Privacy policy

Purpose

CarCloud Solutions Ltd, a company registered in England and Wales with company number 16029395 whose registered office is at Grosvenor House, 11 St Pauls Square, Birmingham, B3 1RB (“CarCloud Solutions”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This privacy notice explains how we process your personal data on our website, in the CarCloud web app and in the CarCloud companion app (the web app and companion app together being the CarCloud Platform). This privacy notice also informs you of your privacy rights pursuant to applicable Data Protection Laws including where applicable the UK Data Protection Act 2018, the UK GDPR and the EU GDPR.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZB928332. This notice should be read together with the CarCloud End User Licence Agreement (www.carcloudsolutions.com/eula), which applies to your use of the CarCloud Platform, and our Terms of Service (www.carcloudsolutions.com/terms-of-service).

Controller for Personal Data

A “controller” is a person or organisation who alone or jointly determines the purposes for which and the way any personal data is or is likely to be processed. Unless we notify you otherwise, CarCloud Solutions is the controller of your personal data for the purposes of this website and our direct business activities.

If you use the CarCloud Platform for your own personal use (as a consumer), CarCloud Solutions is the controller of your personal data.

Processor for Personal Data

Where we process personal data on behalf of our Customers for example, when providing fleet management or vehicle data services we act as a Processor and process personal data in accordance with the Customer’s documented instructions and our contractual obligations.

This includes information about drivers, vehicles, incidents and driving licence checks that a business customer manages using the CarCloud Platform. In that case the business customer (usually the driver’s employer or the organisation they work for) is the controller and its own privacy notice also applies to you. We use carefully selected sub-processors to help us provide these services, including ONO App Ltd (ONO.app), which provides the incident and claims tracking software that forms part of the CarCloud Platform. The current list of our sub-processors is published at www.carcloudsolutions.com/sub-processors.

Scope

This privacy notice applies to the processing of personal data by us in connection with:

• Customers: Businesses and other organisations (business customers) that subscribe to the CarCloud Platform, and the individuals who represent them, where we provide fleet management, SaaS platforms, telematics data services (once available), dashboards, vehicle data analytics or related services. In this notice, “Customer” and “business customer” mean the same thing (a “Business Subscriber” in our Terms of Service) and never include a Consumer.
• Consumers: Individuals who subscribe to the CarCloud Platform for their own personal use, for example to manage their own vehicles. Consumers are called “Consumer Subscribers” in our Terms of Service.
• End Users: Employees, contractors, drivers or authorised users of our Customers who access or use our platforms, dashboards or applications.
• Named drivers and other people: People whose details are added to the CarCloud Platform by a customer or user, for example a named driver, or a third party, passenger or witness involved in an incident.
• Suppliers: Where you provide products or services to us.
• Website Visitors: Anyone browsing our website or interacting with our content online.

The CarCloud Platform is only for people aged 18 or over. We do not knowingly collect personal data about children, except where a user records details of a child involved in an incident (for example, a passenger).

Types of Personal Data

Personal data means any information about an individual from which that person can be identified. It does not include anonymised data.

CarCloud Solutions may collect, use, store and transfer different kinds of personal data grouped as follows:

• Identity Data: first name, last name, username, employee ID, title.
• Contact Data: business or home address, billing address, email address, telephone numbers.
• Financial Data: bank account details and payment information. Note where we use third party payment providers, we only see limited financial data.
• Transaction Data: details about payments to and from you and services provided.
• Technical Data: IP address, login data, browser type and version, time zone setting, operating system, device information (including device type and app version for the companion app), push notification tokens (once push notifications are available) and related technology.
• Profile Data: username and password, account preferences, feedback and survey responses.
• Usage Data: information about how you use our website, dashboards, portals and services.
• Marketing and Communications Data: your preferences in receiving marketing communications.
• Vehicle and Telematics Data: vehicle registration number, make and model, MOT, tax, insurance, finance and servicing dates and other details you add to your digital garage, vehicle identifiers, trip data, route history, geolocation data and related fleet information, including (once this feature is available) data imported through API connections from the telematics providers used by our business customers. It also includes vehicle valuations, details of any finance agreement registered against a vehicle, and maintenance and fuel-cost forecasts. We provide these for company-owned vehicles and personal accounts only, never for grey fleet vehicles on a business customer’s account.
• Incident and Claims Data: details of incidents and first notifications of loss, including dates, times, locations, descriptions, photographs and videos, details of the vehicles and other people involved (such as third parties, passengers and witnesses), and insurer and claim references.
• Health Data: information about injuries or the wellbeing of people involved in an incident, where this is recorded (see ‘Incident information and health data’ below).
• Driving Licence Data (business customers only): driving licence number, entitlements, endorsements, penalty points and disqualifications obtained from the DVLA through a licence check requested by a business customer, and a record of the driver’s consent to the check.
• Insurance and Finance Enquiry Data: details you give us when you ask to be introduced to an insurance or finance provider, and records of the introductions we make.

Depending on your relationship with us, we may process some or all of the categories above.

Lawful Bases: How We Use Your Personal Data

We will only use your personal data where permitted by law including:

• Performance of a contract: where processing is necessary to perform a contract with you or your employer.
• Legal obligation: where processing is necessary to comply with a legal obligation.
• Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests. Where we rely on legitimate interests, you can ask us for more information about how we have balanced our interests against your rights (our legitimate interests assessment), and you have the right to object (see ‘Controller: Data Subject Rights’ below).
• Consent: where required, particularly for marketing communications or non-essential cookies. You may withdraw consent at any time by contacting us.
• Vital interests: where necessary to protect your vital interests.
• Special category and criminal offence data: where we process Health Data, or Driving Licence Data (which may include information about driving offences), we do so only where an additional condition under the UK GDPR and the Data Protection Act 2018 applies. For example, this may be where it is necessary to establish, exercise or defend legal claims, where you have given your explicit consent or, for business customers, where it is necessary for the customer’s obligations as an employer. Where we process this data on behalf of a business customer, the customer is responsible for identifying the condition that applies.

How We Collect Your Personal Data

Directly from You

You provide personal data when you:

• Complete website forms
• Register for an account
• Use our platform or dashboards
• Contact us for support
• Enter into a contract with us
• Subscribe to communications
• Record an incident or a first notification of loss
• Ask us to introduce you to an insurance or finance provider

Third-Party Sources

We may receive your personal data from:

• Business customers who add End User, driver, vehicle and incident details or request driving licence checks
• The DVLA, through our licence-checking service provider, for driving licence checks requested by business customers
• Public vehicle records, such as DVLA vehicle tax and DVSA MOT information, when you add a vehicle to your digital garage
• Other users of the CarCloud Platform, for example where a driver records an incident involving you
• (Once available) telematics providers and other services that a business customer connects to the CarCloud Platform through an API connection
• Payment processors
• IT and cloud service providers
• Analytics providers: PostHog, for product analytics and session recording in the CarCloud Platform (only with your consent), and Google Analytics, for our website (only with your consent).
• Marketing and advertising partners

We also automatically collect certain Technical and Usage Data through cookies and similar technologies when you interact with our website or services. In the CarCloud Platform, we use PostHog for product analytics and session recording, but only if you accept analytics when you log in. Session recordings are set up to mask passwords and other sensitive information, such as driving licence and incident details. If you are a driver or other user on a business customer’s account, CarCloud is the controller of this analytics data, which we use only to improve the CarCloud Platform.

Processing Tables

The following tables explain why we process personal data and the lawful basis for doing so. Please consult the applicable table relevant to your relationship with us.

Business Customer: Processing Information

This processing table applies to Business Customers (and the individuals who represent them) and explains how CarCloud Solutions processes personal data when delivering our services. It outlines the relevant processing activities, the categories of personal data involved and the lawful bases relied upon in accordance with applicable data protection laws.

End User (employee, driver or other user of a Business Customer): Processing Information

This processing table applies to End Users i.e. employees or authorised users of our Customers and explains how CarCloud Solutions processes personal data when providing access to and operating our platform and other services.

Incident information and health data (Claims & Incidents Tracking: coming soon)

When an incident is recorded using the CarCloud Platform, information about any injuries or the wellbeing of the people involved may be recorded. Health information is special category data, and we handle it with extra care and restrict who can access it.

Please only record health information that is needed for the incident report or claim. Do not upload medical records unless your insurer or, for business users, your employer has asked for them.

Where we act for a business customer, the customer (usually your employer) is the controller of this information and decides the condition it relies on. Where you use the CarCloud Platform as a consumer, we rely on your explicit consent or, where the information is needed to establish, exercise or defend a legal claim, on that condition. You can withdraw your consent at any time, but this will not affect information that has already been sent to your insurer.

If you record information about another person, such as a third party, passenger or witness, please make sure you are entitled to do so and, where appropriate, let them know that you have shared their details.

Driving licence checks (business customers only; coming soon)

Where a business customer uses the CarCloud Platform to check the driving licence of one of its employees or subcontractors, we process the driver’s licence information on behalf of that customer, which is the controller. A check is only carried out once the driver has given the consent required by the DVLA, which the driver gives through the CarCloud Platform before the check is run. We keep a record of that consent. Driving licence information may include details of driving offences, which is treated as criminal offence data, and the customer is responsible for having a lawful basis and an appropriate condition under the Data Protection Act 2018. Drivers should also read their employer’s privacy notice. We do not carry out driving licence checks for consumers.

The business customer can view and filter licence check results, for example to show drivers with between 3 and 6 penalty points, or 6 or more. CarCloud does not produce any score, rating or risk profile about individual drivers, and any decision based on the results is made by the business customer.

Telematics and connected data

We plan to introduce this feature in future and will update this notice before it goes live. We do not provide telematics services ourselves. Once the feature is available, where a business customer connects the CarCloud Platform to its own telematics provider or another service, we import data from that service through an API connection so that the customer can view and manage it in the CarCloud Platform. This data may include vehicle location, journeys and driving events. The business customer is the controller of this data and decides how it is used, for example whether it is shared with an insurer or used in connection with a claim, and we only use and share it on the customer’s instructions. Drivers should read their employer’s privacy notice for details of how telematics data is used.

Insurance and finance referrals

CarCloud Solutions Ltd (FCA Firm Reference Number 1055210) is an appointed representative of ComplianceTrak Ltd (company number 11095036; registered office 14 Wistanes Green, Wessington, Alfreton, Derbyshire, DE55 6JN; FCA Firm Reference Number 914597; www.compliancetrak.io), which is authorised and regulated by the Financial Conduct Authority (FCA). Under that appointment we act as a credit broker for vehicle finance and introduce customers to FCA-authorised insurers and insurance brokers (including for secondary vehicle products such as GAP insurance, warranty and asset protection), for which the provider pays us an introduction fee. We do not advise on or recommend specific insurance products. If you were introduced to us by a partner, that partner is the provider we will refer you to for the products and services it provides. Otherwise, we refer you to the provider we recommend (for insurance and finance, an FCA-authorised provider). When you ask us to refer you, we will share the details needed with that provider, and the provider will share with us the information needed to confirm the referral so that it can pay us commission. Where we carry out insurance or credit broking activities for you, we will also record information about your needs and the products discussed, using systems provided by ComplianceTrak Ltd, as FCA rules require. Those records may be monitored and audited by ComplianceTrak Ltd. The provider will then be a separate controller of your personal data and will give you its own privacy notice. We will not pass your details to a provider unless you ask us to. We also share records of introductions, and any related complaints, with ComplianceTrak Ltd so that it can carry out its regulatory oversight of us. ComplianceTrak Ltd may share this information with the FCA and the Financial Ombudsman Service where required. ComplianceTrak Ltd is a separate controller of the information it receives for its regulatory oversight of us, and its privacy policy is available at www.compliancetrak.io.

Audience Partners and the CarCloud Store (coming soon)

Our Audience Partner features are coming soon. When they are available, if you were introduced to CarCloud by one of our partners (an Audience Partner), your account will be tagged with an attribution code (a UTM code). We will use it to apply the correct partner rate, show the partner’s branding on your dashboard, and calculate any revenue associated with that partner. We do this on the basis of our legitimate interests. We only share your personal data with your introducing partner, or allow it to contact you about its own products, in line with the consent choices you make when you register. You can change these choices at any time by contacting us at hello@carcloudsolutions.com or, for marketing emails, by using the unsubscribe link in the email.

When the CarCloud Store is available and you click through to a Store Partner’s website, we may tell that partner that you were referred by CarCloud so that we can receive a referral fee. Any purchase you make is between you and the Store Partner, which will use your personal data under its own privacy notice. Card payments for your CarCloud subscription are processed by our payment provider, Stripe, which collects your card details directly. We do not store your full card details. Stripe acts as a separate controller for some purposes, such as fraud prevention and meeting its own legal obligations, and its privacy policy is available at stripe.com/privacy.

CarCloud payment card

If you apply for or use a CarCloud payment card (when available), your application, card and transaction data will be processed and stored in the UK by Atlas Consolidated (UK) Ltd (company number 16197917; registered office 14 Queen Anne’s Gate, London, SW1H 9AA), the UK subsidiary of Atlas Consolidated Pte. Ltd. (Singapore), a financial services and banking-as-a-service technology provider, which provides the card programme using its Hugo Hub product line. Atlas Consolidated (UK) Ltd has applied to the Financial Conduct Authority for authorisation as an electronic money institution. The regulated services for the card, including issuing the card and holding electronic money, are provided by FCA-authorised third parties, which will be named in the cardholder terms. The card will only be offered once the necessary authorisations are in place. Atlas Consolidated (UK) Ltd and the authorised card issuer will carry out identity, anti-money laundering and fraud checks, which may involve credit reference and fraud prevention agencies, and each will be a controller of your personal data under its own privacy notice. We receive card and transaction information from Atlas Consolidated (UK) Ltd so that we can display it in the CarCloud Platform.

Consumer (Personal User): Processing Information

This processing table applies to Consumers, i.e. individuals who use the CarCloud Platform for their own personal use, and explains how CarCloud Solutions processes their personal data as controller.

Supplier: Processing Information

This processing table applies to Suppliers and service providers and explains how CarCloud Solutions processes personal data in the course of managing our supplier relationships.

Website Visitor: Processing Information

This processing table applies to website visitors and outlines how CarCloud Solutions handles personal data collected through the use of our website.

Note: Where required by applicable law, consent will be obtained for non-essential cookies or similar tracking technologies. Please refer to our Cookie Policy for further information.

Cookies and similar technologies

We may gather information and statistics collectively about visitors to our website. Analysis of this information demonstrates the most frequently used sections of the website and assists us in continually improving the online service. Please also refer to our Cookie Policy for more information on how we set cookies. We will ask for your consent before using cookies that are not strictly necessary, except where the law allows certain cookies to be used without consent, for example cookies used only to produce statistics to improve our website or to remember your preferences. In that case we will tell you about them and give you a simple way to object. Full details of the cookies we use, and how to change your choices, are in our Cookie Policy at www.carcloudsolutions.com/cookie-policy.

Our companion app

If you use the CarCloud companion app, we also collect information about your device, such as its type, operating system and app version, so that the app works properly and securely. With your permission, given through your device settings, the app can also use: your camera and photos, for example to add pictures to an incident report; your location, for example to record where an incident happened; and, once available, push notifications, for example to send you MOT, tax or insurance reminders. You can change these permissions at any time in your device settings, although some features may not work without them. The app uses analytics and crash-reporting tools to help us find and fix problems; the providers are named in our Sub-processor List (www.carcloudsolutions.com/sub-processors). Our Cookie Policy explains the similar technologies the app uses.

Providing personal data

Where we need to collect personal data by law or under the terms of a contract and you do not provide that information when requested we may not be able to perform the contract we have or are trying to enter into with you for example to provide you with our services. In this case we may have to cancel our service, but we will notify you if this is the case at the time.

Marketing communications

We may send you marketing communication. You have the right to object to processing of your personal data for direct marketing purposes. You can unsubscribe from receiving marketing communications from us by using the unsubscribe methods contained in communications we send to you or by contacting us. See Contact us.

Where you opt out of receiving marketing communications this will not apply to personal data provided to us as a result of registering for or using our service, your service experience or other interactions with this website.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes, legitimate purposes and other reasons subject to this Notice.

Such circumstances where we disclose information may include:

• Internally: Your personal data will be used by our employees and contractors who are working on providing our services to you on a need-to-know basis.
• With our affiliates: CarCloud does not currently have any group companies. If it does in future, we may share information within our corporate group to operate and manage our business effectively and to provide you with the services you request, and those companies will protect it in the same way we do.
• Our service partners: With vendors or other third parties who perform services on our behalf (for example IT management, customer support and cloud storage). The providers we use to run the CarCloud Platform, including for hosting, sign-in, vehicle data and valuations, driving licence checks, email, push notifications, error monitoring and analytics, are named in our Sub-processor List (www.carcloudsolutions.com/sub-processors).
• Incident and claims tracking provider: ONO App Ltd (ONO.app), whose software we use under the CarCloud brand to record incidents and first notifications of loss and to track claims. ONO processes this data on our behalf as our data processor.
• Insurers: the insurer you (or, for business users, your employer) choose, when you or they decide to send incident details to it.
• Driving licence check provider and the DVLA: for driving licence checks requested by business customers.
• Insurance and finance providers: FCA-authorised firms that we refer you to, at your request.
• ComplianceTrak Ltd, the FCA and the Financial Ombudsman Service: as explained in ‘Insurance and finance referrals’ above.
• Business customers: if you are a driver or user on a business customer’s account (including as a grey fleet driver), that customer can see the information recorded about you in the CarCloud Platform, for example incidents and licence check results.
• Audience Partners: the partner that introduced you to CarCloud, only in line with the consent choices you make at registration.
• Store Partners: when you choose to click through to a Store Partner from the CarCloud Store, to record the referral.
• Payment provider: Stripe, which processes card payments for your subscription (see ‘Audience Partners and the CarCloud Store’ above).
• Card programme provider and card issuer: Atlas Consolidated (UK) Ltd (company number 16197917), which will provide the CarCloud payment card programme in the UK using its Hugo Hub product line, and the FCA-authorised third parties that provide the regulated card services, once the card is available.
• Law enforcement, regulators and courts: where we are required to do so by law.
• Marketing partners: From time to time we may work with business and marketing partners to provide services and to promote CarCloud. Where we share your information with them, they will use it in accordance with their own privacy notices. We will always obtain your consent before sharing your contact details with third parties for their own marketing.
• Legal advisors: To enforce any applicable terms of service and to protect or defend the Services, our rights and the rights of our users or others.
• Professional advisers: This would include bankers, auditors and insurers who provide consultancy, banking, insurance and accounting services.
• Advertising networks and analytics service providers: We may use analytics providers to understand how our website and the CarCloud Platform are used, and advertising networks to show relevant advertising about CarCloud on our website and on other websites and social media. Analytics and advertising cookies are used only with your consent (see our Cookie Policy). We do not currently display third-party advertising in the CarCloud Platform.
• Business transactions (M&A): This is in connection with a business transaction such as a merger or acquisition. Where this is the case, your personal data shall continue to be processed in accordance with this Privacy Notice.

International transfers

The CarCloud Platform is hosted in the UK. Some of our service providers, such as our website analytics and customer relationship management providers, may process personal data outside the UK, for example in the United States. Where this happens, we make sure your personal data is protected by at least one of the following safeguards:

• We will only transfer your personal information to countries that the UK Government has approved as providing an adequate level of protection for personal data (under UK adequacy regulations); or
• We will use contracts approved for use in the UK, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed to protect your personal data.

You can contact us for more information about the safeguards we use.

Grey fleet drivers (using your own vehicle for work)

If you drive your own vehicle for work, your employer (one of our business customers) adds you to its CarCloud business account, in the same way as its other drivers. Your employer is the controller of that information and we process it on your employer’s behalf (see ‘Processor for Personal Data’ above). The business account holds only what your employer needs to run its business and remain compliant: for example, your vehicle details, that your vehicle is insured, taxed and has a valid MOT, your declaration that business-use insurance is in place and its renewal date, and the results of any driving licence checks. It does not hold your vehicle’s valuation or your costs of running it, such as insurance, finance and other costs that are not business-related.

Your business-use insurance declaration is yours: we record it but do not check it, and you are responsible for keeping it accurate. Your employer’s privacy notice explains how your employer uses this information.

You can also choose to open your own personal CarCloud account, for example to manage your vehicle’s finance and insurance costs. A personal account is completely separate from your employer’s business account: the two are not linked, we are the controller of your personal account, and nothing in it is shared with or visible to your employer. Opening one is entirely your choice.

If someone else has given us your details

Users of the CarCloud Platform may give us your details. For example, you may be a named driver on someone’s vehicle, a driver employed by or working for one of our business customers, or a third party, passenger or witness involved in an incident. In that case we will usually hold your name and contact details and information about the vehicle or incident, and, if you drive for a business customer, the other information described in this notice. We use it for the purposes described in this notice, and it may be shared with insurers and others as described above. If you drive for a business customer, that business is the controller of your information, and its own privacy notice will tell you more. You have the same rights over this information as anyone else, and you can contact us at hello@carcloudsolutions.com.

Family garages (shared personal accounts)

If you join someone else’s personal CarCloud account (a family garage), the account holder owns and controls that account. Everything you add or record in it, including your vehicle, insurance, finance and other costs, documents and incident records, is visible to and controlled by the account holder, and to any admin the account holder appoints. If you have a driver role, you see only the vehicles you drive. The account holder and any admin can edit or delete anything in the family garage. We are the controller of your personal data in the family garage, and we use it to provide the account to the account holder and to you (performance of a contract with you under our End User Licence Agreement, and our legitimate interests). If you want to keep this information private, open your own personal account instead. A personal account is completely separate, and its information is not part of any family garage.

You can leave a family garage at any time, and the account holder can remove you at any time. The vehicles and records in the family garage, including those you added, then stay with the account holder unless they remove them. You can ask us for a copy of the information you added, in a commonly used electronic format, and ask us to delete personal information that relates only to you, such as your own insurance or finance details. We will do this after telling the account holder, unless we are entitled or required by law to keep it. Moving a vehicle and its information directly to your own personal account is not currently available, but you can add the vehicle to your own account and use your copy.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Our security measures include encryption of data in transit and at rest, access controls, regular security testing, audit logging, and business continuity and disaster recovery procedures. Our service providers are bound by contract to keep your personal data secure and to tell us promptly about any security incident.

The transmission of information via the internet is not completely secure. Although we will take reasonable measures to protect your personal data, we cannot guarantee the security of your information transmitted.

Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We apply the retention periods below. Where we process personal data on behalf of a business customer, we follow that customer’s instructions, and these periods apply only where the customer has not told us otherwise. At the end of the relevant period we securely delete or anonymise the data.

How we use anonymised and aggregated data

We anonymise and aggregate data from the use of the CarCloud Platform, including vehicle, journey, incident and driving licence check information, so that it no longer identifies you, any vehicle or any business. We then use the anonymised data, and may share, license or sell it, for purposes including:

• developing, training, testing and operating our products and services, including artificial intelligence and machine learning models and agentic features;
• improving road safety, vehicle maintenance and fleet management;
• producing benchmarks, statistics, research and market insight; and
• creating aggregated reports, datasets and analytical products for third parties, such as insurers, insurance intermediaries, finance providers, vehicle manufacturers and dealers, telematics and mobility providers, researchers, regulators and local or national authorities.

We never include health information. Driving licence check information, and data we receive from other data suppliers such as the DVLA, is included only in aggregated statistical form, and only where the law and the supplier’s terms allow. We follow the Information Commissioner’s guidance on anonymisation and test our methods regularly. We only release anonymised data in groups large enough that no individual, vehicle or business can be singled out, and we require anyone we share it with not to try to identify anyone. We do not use anonymised data to make decisions about you or to price products for you. We train our own artificial intelligence models only on anonymised data. Anonymised data is not personal data.

Anonymising your personal data is itself a use of your personal data. We do this on the basis of our legitimate interests in developing our services and data products, and you have the right to object (see ‘Controller: Data Subject Rights’). If you drive for or work for one of our business customers, we anonymise its data on that customer’s instructions (Terms of Service Clause 29.6), and its privacy notice explains this.

Controller: Data Subject Rights

Where we act as a controller under certain circumstances, you have rights under Data Protection Laws. Not all rights are absolute and depending on where you are located, not all rights are given to you. You can:

• Request access to your personal data: This is known as a “subject access request” and enables you to receive a copy of the personal data we hold about you.
• Request correction of your personal data: This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you at the time of your request.
• Object to processing of your personal data: This is where we are processing your personal data based on a legitimate interest or those of a third party and you may challenge this. However, we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to any legal claims. See also Marketing communications.
• Request restriction of processing your personal information: This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the information’s accuracy (b) where our use of the information is unlawful but you do not want us to erase it (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
• Request transfer of your personal information (“data portability”): This is where in some circumstances we will provide to you or a third party you have chosen your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: This is where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. Depending on the processing activity, we may not be able to provide certain services to you if you withdraw your consent. We will advise you if this is the case at the time you withdraw your consent.
• Automated decision making: This is where decisions are made about you solely by automated means, without any human involvement. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. We do not produce any score, rating or risk profile about individual drivers. Business customers can view and filter driving licence check results (for example, by number of penalty points), but any decision based on them is made by the business customer, not by CarCloud. If we ever introduce automated scoring, we will update this notice before it is used and explain the safeguards available to you, including the right to have a person review any significant decision made about you.
• Right to complain to us: You can complain to us if you are unhappy with how we have used your personal data. See ‘Concerns and complaints’ below.

Carrying out your data subject rights

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information or to exercise any of your other rights. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We will respond to your request without undue delay and within one month of receiving it. If we need information from you to confirm your identity or to clarify your request, the month will run from when we receive that information. If your request is complex or you have made a number of requests, we may extend this by up to two further months, and we will tell you within the first month if we need to do so. When responding to a request for access to your personal data, we will carry out a reasonable and proportionate search.

If you wish to exercise any of the rights set out above, please contact us at hello@carcloudsolutions.com.

Processor: Data subject rights

Where we act as a processor, you should first contact your employer regarding any exercise of your data subject rights. We may assist your employer (our customer) in responding to your request but all requests must be submitted through your employer in the first instance. If we receive a request directly, we will pass it to the relevant customer promptly.

Keeping personal information accurate and current

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. Please contact us if you wish to update your personal data.

Concerns and complaints

We would appreciate the chance to deal with your concerns in the first instance. Please see Contact us section. If you have unresolved issues, you have the right to complain at any time to a data protection supervisory authority for data protection issues such as the UK data protection regulator – the Information Commissioner’s Office (ICO).

You can complain to us about how we use your personal data by using the contact form on our website or in the CarCloud Platform, or by emailing hello@carcloudsolutions.com. We will acknowledge your complaint within 5 business days of receiving it, investigate it without undue delay and tell you the outcome. You can also contact the ICO at www.ico.org.uk or on 0303 123 1113.

You may lodge a complaint with a supervisory authority if you live or work outside the UK or you have a complaint concerning our personal data processing activities.

Changes to our privacy notice

This privacy notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update our privacy notice. We will obtain your consent to any material privacy notice changes if and where this is required by applicable Data Protection Laws.

Contact us

If you would like more information about the way we manage personal information that we hold about you please contact us at:

Email address: hello@carcloudsolutions.com
Post: CarCloud Solutions Ltd, Grosvenor House, 11 St Pauls Square, Birmingham, B3 1RB

Version control

This version was last updated on 5 October 2026.