top of page
Logo words only 1.png
Logo words only 1.png
Privacy Notice
Data Retention Schedule
GDPR Policy

UK Fleet Audit Ltd. customer privacy notice

 

This privacy notice tells you what to expect us to do with your personal information.

  • Contact details

  • What information we collect, use, and why

  • Lawful bases and data protection rights

  • Where we get personal information from

  • How long we keep information

  • Who we share information with

  • How to complain

Contact details

Telephone

07895501007

Email

rob@ukfleetaudit.co.uk

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details

  • Addresses

  • Purchase or account history

  • Website user information (including user journeys and cookie tracking)

  • Records of meetings and decisions

  • Identification documents

  • Information relating to compliments or complaints

We collect or use the following information for the operation of customer accounts and guarantees:

  • Names and contact details

  • Addresses

  • Purchase history

  • Account information, including registration details

We collect or use the following information for service updates or marketing purposes:

  • Names and contact details

  • Addresses

  • Location data

  • Recorded images, such as photos or videos

  • Purchase or viewing history

  • Records of consent, where appropriate

We collect or use the following information to comply with legal requirements:

  • Name

  • Contact information

  • Identification documents

  • Any other personal information required to comply with legal obligations

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details

  • Address

  • Account information

  • Purchase or service history

  • Customer or client accounts and records

  • Correspondence

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

    • UK Fleet Audit Ltd conducts independent transport compliance audits on behalf of goods vehicle operators. To carry out an audit effectively and produce an accurate, evidenced report, it is necessary to review and record certain personal data relating to named individuals within the client\'s business. The personal data collected and reviewed serves the following legitimate purposes: Verifying the identity of the operator, company directors and transport manager against the operator licence and Companies House records, as required by the DVSA Operator Compliance Audit framework Reviewing transport manager qualifications and Certificate of Professional Competence details to assess compliance with operator licence conditions Sampling driver records including licence details and tachograph data to assess compliance with drivers\' hours regulations and licence requirements Recording audit findings accurately and producing a written report that the operator can use to demonstrate compliance to the DVSA and Traffic Commissioner The benefit of collecting this information is that it enables the operator to identify and address compliance gaps before they result in regulatory intervention, prohibition, or Traffic Commissioner action. This directly supports road safety and legal compliance across the haulage industry. The impact on individuals whose data is reviewed is limited because: the data is reviewed only to the extent strictly necessary for the audit; individual driver names are not recorded in the final audit report; data is not retained beyond the period required; and the processing relates to individuals in their professional capacity within a regulated industry rather than their private lives.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for legal requirements are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Where we get personal information from

  • Directly from you

  • Publicly available sources

How long we keep information

For information on how long we keep personal information, see our retention schedule at https:\/\/www.ukfleetaudit.co.uk\/policies

Who we share information with

Others we share personal information with

  • Professional or legal advisors

  • Relevant regulatory authorities

  • External auditors or inspectors

  • Organisations we’re legally obliged to share personal information with

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: enquiries@ukfleetaudit.co.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Data Retention Schedule
UK Fleet Audit Ltd — UK GDPR and Data Protection Act 2018

Version 1.0 | Issued: September 2026 | Review: Annually

1. Purpose

This retention schedule sets out the categories of personal data collected and processed by UK Fleet Audit Ltd in connection with the delivery of independent HGV transport compliance auditing services, together with the applicable retention period for each category and the legal justification for that period.

UK Fleet Audit Ltd is committed to retaining personal data only for as long as is necessary for the purpose for which it was collected, or as required by law, in accordance with the data minimisation principle under Article 5(1)(e) of the UK General Data Protection Regulation (UK GDPR).

2. Legal framework

The retention periods in this schedule are determined by reference to the following legislation and regulatory requirements:

  • UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 — data minimisation and storage limitation principles

  • Limitation Act 1980 — professional negligence and contractual claims must be brought within 6 years of the act or omission; records must therefore be retained for 6 years to support any defence

  • HMRC record-keeping requirements — financial records including invoices must be retained for 6 years from the end of the relevant accounting year

  • DVSA Operator Compliance Audit framework — operators are required to retain maintenance and tachograph records for a minimum of 15 months; UK Fleet Audit Ltd retains sampled operational data for 13 months post-audit to cover one full annual audit cycle plus a short buffer

3. Repeat audit clients

Where a client engages UK Fleet Audit Ltd for more than one audit, the retention period for client contact details and engagement records runs from the date of the most recent audit or last contact, whichever is later. The clock does not run separately for each individual audit — it resets from the most recent engagement.

This ensures that personal data relating to ongoing client relationships is not deleted prematurely whilst the relationship remains active, whilst still ensuring it is not retained indefinitely once the relationship has ended.

4. Retention schedule

Audit reports
Includes: Formal written audit report including findings, scores, section-by-section results and recommended corrective actions.
Retention period: 6 years from audit date — or 6 years from date of most recent audit where repeat client.
Justification: Limitation Act 1980 — professional liability and negligence claims.

Client contracts and correspondence
Includes: Signed client contracts, engagement letters, emails and written correspondence relating to the audit engagement.
Retention period: 6 years from end of engagement — or 6 years from last contact where repeat client.
Justification: Limitation Act 1980 — contractual claims.

Client contact details
Includes: Name, job title, business email address and telephone number of nominated client contacts.
Retention period: 6 years from last engagement or last contact, whichever is later.
Justification: Legitimate interests — ongoing client relationship management and repeat audit administration.

Operator licence data reviewed
Includes: Operator licence details, transport manager names and CPC certificate details as reviewed and recorded during the audit.
Retention period: 6 years from audit date — or 6 years from most recent audit where repeat client.
Justification: Legitimate interests — supports audit report and any subsequent professional dispute or query.

Driver records reviewed during audit
Includes: Driver names, licence numbers and tachograph data sampled during the audit. Note: individual driver names are not included in the final audit report.
Retention period: 13 months from audit date.
Justification: Data minimisation — retained only to support any query arising from the audit report; does not form part of the report itself.

Training records reviewed
Includes: Staff names and Driver CPC completion dates as sampled during the audit.
Retention period: 13 months from audit date.
Justification: Data minimisation — retained only to support any query arising from the audit report.

Pre-audit documentation submitted by client
Includes: Policies, procedures and other documents submitted by the client ahead of the site visit for pre-audit review.
Retention period: 13 months from audit date.
Justification: Data minimisation — reviewed to inform audit findings; the report contains the findings, not the underlying documents.

Working notes from audit day
Includes: Handwritten or digital notes made by the auditor during the site visit.
Retention period: 13 months from audit date.
Justification: Data minimisation — working notes are superseded by the formal audit report once issued.

Invoices and financial records
Includes: All invoices issued to clients, payment records and associated financial correspondence.
Retention period: 6 years from end of relevant accounting year.
Justification: Legal obligation — HMRC record-keeping requirement.

Business enquiries (no contract formed)
Includes: Name, contact details and enquiry details where contact was made but no audit engagement followed.
Retention period: 2 years from date of enquiry.
Justification: Legitimate interests — reasonable period to follow up an enquiry and maintain a record of prospective client contact.

Driver interview records
Includes: Anonymous numerical records only — Driver 1, Driver 2 etc. No personal data identifying individual drivers is recorded.
Retention period: Not retained beyond completion of the audit report.
Justification: Data minimisation — no personal data is recorded; anonymous responses are used only to inform audit findings.

5. Deletion and destruction

At the end of the applicable retention period, personal data will be deleted or destroyed securely:

  • Electronic records — permanent deletion from all devices and cloud storage, including backup copies

  • Physical documents — confidential shredding

6. Review of this schedule

This retention schedule will be reviewed annually and following any significant change in data processing activities, applicable law or ICO guidance. The current version is always available on request.

Data controller: Rob Richards CMILT, TM CPC, ISO 9001:2015 Lead Auditor
UK Fleet Audit Ltd | Company No. 17309793 | Registered in England and Wales
enquiries@ukfleetaudit.co.uk | www.ukfleetaudit.co.uk

Data Protection and Privacy Policy
UK Fleet Audit Ltd — UK GDPR and Data Protection Act 2018

Version 1.3 | ICO Registration No. ZC199321 | Renewal due 14 July 2027

Organisation: UK Fleet Audit Ltd
Company number: 17309793 — Registered in England and Wales
Registered office: 35 Kingswood Ave, Belvedere, Kent, DA17 5HN
Data controller: Rob Richards CMILT, TM CPC, ISO 9001:2015 Lead Auditor
ICO registration number: ZC199321
ICO registration renewal: 14 July 2027
Contact email: enquiries@ukfleetaudit.co.uk
Contact telephone: 07895501007
Website: www.ukfleetaudit.co.uk

1. Introduction

UK Fleet Audit Ltd is a limited company providing independent transport compliance auditing services to HGV operators across Great Britain. The company is registered in England and Wales (Company No. 17309793) and is operated by Rob Richards CMILT, TM CPC, ISO 9001:2015 Lead Auditor. In the course of providing these services, UK Fleet Audit Ltd processes personal data relating to client representatives, employees, drivers and other individuals.

This policy sets out how UK Fleet Audit Ltd collects, uses, stores, protects and deletes personal data, and explains the rights of individuals whose data is processed. UK Fleet Audit Ltd is committed to processing personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

UK Fleet Audit Ltd is registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZC199321, renewable 14 July 2027, as required under the Data Protection (Charges and Information) Regulations 2018.

2. Who we are

For the purposes of UK GDPR, UK Fleet Audit Ltd is the data controller in respect of personal data collected and processed in connection with transport compliance auditing services. This means UK Fleet Audit Ltd determines the purposes and means of processing personal data.

If you have any questions about this policy or wish to exercise your rights, please contact:

3. Personal data we collect

3.1 Client contact information

When a client engages UK Fleet Audit Ltd, we collect and hold personal data relating to the client's nominated contacts, including:

  • Full name and job title

  • Business email address and telephone number

  • Business address

  • Operator licence details (which may include the name of licence holders and transport managers)

3.2 Audit documentation

During the course of an audit, UK Fleet Audit Ltd will review and may record information from documents that contain personal data, including:

  • Driver names and licence numbers

  • Transport manager names and CPC certificate details

  • Company director names as listed on Companies House or the operator licence

  • Employee training records

  • Tachograph and drivers' hours records (which include driver names and card numbers)

  • Incident and accident records (which may name individuals involved)

  • Driver CPC training records

3.3 Driver interviews

Where driver interviews are conducted as part of an audit, these are carried out on a strictly anonymous and voluntary basis. No personal data identifying individual drivers is recorded or retained. Interview responses are recorded numerically only (Driver 1, Driver 2, etc.) and are used solely to inform the audit findings.

3.4 Special category data

UK Fleet Audit Ltd does not intentionally collect special category personal data (such as health information, race, religion or trade union membership). Where a client's records contain such data (for example, driver medical declarations or occupational health records), UK Fleet Audit Ltd will limit its review to what is strictly necessary for the purposes of the audit and will not record or retain such data beyond what is required for the audit report.

3.5 Website and enquiries

If an individual contacts UK Fleet Audit Ltd by email or telephone to make an enquiry, UK Fleet Audit Ltd will retain the name, contact details and details of the enquiry for the purposes of responding and maintaining a record of business enquiries.

4. Lawful basis for processing

UK Fleet Audit Ltd processes personal data only where a valid lawful basis exists under Article 6 of the UK GDPR. The lawful bases relied upon are as follows:

Client contacts — Name, job title, email, phone. Purpose: delivering audit services and managing the client relationship. Retention: 6 years from last engagement or last contact, whichever is later. Lawful basis: Contract (Art. 6(1)(b)).

Operator licence data — Licence holder name, transport manager name, CPC details. Purpose: conducting the compliance audit and producing the audit report. Retention: 6 years from audit date or most recent audit where repeat client. Lawful basis: Contract / Legitimate interests (Art. 6(1)(b)(f)).

Driver records reviewed — Driver names, licence numbers, tachograph data. Purpose: reviewing compliance with drivers' hours and licence requirements. Retention: 13 months from audit date — not retained in audit report. Lawful basis: Legitimate interests (Art. 6(1)(f)).

Training records — Staff names, CPC completion dates. Purpose: verifying training compliance as part of the audit. Retention: 13 months from audit date. Lawful basis: Contract / Legitimate interests (Art. 6(1)(b)(f)).

Business enquiries — Name, email, phone, enquiry details. Purpose: responding to enquiries and maintaining business records. Retention: 2 years from date of enquiry. Lawful basis: Legitimate interests (Art. 6(1)(f)).

Invoicing and accounts — Client name and contact for invoice purposes. Purpose: meeting legal obligations for financial record keeping. Retention: 6 years from end of relevant accounting year. Lawful basis: Legal obligation (Art. 6(1)(c)).

A full data retention schedule setting out all categories of data and their applicable retention periods is published on the UK Fleet Audit Ltd website and is available on request.

5. How we use personal data

UK Fleet Audit Ltd uses personal data for the following purposes:

  • Providing transport compliance auditing services in accordance with the terms of the client contract

  • Producing written audit reports that record the findings of the audit

  • Communicating with clients about the audit, the report and any follow-up actions

  • Issuing invoices and maintaining financial records as required by law

  • Responding to enquiries from prospective clients

  • Improving the quality and consistency of audit services

UK Fleet Audit Ltd will not use personal data for any purpose that is incompatible with the purpose for which it was collected, and will not sell, rent or otherwise transfer personal data to third parties for marketing or commercial purposes.

6. Sharing personal data

UK Fleet Audit Ltd does not routinely share personal data with third parties. Personal data may be shared in the following limited circumstances:

  • With the client's own transport manager, legal adviser or other authorised representative where required to deliver the audit service

  • With a professional indemnity insurer or legal adviser where necessary to defend a legal claim

  • With HM Revenue and Customs or other regulatory bodies where required by law

  • With the ICO or a court where required by law or legal process

Personal data will not be transferred outside the United Kingdom without ensuring that an equivalent level of protection is in place as required by UK GDPR.

7. Data security

UK Fleet Audit Ltd takes the security of personal data seriously and implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. These measures include:

  • Audit reports and client documents stored in password-protected files or encrypted cloud storage

  • Email communications containing personal data sent via secure email where practicable

  • Physical documents containing personal data kept securely and disposed of by confidential shredding

  • Access to personal data restricted to authorised personnel within UK Fleet Audit Ltd only

  • Regular review of data held to ensure only necessary data is retained

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, UK Fleet Audit Ltd will notify the ICO within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

8. Data retention

UK Fleet Audit Ltd retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. A full data retention schedule is published on the UK Fleet Audit Ltd website and is available on request. The key retention periods are summarised below:

Client contracts and correspondence: 6 years from last engagement or last contact, whichever is later — Limitation Act 1980, contractual claims.

Audit reports: 6 years from audit date or most recent audit where repeat client — Limitation Act 1980, professional liability.

Invoices and financial records: 6 years from end of relevant accounting year — HMRC legal requirement.

Driver records reviewed during audit: 13 months from audit date — data minimisation, not retained in final report.

Driver interview records: Not retained beyond audit report completion (anonymous only) — no personal data recorded.

Business enquiries (no contract formed): 2 years from date of enquiry — legitimate interests.

Individual driver personal data reviewed during audit: Not retained in final report — data minimisation principle.

9. Your rights

Under the UK GDPR, individuals whose personal data is processed by UK Fleet Audit Ltd have the following rights. To exercise any of these rights, please contact UK Fleet Audit Ltd using the details in section 2. Requests will be responded to within one calendar month.

Right of access: You can request a copy of the personal data UK Fleet Audit Ltd holds about you (a Subject Access Request). UK Fleet Audit Ltd will respond within one month.

Right to rectification: If the personal data UK Fleet Audit Ltd holds about you is inaccurate or incomplete, you can ask for it to be corrected.

Right to erasure: You can ask UK Fleet Audit Ltd to delete your personal data where there is no longer a legitimate reason to hold it. This right does not apply where UK Fleet Audit Ltd is required to retain the data by law.

Right to restrict processing: You can ask UK Fleet Audit Ltd to restrict the processing of your personal data in certain circumstances, for example while a complaint is being investigated.

Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you can ask UK Fleet Audit Ltd to provide your data in a structured, commonly used and machine-readable format.

Right to object: Where processing is based on legitimate interests, you can object to the processing of your personal data. UK Fleet Audit Ltd will consider the objection and cease processing unless it can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent: Where processing is based on consent, you can withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

10. Complaints

If you have a concern about the way UK Fleet Audit Ltd handles your personal data, please raise it with UK Fleet Audit Ltd in the first instance using the contact details in section 2. UK Fleet Audit Ltd will investigate and respond to complaints within 30 days.

If you remain dissatisfied after raising a concern with UK Fleet Audit Ltd, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator:

  • Website: www.ico.org.uk

  • Telephone: 0303 123 1113

  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. Third-party processors and tools

UK Fleet Audit Ltd uses third-party software tools and services for accounting, banking, cloud storage and business communications in the delivery of audit services and the management of the business. Where these tools involve the processing of personal data, UK Fleet Audit Ltd ensures that appropriate data processing agreements are in place and that any such tools comply with UK GDPR requirements.

A full record of third-party processors used by UK Fleet Audit Ltd is maintained internally in accordance with the obligation to keep a Record of Processing Activities (ROPA) under Article 30 of the UK GDPR. This record is available to the ICO on request.

Personal data will not be shared with any third-party processor beyond what is necessary for the delivery of the services. UK Fleet Audit Ltd remains responsible for ensuring that any third-party processors it uses apply appropriate safeguards.

12. Website and digital tools

UK Fleet Audit Ltd uses a standalone audit application that runs locally in a web browser on the auditor's device. This application does not transmit personal data to any external server. Audit data is stored locally on the device used by the auditor and is protected by the security measures described in section 7.

The UK Fleet Audit Ltd website at www.ukfleetaudit.co.uk uses cookies to ensure it functions correctly and to provide analytics. A cookie policy is published on the website and details the cookies in use, their purpose and how to manage consent. Users are asked for consent before any non-essential cookies are placed, in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR). Cookie consent is managed through Usercentrics.

13. Changes to this policy

UK Fleet Audit Ltd will review this policy at least annually and following any significant change in data processing activities, applicable law or ICO guidance. The current version of this policy will always be available on request and on the company website at www.ukfleetaudit.co.uk. Where changes are material, UK Fleet Audit Ltd will notify clients and other affected individuals as appropriate.

14. Governing law

This policy is governed by the laws of England and Wales. UK Fleet Audit Ltd processes personal data in accordance with the UK General Data Protection Regulation as it forms part of domestic law by virtue of the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018.

Data controller: Rob Richards CMILT, TM CPC, ISO 9001:2015 Lead Auditor
UK Fleet Audit Ltd | Company No. 17309793 | Registered in England and Wales
ICO registration: ZC199321 | Renewal due 14 July 2027
Version 1.3 | enquiries@ukfleetaudit.co.uk | www.ukfleetaudit.co.uk

bottom of page