Legal

Privacy & cookie policy

Last updated: 1 September 2026

Draft — pending legal review

This notice is a working draft prepared for review by FleetMe’s solicitor and data protection adviser. It has not been approved. Items marked [CONFIRM] are awaiting facts from the business; items marked [NEEDS HUMAN SIGN-OFF] are judgements that need a qualified adviser. The notice must be accurate and signed off before the site goes live.

The short version

FleetMe supplies vehicles — on business contract hire to limited companies and LLPs, and on short-term rental of up to 89 days to individuals, including sole traders. When you enquire, we collect what you tell us so we can work out whether we can help, price a vehicle and get back to you. We store that in our own systems and the specialist services that run our website, our records and our email. We do not sell your personal data. You can ask us at any time to show you what we hold, correct it or delete it.

Who is responsible for your data

The data controller is [CONFIRM: registered company name] (“we”, “us”, “our”), trading as FleetMe, a company registered in England & Wales under company number [CONFIRM: company number], registered office [CONFIRM: registered office], Telford, Shropshire, [CONFIRM].

[CONFIRM] — (a) the registered company name, company number and registered office that identify the controller; (b) the FleetMe registration with the Information Commissioner’s Office and its registration number, which must be shown here. Paying the data protection fee is a legal requirement for most UK organisations that process personal data under the Data Protection Act 2018, with a penalty of up to £4,000 for not doing so (ICO, 2026).

[CONFIRM] — whether FleetMe needs to appoint a Data Protection Officer, and if so, that person’s contact details. Handling identity documents, bank statements and creditworthiness information at scale makes this worth a specific decision rather than an assumption.

Whose data this notice covers

Information about a company is not personal data, so where our customer is a limited company or an LLP this notice covers the people behind it — the person who makes the enquiry, the named contact, the directors, and any proposed driver.

Where you rent a vehicle in your own name — as a personal customer or as a sole trader — the customer is you, so this notice covers you directly.

What we collect

When you make an enquiry

Who you are and how to reach you — your name, email address and phone number.
Your business — whether the enquiry is for a business or in your own name, and the business details you choose to give us.
What you need — vehicle type or specific vehicle, monthly budget, contract term, mileage, when you need it, and any notes you add.
Your marketing choice — whether you asked us to send you offers and updates.
Where you came from — the page you enquired on, and campaign tags and advertising click identifiers in the web address you arrived by (for example UTM tags and advertising click IDs), where present.

If you complete a full application

The full application collects considerably more, because it is what an underwriting decision is made on. Depending on whether the application is in a company’s name or your own it can include: date of birth; current and previous address and how long you have lived there; residential status; employment status, employer and an income band; driving licence number, type and DVLA check code; whether you have adverse credit and what kind; company name, business type, how long the business has been trading, and director details; the vehicle, term, mileage and initial rental you want; supporting documents you upload — bank statements, proof of address and both sides of a driving licence; and an electronic signature and the declarations you tick.

The full application is currently switched off. The site is enquiry-only, and both the form and the server that receives it are disabled, so we are not collecting identity documents or bank statements at the moment. This section describes what would be collected when that journey is reopened, so it must be reviewed and signed off before it is.

[NEEDS HUMAN SIGN-OFF] — the document-collecting journey must not be reopened until a solicitor has confirmed the lawful basis, the retention approach and the security arrangements for holding identity documents and bank statements. See docs/COMPLIANCE-DECISIONS.md, item D-3.

When you join our mailing list

Just your email address, plus the page or campaign you signed up from.

Automatically, when you use the site

Technical data — your IP address, device and browser information, and the pages you view. Your IP address is also passed to our bot-protection service when you submit a form, to check the submission is from a person.
Cookies and similar technologies — see the cookies section below.

Stored on your own device, not sent to us

Saved and recently viewed vehicles (lo_saved_v1, lo_recent_v1) — public vehicle details only, no personal data.
An in-progress application draft (ftlApplicationDraft) — the typed answers are saved in your browser for up to 7 days so you do not lose your place, and cleared when you submit. Uploaded documents and your signature are never saved to your device. This stays on your device; it is not transmitted to us from there.

You do not have to give us any of this. But we cannot price a vehicle or assess an application without the basics — who you are, how to reach you and what you need.

We do not ask you for special category data (such as health or biometric data) or for criminal offence data, and you should not send it to us.

Why we use it, and our lawful bases

Under the UK GDPR we must have a lawful basis for each thing we do with your data. Ours are:

Answering your enquiry and preparing a quotation. Where you are enquiring about a short-term rental in your own name, you are the person we would contract with, so we rely on taking steps at your request before entering into a contract (Article 6(1)(b)). Where the customer is a limited company or an LLP, the contract would be with that business rather than with you personally, so Article 6(1)(b) does not fit and we rely instead on our legitimate interests (Article 6(1)(f)) — our interest being to respond to a business enquiry made through its named contact.
Assessing an application and deciding whether we can supply a vehicle. Steps before entering a contract (Article 6(1)(b)) where you are the hirer, and our legitimate interests (Article 6(1)(f)) in assessing risk and affordability responsibly before committing a vehicle. [CONFIRM] — whether checks with credit reference agencies or fraud prevention agencies are carried out, by whom, and at what point; if they are, this notice must name the agencies and explain that they keep a record of the search.
Running and protecting the website. Our legitimate interests (Article 6(1)(f)) in keeping the site secure, preventing spam and fraudulent submissions, and keeping it working.
Keeping records and administering our business. Our legitimate interests (Article 6(1)(f)), and our legal obligations (Article 6(1)(c)) where the law requires us to keep records.
Marketing emails. Your consent (Article 6(1)(a)), which you can withdraw at any time. Marketing is opt-in, never pre-ticked and never bundled into the enquiry itself.
Analytics and advertising cookies. Your consent, given through the cookie banner (Article 6(1)(a), and regulation 6 of the Privacy and Electronic Communications Regulations 2003).
Meeting legal obligations and defending legal claims. Legal obligation (Article 6(1)(c)) and our legitimate interests (Article 6(1)(f)).

[NEEDS HUMAN SIGN-OFF] — the lawful bases above are our reasoned draft, not settled advice. Two need a decision in particular: (1) whether the enquiry flow is best framed as pre-contract steps or legitimate interests, given most customers are companies; and (2) if credit or fraud checks are introduced, the basis for them and the legitimate interests assessment that has to be recorded alongside. Every legitimate-interests basis above needs a documented balancing test on file before launch.

We do not make decisions about you by automated means alone. A person reviews every application before we accept or decline it.

Who we share it with

We share personal data only where it is needed to run the service, and only with organisations bound by a contract to process it on our instructions:

Airtable — stores enquiries and applications, and any documents attached to an application. This is our records system.
Brevo — sends the acknowledgement email you get when you enquire, our internal notifications, and marketing emails where you have asked for them. It also holds your contact record and the preferences we use to decide what is relevant to send you.
Cloudflare — hosts and protects this website, and provides the bot check (Turnstile) that runs when you submit a form.
Google — tag management and website analytics, and advertising measurement, where you have accepted the relevant cookies.
Microsoft — website behaviour analytics, where enabled and where you have accepted analytics cookies.
Our professional advisers and insurers, and regulators, authorities and law enforcement where we are required or permitted by law to share information.

[CONFIRM] — the following are unresolved and this section is not complete until they are answered:

Whether FleetMe funds vehicles through a third-party funder, and whether an application is shared with them. If so, they must be named here and their role (processor or separate controller) settled.
Whether supplying dealers, manufacturers, maintenance providers, insurers or the DVLA receive personal data at order or delivery. If they do, they must be named here.
That a written processing agreement is in place with every processor named above, as Article 28 requires.
Whether an advertising pixel is in use. No advertising pixel is currently loaded by the site; if one is added, this notice and the cookie table must be updated first.

[NEEDS HUMAN SIGN-OFF] — the analytics and tag management on this site currently run through container and measurement IDs inherited from a different business. Sending FleetMe visitors’ data into another company’s analytics property is a controller problem as well as a reporting one. It must be replaced with FleetMe’s own before launch. See docs/COMPLIANCE-DECISIONS.md, item D-1.

We do not sell your personal data, and we do not share it with other businesses for their own marketing.

Sending data outside the UK

Some of the services above are based outside the UK, or store data outside it — including in the United States and the European Economic Area. Where personal data is transferred out of the UK we rely on an approved safeguard: the UK’s adequacy regulations where they apply, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with a transfer risk assessment.

[CONFIRM] — the specific transfer mechanism relied on for each provider, and the transfer risk assessments that must be recorded alongside them. This paragraph describes what should be in place; someone has to check that it is, provider by provider.

How long we keep it

[NEEDS HUMAN SIGN-OFF] — retention periods must be set by the owner with advice, not assumed. They cannot be invented here. The draft below is a starting point for that conversation and must be replaced with agreed periods before launch:

Enquiries that do not proceed — proposed: 24 months from your last contact with us, then deleted.
Applications that are declined or withdrawn — proposed: 12 months, then deleted, keeping only a minimal record of the decision.
Identity documents and bank statements — proposed: deleted as soon as the decision they support has been made, and not retained for the life of an agreement.
Customers who take a vehicle — driven by the length of the agreement plus the period needed for tax records and for legal claims. Six years after the end of the agreement is the usual reference point, but it needs confirming.
Marketing contacts — until you unsubscribe, then a minimal suppression record so we do not email you again by mistake.

How we protect it

We use appropriate technical and organisational measures: encryption in transit, access controls on the systems that hold enquiries and applications, and processors chosen for their security arrangements. Access to application data is restricted to the people who need it. No transmission over the internet is ever completely secure, but we take reasonable steps to protect what you send us.

[NEEDS HUMAN SIGN-OFF] — before the document-collecting application is reopened, the storage arrangement for identity documents and bank statements needs a security review. Documents currently attach to records in our records system, where the access controls on that system are the only thing protecting them.

Cookies and similar technologies

We ask for your choice the first time you visit, and nothing non-essential runs until you accept. We use Google Consent Mode, so analytics and advertising tags stay switched off by default and are only enabled if you turn them on.

Essential — always on, no consent needed.
- cookie_consent — remembers your cookie choice for 180 days. Without it we would have to ask you on every page.
- Cloudflare security and bot-check cookies, which keep the site available and stop automated form abuse.
Analytics — only with your consent.
- Google Analytics, via Google Tag Manager, so we can see which pages help and which do not.
- Microsoft Clarity, where enabled, which records how pages are used and can replay an anonymised session. It loads only after you accept analytics cookies.
Advertising — only with your consent. Measurement of advertising campaigns. No advertising pixel is currently loaded on this site; if one is added, this section will be updated before it goes live.

You can change or withdraw your choice at any time: . You can also block or delete cookies in your browser settings, though the site may not work as well.

Marketing

We only send marketing to people who asked for it. The opt-in is separate from the enquiry itself and is never pre-ticked. Every marketing email has an unsubscribe link, and you can also opt out by emailing us. Opting out of marketing does not stop the service messages about an enquiry or application you have made — those are part of dealing with your request.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected, or incomplete data completed;
have your data erased in certain circumstances;
restrict how we use it, or object to us using it — including an absolute right to object to direct marketing;
receive data you gave us in a portable format, where we rely on your consent or on a contract;
withdraw consent at any time, without affecting anything we did before you withdrew it;
complain to us, and to the Information Commissioner’s Office.

To exercise any of these, email info@fleetme.co.uk. We will respond within one month. We may ask you to confirm your identity first, so we do not disclose your data to someone else. Exercising your rights is free.

Complaining about how we handle your data

Please tell us first — email info@fleetme.co.uk and we will look into it. Our complaints procedure explains what happens next.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first, but we would appreciate the chance to put things right.

[CONFIRM] — from 19 June 2026, the Data (Use and Access) Act 2025 requires controllers to have a process for data protection complaints, to acknowledge a complaint within 30 days of receiving it, and to respond without undue delay (ICO guidance, 2026). Someone at FleetMe must own that process, and the mailbox behind it has to be monitored.

Children

This site and our service are for businesses and for adults aged 18 or over. We do not knowingly collect data about children.

Changes to this notice

We may update this notice. The “last updated” date at the top shows the current version, and we will highlight significant changes on the site.