Privacy Policy

Kedra Fleet Ltd ("Kedra", "we", "us", or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our fleet management platform at kedrafleet.co.uk and any associated services.

We are the data controller for the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018). If you have any questions about this policy, please contact us at hello@kedrafleet.co.uk.

1. Data We Collect

Account Information

When you register for a Kedra account, we collect your name, email address, company name, and password. If you subscribe to a paid plan, we also collect billing information through our payment processor.

Vehicle and Fleet Data

You may enter vehicle registration numbers, make, model, MOT dates, tax status, mileage, service records, and other fleet-related information. Where you use our DVLA integration, we retrieve publicly available vehicle data from the DVLA on your behalf.

Usage Data

We automatically collect information about how you interact with the platform, including pages visited, features used, timestamps, browser type, device type, and IP address. This data is collected through Vercel Analytics and essential cookies.

Communications

If you contact us via email or our contact form, we retain the content of your message, your email address, and any attachments you provide.

2. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Kedra platform and its features
• Process your account registration and manage your subscription
• Retrieve and display vehicle information via the DVLA integration
• Send you transactional emails such as compliance reminders, MOT alerts, and billing receipts
• Power AI-assisted features, including our fleet assistant and smart suggestions
• Analyse usage patterns to improve the platform and fix issues
• Respond to your support enquiries and communications
• Comply with legal obligations and enforce our terms of service

3. Legal Basis for Processing

We process your personal data on the following grounds:

• Performance of a contract: to provide the services you have subscribed to
• Legitimate interests: to improve our platform, prevent fraud, and ensure security
• Consent: where you have opted in to receive marketing communications
• Legal obligation: to comply with applicable laws and regulations

4. DVLA Data Handling

When you use our DVLA lookup feature, we query the DVLA vehicle enquiry service using the registration numbers you provide. The data returned (such as MOT status, tax status, make, model, and colour) is publicly available information. We store this data within your account to provide ongoing compliance monitoring and alerts. We do not share DVLA data with any third parties beyond what is necessary to provide the service.

5. Third-Party Services

We use the following third-party services to operate Kedra. Each acts as a data processor on our behalf:

• Supabase — database hosting, authentication, and file storage. Data is stored in Supabase-managed infrastructure.
• Vercel — application hosting, serverless functions, and web analytics.
• Stripe — payment processing. We do not store your full credit card details; these are handled entirely by Stripe in compliance with PCI DSS.
• Resend — transactional email delivery for compliance alerts, receipts, and notifications.
• Anthropic— AI processing for our fleet assistant feature. Prompts and responses may be processed by Anthropic's API but are not used to train their models.

6. Cookies

We use essential cookies to manage authentication sessions and basic analytics cookies via Vercel Analytics to understand how the platform is used. We do not use third-party advertising or tracking cookies. For full details, please see our Cookie Policy.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the service. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal, accounting, or regulatory purposes (typically up to 6 years for financial records).

Vehicle and fleet data associated with your account will be deleted when your account is closed. You may export your data at any time before closing your account.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication through Supabase, role-based access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please email us at hello@kedrafleet.co.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. International Data Transfers

Some of our third-party service providers process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your data in accordance with UK GDPR requirements.

11. Children's Privacy

Kedra is a business-to-business service and is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on the platform. The "Last updated" date at the top of this page indicates when the policy was last revised.