Who is responsible for what
Fleet Log is workshop management software operated by App-Artery. There are two different relationships in it, and they carry different responsibilities under the Data Protection Act 2019.
For the records a workshop keeps in Fleet Log (its customers, their vehicles, service history and job cards), the workshop is the data controller and App-Artery is the data processor. The workshop decides what to record and why; we hold it on their behalf and act on their instructions. The terms of that arrangement are in our data processing agreement.
For the accounts of the people who sign in, and for our own billing and support records, App-Artery is the controller.
The regulator for this processing is the Office of the Data Protection Commissioner.
What we hold
- Account data: your name, email address, role and the workshop you belong to, together with a hashed password. We never store a password in a form we can read.
- Workshop records entered by your workshop: customer names, telephone numbers, email and postal addresses, vehicle registrations and details, odometer readings, job cards, service history and prices.
- Operational data: sign-in times, and server logs that record requests to the service.
We do not use tracking or advertising cookies, and we do not run analytics on your use of the service. Fleet Log sets two cookies: one to keep you signed in, and one to remember whether you chose the light or dark theme. Both are strictly necessary for the service to work as you asked it to.
Why we hold it, and on what basis
Account data is processed because it is necessary for the performance of our contract with the workshop: without it there is no way to sign anyone in or decide what they may see.
Workshop records are processed on the workshop's instructions under our data processing agreement. The workshop is responsible for having its own lawful basis under the Act for holding its customers' details, which for a garage is normally the performance of its contract with that customer, or its legitimate interest in keeping a service history for a vehicle it has worked on.
Server logs and security records are processed on the basis of our legitimate interest in keeping the service available and establishing what happened when something goes wrong.
We do not sell personal data, and we do not use it to train machine learning models.
Where it is held, and why that matters
Fleet Log runs in Amazon Web Services' London region, eu-west-2. This means a Kenyan workshop's records are processed outside Kenya, in the United Kingdom.
We say this plainly because you are entitled to know it before you type a customer's telephone number into the service. The transfer is made because it is necessary for the performance of our contract with the workshop, and the United Kingdom provides a comparable standard of data protection to that required by the Act. The records concerned are ordinary commercial records of vehicle servicing; they are not data subject to the localisation requirements the Act reserves for processing prescribed on strategic-interest grounds.
Data is encrypted at rest and in transit. Backups are taken daily and kept for seven days, in the same region.
How long we keep it
Workshop records are kept for as long as the workshop keeps its account, and are deleted when the workshop asks us to delete them.
Deleting a customer in Fleet Log removes that customer's record together with their vehicles, job cards and service history. The deletion is immediate and it is not reversible.
There is one exception. Where a record forms part of an invoice or another accounting record, we and the workshop may be required to keep it to meet a legal obligation. Tax law generally requires business records to be retained for a period of years after the transaction. A record retained for that reason is kept for that purpose alone, and is not used for anything else.
Account data is deleted within 30 days of an account being closed, apart from anything covered by the exception above.
Your rights
Under the Data Protection Act 2019 you have the right to be informed of the use to which your personal data is put, to access it, to object to its processing, to have it corrected where it is inaccurate or misleading, and to have it deleted where there is no lawful ground to keep it.
If the data concerned is a workshop's records, the workshop is the controller and the request should go to them first; we will help them answer it. If it concerns your Fleet Log account, write to us directly.
Where a person accepted our terms on behalf of a workshop, we keep a record of who did so and when. That record is part of the workshop's contract with us and is kept even if the person's account is later closed.
You also have the right to complain to the Office of the Data Protection Commissioner. We would rather you told us first, but that right does not depend on it.
Who else processes it
Amazon Web Services, for hosting and storage, in the London region. Amazon Simple Email Service, for the emails the service sends: invitations and password resets. Both are listed as sub-processors in our data processing agreement.
We will tell workshops before we add another sub-processor.
Contacting us
Write to App-Artery using the address on the Fleet Log sign-in page. We aim to reply to anything about personal data within one working day.
App-Artery is registered with the Office of the Data Protection Commissioner as a data processor. We will publish our registration number here.
Changes
This policy carries a version and an effective date. When we change it we publish the new version here, and where the change is significant we tell workshop owners in the application.