Fleet Privacy Policy

Last updated: 16 August 2026

This Fleet Privacy Policy explains how MEKAVO LTD ("Mekavo", "we", "us") collects, uses and protects data in connection with the Mekavo fleet management platform.

This policy applies specifically to fleet operators, their organisations, team members (managers and drivers), and the vehicle and inspection data processed through the Service.

1. Who We Are

MEKAVO LTD is a company registered in England and Wales (No. 16477044), with its registered office at 76 Letchworth Road, Leicester, LE3 6FH, United Kingdom.

For fleet data, we act as a data processor on behalf of the fleet operator (the data controller). For account registration and billing data, we act as the data controller.

2. Data Controller & Processor Roles

Under GDPR, the roles are as follows:

• Fleet operator (your organisation) — Data Controller for driver personal data, vehicle data, inspection records and defect reports within your organisation
• Mekavo — Data Processor, processing data on your behalf to provide the Service
• Mekavo — Data Controller for account registration data, billing information and website analytics

As a fleet operator, you are responsible for ensuring you have a lawful basis to process your drivers' data and for informing them accordingly.

3. What Data We Collect

We collect the following categories of data:

Organisation data: Organisation name, address, industry, registration number, billing details

User account data: Name, email, phone number, password (hashed), role within organisation

Vehicle data: Registration/plate number, make, model, VIN, mileage, MOT dates, documents, photos

Inspection data: Inspection type, checklist responses (pass/fail), photos, notes, GPS location (if enabled), timestamps, inspector identity

Defect data: Description, severity, photos, reporter identity, timestamps, resolution status and history

Billing data: Stripe customer ID, subscription plan, payment history (we do not store card details — Stripe handles this)

Usage data: Login timestamps, feature usage, device type, IP address, browser information

Dashcam video: Road-facing video recorded while a shift is running, plus number plates read from it, lane position and following distance. All of this is worked out on the phone itself

Cabin audio: Sound recorded alongside dashcam video so a clip is a complete account of what happened. Recorded by default; can be turned off at any time in dashcam settings

Location during a shift: Precise location, including while the app is in the background, used to record the route of a shift and to place an incident. Recorded only while a shift is open

4. How We Use Your Data

We process your data for these purposes:

• Providing the fleet management service (inspections, defects, vehicles, teams)
• Sending reminders (MOT, insurance, tax, service dates) via email or SMS
• Processing payments and managing subscriptions
• Generating compliance reports and dashboards
• Improving the Service based on usage patterns
• Communicating service updates and security notices
• Complying with legal obligations

We do not sell your data. We do not use driver inspection data for advertising or marketing purposes.

5. Driver Data

When drivers are invited to a fleet organisation, we collect and process:

• Name and email address (provided by the organisation owner or the driver themselves)
• Phone number (optional, for SMS reminders)
• Inspection records completed by the driver (timestamped, attributed)
• Defect reports submitted by the driver (timestamped, attributed)
• Login activity and device information

Organisation owners and managers can view driver inspection and defect records. Drivers can view their own records and assigned vehicles.

Driver rights: Drivers may request access to their data, correction of inaccuracies, or deletion of their account. If a driver leaves an organisation, their personal account persists but organisation data access is revoked. Inspection and defect records created within the organisation may be retained by the organisation for compliance purposes.

6. Inspection & Defect Data

Inspection and defect records are core to the Service. This data:

• Is stored securely and associated with the organisation, vehicle and user who created it
• May include photographs, GPS coordinates, timestamps and free-text notes
• Is accessible to authorised organisation members according to their role
• May be exported by organisation owners for audit and compliance purposes
• Is retained according to the organisation's settings or applicable regulatory requirements

7. Data Sharing

We share data only in these circumstances:

• Within your organisation — team members see data according to their role permissions
• Stripe — for payment processing (PCI DSS compliant)
• Vehicle data providers — when you request vehicle lookups (registration number only)
• SMS providers — phone numbers for reminder delivery
• Law enforcement — when required by law or court order

We do not share your fleet data with other organisations, advertisers or data brokers.

8. Data Retention

We retain data as follows:

• Active accounts — data retained while the account/organisation is active
• Deleted accounts — personal data deleted within 90 days of deletion request
• Inspection records — retained for the duration set by the organisation or minimum regulatory period (typically 15 months for daily walkaround checks under DVSA guidelines)
• Billing records — retained for 7 years as required by UK tax law
• Server logs — deleted after 90 days

9. Your Rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Portability — receive your data in a structured format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interest

To exercise these rights, contact us at [email protected]. We respond within 30 days.

California residents have additional rights under the CCPA, including the right to know what data we collect, the right to delete it, and the right to opt out of data sales (we do not sell data). To exercise CCPA rights, contact us at the address below.

10. Security

We implement appropriate technical and organisational measures to protect your data:

• All data encrypted in transit (TLS/HTTPS) and at rest
• Passwords hashed with bcrypt
• Access controls based on user roles
• Regular security updates and monitoring
• Infrastructure hosted on secure cloud providers with ISO 27001 certification
• Stripe PCI DSS Level 1 compliant payment processing

11. International Transfers

Your data is primarily processed and stored within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

12. Changes to This Policy

We may update this policy from time to time. We will notify organisation owners of material changes via email. The "Last updated" date at the top will always reflect the current version.

13. Dashcam, Camera and Audio Recording

Your dashcam recordings stay on the driver's phone. Mekavo records to the phone's own storage, and reads number plates, lane position and following distance on the device itself. Footage is not streamed to us and is not uploaded in the background.

Nothing leaves the phone on its own. Automatic backup of incident footage is switched off unless a driver turns it on. Apart from that, a clip reaches us only when a driver chooses to send it — for example to keep evidence of an incident, or to share it with their fleet operator.

Cabin audio is recorded together with the video, because a clip without sound is only half an account of what happened. A driver can switch it off in dashcam settings, and the microphone is used only while the dashcam is recording.

If a driver does send a clip, it is stored under a unique random address that we do not publish or index, and it is listed only inside their organisation's records. Clips are kept for 90 days on a free plan and 365 days on a paid plan; footage a driver seals as evidence is kept for about two years; a share link expires after 90 days.

Deleting a recording. A driver can delete a clip from their phone at any time, and deleting it in the app removes it from our storage too. Deleting the account removes the recordings with it, as described in section 8.

14. Contact Us

For privacy-related enquiries:

MEKAVO LTD
Company No. 16477044
76 Letchworth Road
Leicester, LE3 6FH
United Kingdom

Email: [email protected]