• LEGAL
How Tacho Agent collects, uses and protects personal data - including the driver and vehicle unit data our clients entrust to us.
Last updated: 08/07/2026 · ICO registration: ZC175805
Tacho Agent Ltd (“Tacho Agent”, “we”, “us”) is a specialist tachograph analysis and compliance bureau for UK HGV and PSV fleet operators. We operate remotely, with a presence in London, Preston and Middlesbrough.
● Registered in England & Wales, company number 16306575
● VAT registration GB 501 394 128
● ICO registration ZC175805
● Contact: hello@tachoagent.com
● Registered address: 128 City Road, London, United Kingdom, EC1V 2NX
This policy applies to our website at www.tachoagent.com and our landing page at www.tachoagent.co.uk.
We are registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection. This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We handle personal data in two very different capacities, and your rights and our responsibilities depend on which one applies to you.
We are the data controller, meaning we decide how and why personal data is used, for:
● visitors to our sites;
● people who contact or enquire with us (for example through our contact form, by email or by phone);
● prospects and business contacts we approach or correspond with; and
● marketing recipients.
Most of this policy is written for you if you fall into one of those groups.
When a fleet operator engages us to analyse its drivers’ tachograph data, the operator is the data controller and we act only as a data processor. We analyse each operator’s data on that operator’s documented instructions, under a written data processing agreement, and produce that operator’s compliance reports. We do not use driver data for our own purposes.
If you are a driver whose data we analyse, your employer (or the operator you drive for) is responsible for telling you about this processing, normally through its employment privacy notice. Your data protection rights are exercised against the operator as controller; if you contact us directly, we will refer your request to the relevant operator and assist them in responding. The section “Driver tachograph data - our processor role” below explains more.
If you contact us through our site contact form, by email or by phone, we collect the details you give us: typically your name, email address, phone number, company name and the content of your message.
We use this information to respond to you, to provide information or quotes you have asked for, and to manage our relationship with you or your company. Our lawful bases are: taking steps at your request before entering into a contract (Article 6(1)(b) UK GDPR) where your enquiry relates to our services, and otherwise our legitimate interests (Article 6(1)(f)) in responding to enquiries and running our business.
Our sites use Webflow Analyze to understand how the sites are used, at a high level. Analyze is set to track all visitors, but it does not use cookies and does not collect personal data - it records anonymous, non-identifying information about site usage (such as pages viewed and general engagement) using your browser’s local storage, in aggregate. We do not use it to identify you or to track you across other websites. Our Cookies Policy explains this in more detail. Lawful basis: our legitimate interests in understanding and improving our sites.
We contact UK fleet operators who we believe may benefit from our services, by email, by telephone follow-up, and by post. Email outreach is sent via our email delivery provider, Instantly.ai, from a separate domain (tachoagent.co.uk) to protect the deliverability of our main domain.
Our lawful basis under UK GDPR is our legitimate interest (Article6(1)(f)) in promoting our services to relevant businesses. We have carried out a legitimate interests assessment covering this activity.
Direct marketing is also regulated by the Privacy and Electronic Communications Regulations 2003 (PECR).Our outreach is directed at corporate subscribers - predominantly limited companies - in their business capacity.
Email. Under PECR we may email the business contact details of corporate subscribers without prior consent, provided we identify ourselves and offer a way to opt out, which we do in every message. Every email includes a working unsubscribe mechanism, and we honour opt-outs promptly and maintain a suppression list.
Telephone. Before making marketing calls we screen numbers against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and we do not call numbers registered with them unless we have the necessary consent. On everycall we identify ourselves and, if asked, tell you how you can opt out and where to find this policy. We add anyone who asks not to be called to our suppression list.
Post. We may also send promotional material by post to fleet operators at their business address. Postal marketing is not coveredby the PECR rules that apply to email and calls; we rely on our legitimate interest (Article 6(1)(f)) in promoting our services to relevant businesses, and you can ask us to stop at any time. We honour requests not to receive post, keep a suppression record, and respect the Mailing Preference Service (MPS).
Where we obtained your details. Where we hold your business contact details for marketing, we obtained them from publicly available sources: company websites, the traffic commissioners’ public registers, Google search and Google Maps. Because we collect these details from sources other than you directly, we provide this privacy information to you at the latest when we first contact you: our outreach emails link to this policy, on calls we tell you where to find it, and our postal mailings include details of how to opt out and where to read this policy, so you can see how your data is used. You can ask us at any time to stop contacting you and we will do so.
For driver tachograph data, the fleet operator is the controller and Tacho Agent is the processor. Each engagement is governed by a written data processing agreement that meets the requirements of Article 28 UK GDPR. Drivers are informed about the processing by the operator, normally through the operator’s own employment privacy notice; we supply operators with suggested wording for this.
Tachograph and related compliance data, which may include: driver names and driver card numbers; vehicle registration and unit information; driving, working, rest, break and availability times; distance and speed data; working time records; and infringement indicators, exceptions, event records, notes and reports generated by or derived from tachograph equipment.
We can receive driver data in the following ways:
● by downloading raw tachograph files from the operator’s existing fleet compliance platform (such as TruTac, FleetCheck, Tachomaster, Tachosys or Aquarius) under read-only access granted to us by the operator; and
● as files provided to us directly by the operator.
In the future we may offer additional methods, such as a secure upload portal, direct access arrangements or receipt via an intermediary. These are not live today and should not be treated as live until implemented. If we introduce them, we will update this policy and the relevant contractual documents.
We analyse each operator’s data solely to produce that operator’s drivers’ hours, working time and compliance reports, on the operator’s instructions. We do not sell driver data, and we do not currently retain, pool or combine driver data across operators for our own benchmarking, analytics or scoring purposes.
In the future, and only with operators’ agreement, we may use pseudonymised driver data to improve and benchmark our analysis across sectors and to develop related compliance and safety analytics services. Pseudonymised data remains personal data under UK GDPR, and any such use would only be introduced under an updated agreement with the relevant operators and an updated privacy notice, with appropriate safeguards. We are not doing this today, and nothing in this policy permits it.
We do not sell personal data. We share it only with service providers (sub-processors, where we act as processor) who help us run our business, under contracts that protect your data:
● Google Workspace - our email and file storage platform (data region set to Europe);
● Webflow - our site and contact-form hosting platform (site enquiry data only, stored in the United States - see “Where personal data is stored”);
● Instantly.ai - our outreach email delivery platform (business contact data only, not driver data);
● Cloudflare - form spam protection (Turnstile) on our sites;
● HubSpot - our customer relationship management (CRM) system, used to manage prospect and client business contacts and our communications with them (business contact and client-relationship data only, not driver data).
We may also disclose personal data where required by law, or to professional advisers under duties of confidentiality.
Our email and file storage is Google Workspace, with the data region set to Europe. Personal data we hold there may be stored in data centres in the UK or the European Economic Area (EEA). Transfers of personal data from the UK to the EEA are permitted under the UK’s adequacy regulations.
Our CRM is provided by HubSpot, with data hosted in the European Economic Area (EEA); transfers from the UK to the EEA are permitted under the UK's adequacy regulations.
Site form data - United States. Our sites and their forms are hosted by Webflow, which stores site form-submission data (such as the name, email, phone, company and message you send us through our contact or free report forms) in the United States. This is a restricted transfer outside the UK, and we rely on Webflow’s approved transfer mechanism to make it lawful. This applies only to site enquiry data - it does not apply to driver tachograph data, which is handled through Google Workspace (Europe) and is not stored in Webflow.
Where any personal data is transferred outside the UK, we rely on an approved transfer mechanism - for example a country the UK has found to provide adequate protection, or the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
Separately, our sites load fonts from Google (Google Fonts), which involves your browser contacting Google as a page loads. This is explained in our Cookies Policy and is a different matter from where we store your data.
We use appropriate technical and organisational measures to protect personal data, including secure and encrypted transfer and storage, access controls limiting who can see the data, staff confidentiality, and pseudonymisation of driver data where it is used in analysis. We keep these measures under review.
Site and enquiry data (controller role): we keep enquiry, prospect and business contact data for 24 months from our last contact with you, unless you become a client (in which case we keep it for the duration of the relationship and as required afterwards for legal and accounting purposes) or you ask us to delete it sooner.
Driver tachograph data (processor role): under our agreement with the operator, we keep driver data for no longer than is needed to provide the service and, where we retain it to substantiate our analysis, up to 24 months after the end of the period the records relate to, in line with operators' own statutory record-keeping obligations (including the two-year working time retention requirement under the Road Transport (Working Time) Regulations 2005), so we can substantiate our analysis if queried, after which it is deleted or returned on the operator's instruction.
Suppression records: if you opt out of marketing, we keep the minimum details needed to make sure we do not contact you again.
Under UK GDPR you have the following rights in relation to personal data we hold about you as a controller:
● Right of access - to obtain a copy of your personal data;
● Right to rectification - to have inaccurate data corrected and incomplete data completed;
● Right to erasure - to have your data deleted in certain circumstances;
● Right to restriction - to limit how we use your data in certain circumstances;
● Right to data portability - to receive certain data in a structured, commonly used, machine-readable format;
● Right to object - including an absolute right to object to direct marketing, and a right to object to processing based on legitimate interests;
● Rights in relation to automated decision-making and profiling - we do not make solely automated decisions with legal or similarly significant effects about you.
To exercise any of these rights, contact us at hello@tachoagent.com. We will respond within one month (extendable by up to two further months for complex requests, in which case we will tell you). There is normally no fee. If you are a driver and your query relates to tachograph data we process for your operator, please contact your operator in the first instance, as the controller. If you contact us, we will pass your request to the operator and assist them in responding. If you are unable to reach the operator, contact us and we will help so far as we are able.
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, telephone 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Our website operates without a cookie banner because we do not use non-essential cookies or trackers. The limited technologies we do use - our website analytics (Webflow Analyze), which uses your browser's local storage rather than cookies to record anonymous usage data; form spam protection (Cloudflare Turnstile); and the loading of fonts from Google - are set out in our separate Cookies Policy, which forms part of this policy.
We may update this policy from time to time. We will publish the current version on our sites with its effective date, and where changes are significant we will take reasonable steps to bring them to your attention.