Privacy Policy

VanStamp ("we", "us") provides a web app that helps businesses manage their vehicles, drivers, fuel, expenses and compliance dates. This policy explains what personal data we handle, why, and what your rights are.

Details in [square brackets] are for us to complete before publishing.

Contact: [CONTACT EMAIL] | [REGISTERED ADDRESS] | ICO registration number: [ICO NUMBER]

1. Our two roles

We handle personal data in two different ways.

As a controller, we decide how and why we use the data. This covers visitors to our website, people who contact us, and the account holders (usually office managers) who sign up for VanStamp, including their billing details.

As a processor, we handle data on behalf of our customers. When a business uses VanStamp, it enters information about its vehicles and drivers. That business is the controller of its drivers' information and decides what to record. We process it only to provide the service and on the customer's instructions, as set out in our Terms of Service (Schedule 1).

If you are a driver using VanStamp through your employer, your employer is responsible for the information about you in the app. Please contact them first about your data. We will help them respond to you.

2. What we collect

Website visitors and enquiries: name, email, company, number of vehicles and the content of your message when you use our contact form; basic technical data such as IP address and browser type, needed to keep the site secure.

Account holders (office users): name, email address, company name, password (stored in protected form, never in plain text), and subscription and billing status. Card payments are handled by Stripe. We do not see or store your card number.

Information customers and drivers enter into the app:

• Vehicles: registration, make, model, photos, mileage, MOT, insurance, road tax, breakdown cover and service dates
• Drivers: name, email, mobile number, date of birth, address, nationality, driving licence number, issue date and category, next of kin and emergency contacts [and bank details, if you keep that field]
• Driver activity: vehicle sessions with start and end mileage and odometer photos; fuel stops with pump and odometer photos; expenses and receipt photos; issue reports with photos and messages; time-off dates
• Fuel cards: provider, last four digits, and a PIN, which is encrypted before it is stored
• Documents uploaded by the customer (for example MOT certificates, insurance documents, V5s, driving licence copies and invoices)
• An audit log of actions taken in the app

We do not track vehicle or driver location.

3. Why we use it and our lawful basis

We do not sell personal data. We do not use it for advertising.

4. Who we share it with

We use trusted service providers ("processors") to run VanStamp. They may only use the data to provide their service to us.

• Hosting, database and file storage: [PROVIDER NAME AND REGION]
• Payments: Stripe, which processes card payments and subscription billing
• Email delivery: [EMAIL SERVICE NAME]
• Automatic photo reading (when we launch it): [AI PROVIDER NAME]. We will update this policy first.

We may also share data where the law requires it, or to protect our rights, or if the business is sold (with the same protections).

Within a customer's account, its own office users can see its records, and each driver can see their own.

5. Transfers outside the UK

Some providers may process data outside the UK. Where they do, we use safeguards approved under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or a UK adequacy decision. [CONFIRM WITH PROVIDERS.]

6. How long we keep it

• Active accounts: for as long as the customer's account is active.
• After an account closes: the customer can export their data. We then delete it within [30] days, apart from encrypted backups, which are removed on their normal cycle within [90] days.
• Billing and tax records: [6] years, as UK tax rules require.
• Enquiries: [12] months after our last message.
• Security logs: [90] days.

7. How we protect it

• Data is encrypted in transit.
• Fuel-card PINs are encrypted before storage, are shown only to the assigned driver, and every reveal is logged.
• Photos and documents are stored privately and opened only through short-lived, signed links.
• Each company's data is separated from every other company's, and drivers can only access their own records. This is enforced in the database, not just on screen.
• Access to accounts is by password, and we check new passwords against known leaked passwords.

No system is perfectly secure. If a breach affects your data, we will tell the affected customer without undue delay so they can meet their own legal duties, and we will notify the ICO where required.

8. Your rights

Under UK data protection law you can ask to: see your data, correct it, delete it, restrict its use, receive a copy in a portable format, and object to certain uses. You can also withdraw consent where we rely on it.

For data we hold as controller (account, billing, enquiries), contact us at [CONTACT EMAIL]. For data held on behalf of an employer, contact the employer first; we will help them respond.

We aim to reply within one month. If you are not happy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

9. Cookies and similar technologies

We use only what is needed to keep you signed in and secure the service. See our Cookie Notice.

10. Children

VanStamp is a business tool for adults. It is not intended for anyone under 18.

11. Changes

We may update this policy. For significant changes we will tell account holders by email or in the app. The date at the top shows the latest version.