Privacy Policy

This Privacy Policy explains how OctoDrive ("we", "us") collects, uses and protects personal data when you use the OctoDrive platform.

1. Data We Collect

We collect account details (name, email, username, role), company and fleet information you enter, vehicle check records, defect reports, photographs, signatures, and technical logs such as IP address and device information.

2. How We Use Data

We process data to provide and operate the service, generate compliance reports and PDFs, send operational notifications, secure the platform and meet legal obligations.

3. Security and Fraud Prevention Information

To keep OctoDrive and its customers safe, we record limited technical security information when someone creates or attempts to create an account, signs in or authenticates, or triggers a relevant account-security event (for example a failed multi-factor authentication attempt or a password change). This information can include the IP address the request came from, the date and time, and details of the security event itself.

We use this information only to protect the OctoDrive platform and customer accounts, to detect and prevent fraud and abuse, to investigate suspicious account registration or authentication activity, and to maintain platform security. We do not use it for marketing, advertising, behavioural profiling, precise location tracking, customer analytics, or automated decisions about eligibility. Access is restricted to a small number of authorised OctoDrive personnel.

4. Legal Basis

Where UK GDPR applies we rely on contract (to deliver the service), legitimate interests (to secure and improve the platform), legal obligation (to retain certain compliance records) and consent (for optional communications).

For the security and fraud-prevention information described above, our lawful basis is legitimate interests — protecting OctoDrive, its customers and their users against fraud, misuse, unauthorised access and security threats. You can object to this processing by contacting us using the details below.

5. Sharing

We share data with vetted service providers who help us run the platform (hosting, email delivery, error monitoring). We do not sell personal data. We may disclose data where required by law.

6. Retention

We retain records for as long as your account is active and for the periods required to meet operator licensing and audit obligations. When no longer needed, data is deleted or anonymised.

Raw IP addresses collected for the security purposes described above are normally retained for up to 12 months after the relevant event. After that period the raw IP address is removed from the security record. The security record itself (such as the event type and its date and time) is kept for longer where we need it for security and audit purposes.

7. Your Rights

Subject to UK GDPR you may request access, correction, deletion, restriction or portability of your personal data, and object to certain processing. To exercise rights, contact us using the details below.

8. Cookies

We use strictly necessary cookies and similar technologies to keep you signed in and remember preferences. We do not use advertising cookies.

9. Security

We use industry-standard technical and organisational measures to protect personal data, including encryption in transit, access controls and logging.

10. International Transfers

Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent mechanisms.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be notified via the platform or by email.

12. Contact

Privacy queries can be sent to privacy@octodrive.co.uk.