United Kingdom privacy
UK GDPR Privacy Notice
Effective: 10 October 2026 · Version 2026-10-10
1. Who we are
Trukfox is a business software service for trucking operations. The Trukfox provider identified on your order form, invoice, or subscription confirmation is responsible for the account and commercial information described in this Policy. Contact the privacy team at privacy@trukfox.com.
For UK-controlled processing described in this Policy, the data controller is TRUKFOX LTD, registered in Scotland under company number SC905403. Send privacy enquiries to privacy@trukfox.com.
If a data protection officer is appointed, their details will be published here and on the relevant order form; no DPO is represented as appointed unless those details are shown.
For US-controlled processing, the US Trukfox provider named in the order form is the business or controller. Its full legal name, state of organisation, and principal address must be added when the entity details are finalised.
2. Our data-protection roles
For website visitors, company enquiries, platform administrators, account security, billing, and our own service operations, Trukfox normally acts as controller.
For personal data placed in a company workspace by a Customer, the Customer normally acts as controller and Trukfox acts as processor. This includes staff, driver, customer, route, order, note, document, incident, daily-check, and tachograph information. Users should direct requests about that information to the trucking company first.
Where applicable, our Data Processing Addendum forms part of the Customer contract.
For US state privacy laws, Trukfox processes Customer Data as a service provider or contractor and will not retain, use, disclose, sell, or share it outside the contract and permitted business purposes.
3. Information we collect
Website and signup information
- Company and contact name, business email, phone number, fleet size, enquiry text, terms version, and acceptance time.
- Technical information such as IP address, browser, device, request time, referring page, and security events.
Account information
- Name, business email, role, company membership, account status, login time, and authentication records.
- Support conversations and administrator actions, including password-reset and account-change records. We do not store readable account passwords.
Customer operational data
- Order numbers, customers, phone numbers, pickup and delivery locations, cargo details, drivers, status, instructions, vehicle details, times, fees, notes, and audit history.
- Documents and metadata, such as invoices, proof of delivery, images, filenames, file type, uploader, and upload time.
Offline device copies
Offline-capable versions save encrypted copies of permitted workspace information, prepared protected paperwork and pending changes on your device, including evidence you choose to attach. Copies are scoped to the signed-in account and company. Drivers receive a signed offline allowance, normally valid for seven days and configurable by the service operator from one to 30 days. Native apps also maintain an encrypted delivery queue containing the scoped session and offline allowance needed to retry permitted changes when the operating system allows background work. The server verifies current account status and permissions before renewing a session or accepting changes. Account revocation cannot immediately reach a disconnected device; cached access ends when the allowance expires or the device learns of the rejection.
Tachograph data
- Original driver-card and vehicle-unit download files, driver and card identifiers, vehicle identifiers, activity periods, driving, other-work, availability and rest records, distance, recorded events, faults, overspeed records, download dates, and derived review flags.
- Access is limited by company and role. Drivers can access only files assigned to them; authorised company administrators can access company records. Card and vehicle identifiers shown in summaries may be masked, while protected originals are retained for authorised access.
Connected mailbox data
- Mailbox provider, server, username, folder, sender restrictions, connection status, message identifiers, subjects containing order numbers, and eligible attachments.
- Mailbox app passwords are encrypted at rest using authenticated encryption. They are not returned to the browser after saving.
- We do not intend to use message content for unrelated purposes. Messages without relevant order numbers may be recorded only as processed/ignored identifiers to avoid repeated processing.
Optional help assistant
Guided help does not use an external AI provider. When external AI is configured by the service operator and enabled by your company administrator in Settings → Platform assistant, eligible software-help questions you type and limited workflow context, such as your role and enabled features, are sent through the Trukfox backend to OpenAI. The company setting starts disabled and applies to its users. Workspace records, attachments, credentials and conversation history are not automatically included. Any personal or operational information you type in the message forms part of that transmission. The application does not persist assistant conversations. Help answers are limited to approved platform guidance. Suggested order drafts require your review and the normal order-save process.
Where information comes from
We receive information directly from you; from the Customer and its administrators; from authorised staff, drivers, customers, suppliers, and connected mailboxes; automatically from browsers, devices, and security logs; from payment, hosting, email, and support providers; and from public business records where reasonably necessary for account verification or legal compliance. Where the Customer supplies data about another person, the Customer is responsible for giving that person an appropriate notice.
Where Trukfox is controller and receives personal data indirectly, we provide the information required by Article 14 of the UK GDPR within a reasonable period and no later than one month, at first communication, or before first disclosure, whichever applies—unless the person already has it or another lawful exception applies.
Special-category and criminal-offence data
Trukfox does not require special-category or criminal-offence data for the standard Service and Customers must not upload it unless expressly agreed. If such processing is agreed, the Customer must identify an Article 6 lawful basis, an Article 9 condition or applicable Data Protection Act 2018 Schedule 1 condition, maintain any required appropriate policy document, and give documented instructions. Trukfox will apply any additional agreed safeguards.
4. Why we use information
| Purpose | UK GDPR lawful basis |
|---|---|
| Respond to company enquiries and set up accounts | Steps before a contract and legitimate interests |
| Provide company workspaces, orders, documents, reports, and support | Contract; legitimate interests; processor instructions |
| Authenticate users, prevent misuse, investigate incidents, and maintain audit records | Legitimate interests and legal obligations |
| Process payments, invoices, tax, and accounting records | Contract and legal obligations |
| Improve reliability and usability | Legitimate interests, using aggregated or minimised data where practical |
| Send important service, security, legal, or account notices | Contract, legal obligations, and legitimate interests |
| Send optional marketing | Consent where required, or permitted business-to-business legitimate interests with an opt-out |
| Purpose | Business purpose |
|---|---|
| Respond to enquiries and create accounts | Customer service and performing requested transactions |
| Provide workspaces, orders, documents, reports, billing, and support | Providing, maintaining, and servicing the product |
| Authenticate users and investigate misuse | Security, integrity, fraud prevention, and debugging |
| Meet tax, accounting, and legal duties | Compliance with law and exercising legal rights |
| Improve reliability and usability | Internal research and product improvement using minimised or aggregated data where practical |
Legitimate interests
Where we rely on legitimate interests, those interests are operating a secure business service, preventing fraud and misuse, supporting Customers, maintaining auditability, improving reliability, protecting legal rights, and communicating with business contacts about relevant services. We balance those interests against the person’s rights, reasonable expectations, relationship with the Customer, sensitivity of the information, and available safeguards. You may ask for information about a particular balancing assessment.
Consent and required information
Where consent is the lawful basis, it may be withdrawn at any time without affecting earlier lawful processing. Account identity, business contact, authentication, billing, and core operational information is required to enter into or perform the Customer contract. If it is not provided, we may be unable to create an account, provide a requested feature, secure the Service, or meet a legal obligation. Optional fields and marketing choices are identified as such.
5. Who receives information
We may share information with vetted hosting, storage, email, security, monitoring, support, payment, accounting, and professional-service providers where needed. They may use it only under contract and for the agreed service. Company administrators and authorised staff can access data according to their roles.
OpenAI receives assistant prompts only for the optional AI use described above. Trukfox disables Responses application-state storage for those requests; this does not mean zero provider retention. Provider abuse-monitoring retention and other controls depend on the configured OpenAI project and applicable agreement. See OpenAI API data controls.
We may disclose information to courts, regulators, law enforcement, insurers, advisers, or another party to a business sale where legally required or reasonably necessary to protect rights, safety, security, or the Service. We do not sell personal data.
6. International transfers
Trukfox may operate and use service providers in the United Kingdom, United States, and other countries. Information may therefore be processed outside the country where it was collected.
For a restricted transfer from the UK, we use a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, approved binding corporate rules, or another lawful safeguard. Where required, we complete a transfer risk assessment (the UK “data protection test”) and apply supplementary technical or organisational measures. A copy of the relevant safeguard, with confidential information removed where necessary, may be requested from privacy@trukfox.com.
For US personal information, providers must process information under contract for the purposes described in this Policy. Data may be processed in another US state or country, subject to applicable law and security safeguards.
7. How long we keep information
- Signup requests are typically retained for up to 24 months after the last meaningful contact unless a longer period is needed for a resulting contract, dispute, or legal obligation.
- Account, subscription, invoice, and contract records are retained during the relationship and typically for up to 6 years afterward where needed for legal, tax, and accounting purposes.
- Customer Data is retained for the subscription and a limited exit or recovery period, then deleted or anonymised according to the agreement, backups, legal obligations, and documented Customer instructions.
- Security and technical logs are kept only as long as reasonably necessary for security, troubleshooting, and legal claims.
- Processed mailbox identifiers are bounded and pruned to prevent unneeded growth.
- Drivers can read prepared company information and protected paperwork during their signed offline allowance, normally seven days and never more than 30 days. Other permitted cached workspace reads are limited to 24 hours and a valid session. Encrypted cached bytes can remain until cache eviction, sign-out or device/site-data clearing. Pending changes remain until synced, discarded or cleared; changes older than 30 days require review and are not automatically erased. Native receipt history is bounded; receipts older than 30 days are pruned on subsequent successful delivery. Explicit sign-out clears saved local work, including unsynced changes; changing to another account is blocked until pending work is synced or discarded.
8. Security
Measures include password hashing, session revocation, role-based controls, tenant-scoped database access, protected file endpoints, masked tachograph identifiers, encrypted mailbox credentials and offline device copies, audit records, input validation, and persistent storage controls. Native delivery queues use device Keychain or Keystore keys. Access is limited to people and providers who need it. No system can guarantee absolute security.
9. UK privacy rights
Subject to conditions and exemptions, you may have the right to:
- be informed about processing and obtain access to your personal data and a copy;
- have inaccurate data corrected and incomplete data completed;
- have data erased, or processing restricted, in qualifying circumstances;
- receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where portability applies;
- object to processing based on legitimate interests or public task, and object at any time to direct marketing;
- withdraw consent at any time where processing relies on consent; and
- seek safeguards in relation to a significant solely automated decision and complain to a supervisory authority.
For information held in a trucking company workspace, contact that company first because it normally controls the data. For Trukfox-controlled data, email privacy@trukfox.com. We may ask for proportionate information to verify identity and authority. We normally respond within one month; UK GDPR permits an extension for complex or numerous requests, in which case we will explain the delay.
You may complain to the Information Commissioner’s Office through ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or using the postal details published by the ICO. We would appreciate the opportunity to address the issue first, but that does not limit your right to contact the ICO.
9. United States state privacy rights
Residents of US states with an applicable comprehensive privacy law may have rights to confirm processing, access, correct, delete, or obtain a portable copy of personal information. Depending on the state, residents may also opt out of targeted advertising, sale, certain profiling, or sharing for cross-context behavioural advertising, and may appeal a denied request.
In the preceding 12 months, we may have collected the categories described in section 3: identifiers and contact details; internet or electronic activity; commercial and account records; professional or employment-related information; approximate location inferred from IP address; and contents of communications or documents submitted to the Service. We collect these categories from individuals, Customers, authorised users, connected mailboxes, devices, and service providers for the purposes in section 4, and disclose them to the recipients in section 5.
Trukfox does not sell personal information for money and does not currently share personal information for cross-context behavioural advertising or use it for targeted advertising. We do not knowingly sell or share personal information of people under 16. If these practices change, we will provide the notices and opt-out methods required by applicable law.
Some information, such as account credentials, precise document contents, and mailbox credentials, may be considered sensitive personal information under certain laws. We use it only to provide and secure the Service and do not use it to infer characteristics about individuals.
Submit a US state privacy request or appeal to privacy@trukfox.com. An authorised agent may submit a request where state law permits; we may require proof of authority and identity. We will not discriminate against you for exercising applicable rights. Rights and exemptions vary by state, and business-to-business or employee data may be wholly or partly exempt.
10. Automated decision-making and profiling
Trukfox does not currently make solely automated decisions about individuals that produce legal or similarly significant effects. Tachograph review flags, document matches, status suggestions, and reports are decision-support tools for authorised human review; the Customer remains responsible for decisions and any required explanation.
If significant solely automated decision-making is introduced, we will give meaningful information about the logic involved, significance and likely consequences, and the safeguards required by UK law. Those safeguards include a route to make representations, obtain human intervention, and contest the decision.
11. Customer responsibilities
Customers must provide appropriate privacy notices to staff, drivers, customers, and other individuals; use lawful bases; limit access; keep records accurate; and avoid uploading excessive or irrelevant personal data. Do not upload special-category, criminal-offence, medical, biometric, or highly sensitive data unless specifically agreed and lawfully protected.
12. Children
Trukfox is a business service and is not directed to children. Users must be at least 18 unless the Customer has lawfully authorised and supervised an older minor in a work context and applicable law permits it.
13. External resources
Our pages may load fonts from Google Fonts and images from an image host; those providers may receive technical request information such as IP address. HERE receives submitted addresses for routing and geocoding, and map-tile coordinates through the Trukfox backend that identify the viewed area. When UK postcode address lists are configured, Ideal Postcodes receives the postcode entered for that search through the Trukfox backend. Other order fields, staff identities, contact numbers and chat history are not automatically attached to address searches. Links to Gmail, Microsoft, Yahoo, or other websites are governed by those providers’ own privacy policies.
14. Changes
We may update this Policy as the Service, providers, or law changes. The latest version and effective date will be posted here. Material changes will be notified through the Service or by email where appropriate.
15. Contact
Email privacy questions or rights requests to privacy@trukfox.com. Security concerns should be sent to security@trukfox.com.