Privacy Policy

Oxus Technologies Limited operates FleetMain, a fleet compliance service for Irish and UK fleets. We are the data controller for the personal data described in this policy, except where we act as your processor, see controller and processor below, which is the most important section here if you store driver records with us.

Oxus Technologies Limited
Registered in Ireland, company number 818468
Registered office: Greenhills Road, Dublin 12, D12 DX80, Ireland
Data protection contact: info@oxus.ie

We have not appointed a Data Protection Officer, because our processing does not meet the threshold in Article 37 GDPR that requires one. Enquiries go to the address above and are handled by us directly.

FleetMain holds two different kinds of personal data, and our legal role differs between them.

• Your own account data, we are the controller. Your name, email, company name, plan, billing history and how you use the product. We decide why and how that is processed, and this policy explains it.
• The data you enter about other people, you are the controller, we are your processor. Your drivers' names, contact details, licence numbers and expiry dates, the assignment and rental log recording who had which vehicle and when, and anything about other people in the invoices and documents you upload. You decide what to collect and why; we only hold and process it to run the service for you.

When we act as your processor, we process personal data only on your documented instructions, keep it confidential, apply the security measures described below, help you respond to individuals exercising their rights, and delete or return it when your account ends. Our sub-processors are listed in full below.

Account and profile data: your name, email address, company name, chosen plan, notification preferences and the team memberships you hold. Created when you sign up or accept an invitation.

Fleet data you enter: vehicle registrations, make, model, year, VIN, mileage, value, category, notes, and the compliance dates you track (Motor Tax, NCT, CVRT, MOT, insurance, operator, SPSV and PSV licences, tachograph calibration, safety inspections), plus service and maintenance records and service schedules. Vehicle data is not personal data in itself, but a registration can identify a person in a small business, so we treat it with the same care.

Documents you upload: the invoices, receipts and reports you choose to attach to a service record or a booking. They are kept in private storage, and the service shows them only to people signed in to your account. If a document names another person, such as a driver or a mechanic, you are the controller of that information and we are your processor, as set out above.

Driver data you enter (team plans), driver name, phone, email, licence number and categories, and the expiry dates of the driving licence, Driver CPC card, tachograph card and ADR certificate, plus notes and the assignment or rental history linking a driver to a vehicle over time.

Billing data: your subscription status and invoice history, and identifiers linking your account to your Stripe customer record. We never see or store your card number; card details go directly to Stripe.

Support and enquiry data: messages you send through the contact form, the onboarding request form or the in-app bug reporter, including the email address you give and the page a bug report was sent from.

Technical and usage data: server and security logs including IP address, browser type and pages requested, and, where you have consented, website analytics. See analytics and advertising.

• To provide FleetMain: running your account, storing your fleet, calculating compliance status and sending the expiry alerts, digests and reminders you have configured. Legal basis: performance of our contract with you.
• To take payment: subscriptions, invoices, and the tax records that go with them. Legal basis: contract: and legal obligation for the accounting records.
• To support you: answering enquiries, investigating bugs, and contacting you about your account or a service issue. Legal basis: contract and our legitimate interest in running a service people can get help with.
• To keep the service secure and working: logging, rate limiting, abuse prevention, backups and debugging. Legal basis: legitimate interest in the security and integrity of the service.
• To improve the product and measure our marketing: understanding which pages and features are used. Legal basis: consent for analytics and advertising cookies; legitimate interest for aggregate, non-cookie usage review.
• To send product news or offers: if you have asked for them. Legal basis: consent: withdrawable at any time.

We do not sell personal data, and we do not use it to make automated decisions producing legal or similarly significant effects about anyone. The expiry statuses FleetMain calculates are arithmetic on the dates you entered, not profiling.

• Compliance alerts and digests: sent ahead of expiry dates and, for items already lapsed, on the cadence you choose in Settings. Sent to the account owner and to team members whose role receives them. These are part of the service, so they are not marketing and cannot be turned off wholesale while the account is active, but you control their frequency and can adjust or disable individual reminder types in Settings.
• Account emails: sign-up confirmation, password reset, team invitations, billing receipts and service notices. Necessary to operate the account.
• Driver assignment notifications: where someone in your account chooses to notify a driver that a vehicle has been assigned to them, we send that email on your instruction and on your behalf: as your processor.
• Marketing: only with your consent, and every such email carries an unsubscribe link.

When you use the registration lookup, we send the registration number you typed to a third-party vehicle data provider (CarRegistrationAPI / regcheck.org.uk, in the United Kingdom) and store the make, model, year, VIN and description it returns against your vehicle. We do not send them your name, your email or anything else about you or your fleet. Legal basis: performance of our contract with you, since you asked for the lookup.

We use Google Analytics 4 to understand how people find and use FleetMain, and a Google Ads tag to measure which advertising leads to sign-ups. These set cookies and share page-level usage data with Google.

What Google receives is limited to which pages were viewed and a few product events such as starting a sign-up or a checkout. Your fleet never goes to Google: no registrations, no driver records, no compliance dates.

You can change your mind at any time from the cookie banner controls, and our Cookie Policy lists every cookie in full.

We use the following sub-processors. Each is bound by a data processing agreement, and none may use your data for its own purposes.

We may also disclose personal data to our professional advisers, or where we are legally required to, for example in response to a valid order from An Garda Síochána or a court. If our business is sold or reorganised, data may transfer to the buyer, who would remain bound by this policy or one no less protective.

We will give notice by email before adding a sub-processor that handles customer personal data, so customers acting as controllers can object.

Your account, fleet and driver data, and any documents you upload, are stored in Ireland (AWS eu-west-1): inside the EU, on infrastructure operated by our database provider.

Some of our providers operate partly outside the EEA, principally in the United States, for payment processing, email delivery and analytics. Where personal data reaches them, the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, together with the additional safeguards those mechanisms require.

• All traffic is encrypted in transit with TLS, and data is encrypted at rest.
• Access to your fleet is enforced in the database itself with row-level security, so one account cannot read another's data even if the application has a bug. A viewer's read-only role is enforced the same way.
• Passwords are hashed by our authentication provider; we never see them.
• Internal access to production data is limited to the people who need it to operate and support the service.
• Backups are taken regularly and are subject to the same protections.

If a personal data breach occurs and is likely to result in a risk to people's rights, we will report it to the Data Protection Commission within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk is high. Where we are your processor, we will notify you without undue delay so you can meet your own obligations as controller.

• Account, fleet and driver data: for as long as the account is active. After you delete your account or it is terminated, we keep it for 30 days so you can export it, then delete it.
• Deleted vehicles, drivers and records: kept for 30 days so an account owner or admin can restore something deleted by mistake, then permanently removed. That includes any documents attached to them, which are erased from storage at the same point. Deleting your whole account does not go through this step.
• Archived drivers: kept while the account is active, deliberately: an assignment log is only useful for identifying who was responsible for a vehicle if the driver record behind it survives. You can delete an archived driver outright at any time.
• Billing and tax records: up to 7 years, as Irish tax law requires.
• Support, contact and bug reports: up to 2 years after the matter is closed.
• Security and server logs: typically 30 to 90 days.
• Backups: deleted data persists in backups for a short period before rolling out of the retention window.

Under the GDPR you have the right to:

• Access a copy of the personal data we hold about you;
• Rectify data that is inaccurate or incomplete;
• Erase your data where we no longer have grounds to keep it;
• Port your data to another provider in a machine-readable format - FleetMain also lets you export your fleet to CSV at any time from the Reports page;
• Restrict or object to processing based on our legitimate interests;
• Withdraw consent at any time, where consent is the basis, this does not affect processing already carried out.

Email info@oxus.ie to exercise any of these. We respond within one month, and will tell you if we need longer because a request is complex. There is no charge unless a request is manifestly unfounded or excessive.

If you are a driver whose record is held by a business using FleetMain, direct your request to that business, they are the controller. See controller and processor.

FleetMain is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, tell us at info@oxus.ie and we will delete it.

If you are unhappy with how we have handled your personal data, please raise it with us first at info@oxus.ie, most things are quicker to fix directly.

You also have the right to complain to the Irish supervisory authority, the Data Protection Commission: 6 Pembroke Row, Dublin 2, D02 X963 - dataprotection.ie. If you live in another EU country, you may complain to your local supervisory authority instead.

We update this policy when our processing or the law changes. The “last updated” date at the top always reflects the current version, and we will email account owners before a material change takes effect.

Data protection: info@oxus.ie
General support: info@oxus.ie or our contact page.

Oxus Technologies Limited · Company no. 818468 · Registered office: Greenhills Road, Dublin 12, D12 DX80, Ireland

See also our Terms of Service and Cookie Policy.