1. Who We Are
DriveNexus Ltd (“we”, “us”, “our”) provides fleet compliance management and AI-assisted driver assessment software. We act as a Data Processor on behalf of fleet operators (Data Controllers) and as a Data Controller for platform user accounts.
Contact: privacy@drivenexus.co.uk
2. Data We Collect
Driver Data (processed on behalf of fleet operators)
- Name, date of birth, nationality, contact details
- Driving licence number, expiry date, categories
- Driver CPC card (DQC) details and training records
- ADR certificate details
- Assessment session data including video snapshots, scores, and AI-generated observations
- GPS location data during assessment sessions
- Documents uploaded to the driver vault
Platform User Data (accounts)
- Name, email address, role
- Login activity and session data
- IP address for security purposes
3. Legal Basis for Processing
- Contract (Art. 6(1)(b)): Processing necessary to provide the service to fleet operators
- Legitimate Interest (Art. 6(1)(f)): Driver safety assessment and fleet compliance monitoring
- Legal Obligation (Art. 6(1)(c)): DCPC training records required under EU Directive 2003/59
- Consent (Art. 6(1)(a)): Where obtained from drivers prior to assessment sessions
4. How We Use Data
- Providing driver compliance tracking and DCPC management
- Generating assessment reports and safety scores
- Fleet risk analysis and trend reporting
- Certificate generation for training completion
- Compliance calendar and expiry reminders
5. Data Sharing
We do not sell personal data. Data may be shared with:
- Fleet operators: Your employer or contracted fleet operator has access to your data
- External instructors: Receive minimum necessary data only (name, vehicle type, assessment scores)
- JAUPT/DVSA: DCPC training records uploaded as required by law
- Infrastructure providers: UK-based hosting and backup services
6. Data Retention
- Driver assessment records: 6 years (operator licence compliance)
- DCPC training records: 7 years (regulatory requirement)
- User account data: Duration of contract + 2 years
- Session video snapshots: 90 days unless saved to report
- Consent records: Permanent audit trail (immutable)
7. Your Rights (UK GDPR)
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate data
- Right to Erasure: Request deletion (subject to legal retention obligations)
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Object: Object to processing based on legitimate interest
To exercise any right, contact privacy@drivenexus.co.uk. We will respond within 30 days. You also have the right to complain to the ICO.
8. Cookies
We use essential cookies only:
- Session cookie: Required for authentication (deleted on browser close)
- Preference cookie: Dark/light mode preference (localStorage, not transmitted)
- Consent cookie: Records that you have seen this notice (localStorage)
We do not use analytics cookies, advertising cookies, or third-party tracking.
9. Security
- Passwords stored using industry-standard cryptographic hashing
- CSRF protection on all forms
- Rate limiting and account lockout protection
- Data isolated per company (multi-tenant architecture)
- UK-based server infrastructure
10. Data Processing Agreement
Fleet operators using DriveNexus Office are Data Controllers. We act as Data Processor under Article 28 UK GDPR. A Data Processing Agreement (DPA) is available on request and must be signed before processing driver personal data.
Contact legal@drivenexus.co.uk to request a DPA.
11. Changes to This Policy
We will notify registered users of material changes by email. The policy version is displayed at the top of this page. Continued use of the service after notification constitutes acceptance.