working time and night-out records; vehicle assignments, daily checks, signatures, defects, repairs and photographs; job, route, geofence and active shift location records; CMR, customs and delivery documents; expense, invoice, payroll and payslip records; plan, subscription and purchase status; incident records, including whether an injury was reported; and security and audit logs. Payment-card details are entered on Stripe's hosted payment page and are not stored by AFilipTrans. Where a company enables the fuel-card feature, the final six card digits and an encrypted fuel-card PIN are processed so an assigned driver can request a short, audited reveal during an active shift; the PIN is not included in manager lists or audit-log metadata. When notifications are enabled, we also process an encrypted device notification token so that the correct signed-in user can receive dispatch and safety alerts.

Licence information may be supplied by the driver, an authorised administrator or DVLA following the driver's permission. It is a criminal offence to obtain another person's DVLA information without permission. DVLA permission is recorded separately from the UK GDPR lawful basis used for workforce administration.

Purposes and lawful bases

• Legal obligation: operator-licence compliance, roadworthiness, drivers' hours and working-time records, tachograph duties, tax, payroll, accounting and responding to lawful authorities.
• Contract: administering employment or contractor work, assigning jobs, recording time and paying approved amounts.
• Legitimate interests: safe and efficient dispatch, active shift vehicle tracking, fraud prevention, incident handling, service security and establishing or defending legal claims. We balance these interests against worker rights and do not use tracking outside an active shift.
• Consent only where appropriate: optional device permissions such as notifications. Employment consent is not used where the worker has no genuine choice.

Location and monitoring

Location is collected only after device permission is granted and while an active shift is being tracked. It is shown only to authorised operational staff for dispatch, safety and route history. The current app does not request continuous background location. Drivers and passengers must be informed that work vehicles are tracked. Tracking must be disabled outside work where a vehicle is permitted for private use.

App timers and alerts support operational review; they do not replace the legally required tachograph record and do not make solely automated disciplinary or other legally significant decisions. A responsible manager must review the underlying record and allow the driver to explain or correct inaccurate information.

Recipients and international processing

Information is available only to authorised RoadTech Logistics staff and relevant drivers according to role. It may be shared when necessary with maintenance providers, payroll or accounting advisers, insurers, customers receiving proof of delivery, DVSA, Traffic Commissioners, HMRC, police or other lawful authorities.

Cloudflare provides application hosting, database and evidence storage as a processor. Stripe provides subscription billing and payment processing. Apple Push Notification service or Google Firebase Cloud Messaging delivers notifications to a device only after permission is granted. If a provider processes information outside the UK, RoadTech Logistics must use an adequacy regulation or an appropriate UK transfer safeguard. A copy or description of the applicable safeguard can be requested using the contact details above.

Retention schedule

• Vehicle safety inspections, defect reports, repair and maintenance evidence: at least 15 months, including after sale or removal from the operator licence.
• Road Transport Working Time records: 2 years after the end of the relevant reference period; drivers' hours records: at least 1 year.
• PAYE, payroll and employee expense records: at least 3 years after the end of the relevant tax year. Minimum-wage evidence may require a longer period.
• VAT invoices and VAT records: at least 6 years. Self-employed tax records are kept for the applicable HMRC period.
• Active-shift GPS and routine route history: normally 12 months, then deleted or anonymised unless required for a live complaint, incident, insurance matter, legal claim or statutory investigation.
• Account and audit records: for the account lifetime and afterwards only for security, legal or evidential needs, subject to an annual retention review.
• Disabled notification tokens are removed after 30 days. Push delivery records are retained for up to 90 days for reliability and security review.

Your rights

Depending on the lawful basis, you may request access, correction, erasure, restriction, objection or portability. Erasure does not apply where records must be retained by law or for legal claims. You may challenge monitoring information and request human review.

You may complain to the Information Commissioner's Office. Please contact us first where possible so we can investigate.

Device security

Camera and photo access are used for vehicle, receipt and delivery evidence. Notifications are used for operational updates. Limited unsent actions may be held securely on the device until synchronised. Do not share login credentials or uninstall the app while records are waiting to synchronise.

This workforce service is not intended for children, does not sell personal information and does not use advertising networks or third-party behavioural advertising.