1. Who we are

Nitor Plus Limited (company number 10867611) develops and operates Data Trak, a web application, mobile application and related service.

In this policy, “Nitor Plus”, “we”, “us” and “our” refer to Nitor Plus Limited. “Data Trak” refers to the application, mobile app, website and related service provided by Nitor Plus Limited.

Registered office: C/O Andersons, White Gables Farm, Blunham Road, Bedford, Bedfordshire, MK44 3RA.

Website: https://datatrak.app | Email: [email protected]

2. Our role

Most organisations use the Data Trak application to manage their own staff, drivers and operations. In those circumstances, the organisation using Data Trak is normally the data controller and decides why and how personal information is used. Nitor Plus Limited acts as its data processor and handles information on its documented instructions.

Nitor Plus Limited acts as a data controller for information used to operate its own business, such as customer contacts, account administration, security, billing, service enquiries and the website.

If your employer or another organisation gave you access to Data Trak, you should also read that organisation’s privacy information and normally direct rights requests to it.

3. Information we may collect

Account and contact information

• Name, email address, telephone number and job role.
• Organisation, account code, employee or driver identifier and login details.
• Customer support messages and service communications.

Device, usage and security information

• IP address, device type, operating system, app version and identifiers used for notifications.
• Login activity, audit records, diagnostic information and error logs.
• Cookie and session information used to provide, protect and improve the website and service.

Operational information

• Shift, timesheet, job, delivery, journey and vehicle information.
• Vehicle checks, defects, accident reports, compliance records and related notes.
• Photographs, documents, signatures, scanned barcodes or QR codes where the relevant feature is used.

Location information

Where enabled by the organisation and permitted on the device, Data Trak collects precise location information to support delivery tracking, journey logging and operational visibility.

When location data is collected

Location data may be collected while the app is open, running in the background or closed/terminated. This occurs only when the user has started an active shift in the app. Data Trak is not intended to track a user outside an active shift; location collection stops when the shift ends.

Why location data is collected

• Track delivery routes and record journey history and stop locations.
• Provide real-time operational visibility, route information and ETAs.
• Support compliance, auditing and reporting.
• Improve delivery and logistics performance.

How location data is used and stored

• Location data is transmitted securely to our servers and linked to the user account and active shift.
• Information is accessible only to the customer organisation, its authorised personnel and authorised Data Trak personnel where required to provide support.
• Location data is retained only for as long as necessary under the customer’s retention requirements and our contract.

We do not sell location data or share it with third parties for advertising or marketing. It may be processed by vetted infrastructure providers solely to operate and protect the service.

4. DVLA driving licence information

Where an authorised customer has a legitimate business need to confirm a driver’s entitlement to drive, Nitor Plus Limited may use the Data Trak application to retrieve driving licence information from the Driver and Vehicle Licensing Agency (DVLA) through the Access to Driver Data (ADD) service. The service is not used for identity checking, advertising or marketing.

A check may include:

• Driver and licence details, including licence number, status and validity dates.
• Categories and entitlements to drive, restrictions and relevant codes.
• Endorsements, penalty points and disqualifications.
• Certificate of Professional Competence (CPC) and digital tachograph card information where specifically requested and available.

Before a check is made, the customer must ensure that the driver has received appropriate privacy information and has completed the current DVLA-approved declaration or approval process where required. A driver may withdraw that approval through the organisation that requested the check, subject to any legal or employment consequences explained by that organisation.

5. Why we use personal information

Depending on the features selected by the customer, information may be used to:

• Create and secure accounts, authenticate users and provide the contracted service.
• Plan, record and manage transport, delivery, fleet and workforce operations.
• Confirm entitlement to drive and support road safety, insurance and fleet compliance.
• Record working time, vehicle checks, defects, incidents and other compliance activity.
• Provide customer support, maintain the service and investigate faults or misuse.
• Protect users, customer information, systems and infrastructure.
• Meet contractual, accounting, legal and regulatory obligations.

6. Lawful bases

Where Nitor Plus Limited acts as controller, we rely on one or more lawful bases under UK data protection law: performance of a contract, compliance with a legal obligation, our legitimate interests in providing and protecting a business service, or consent where it is the appropriate basis and can be withdrawn.

Where Nitor Plus Limited acts as processor, the customer is responsible for identifying and communicating the lawful basis for its processing. Completion of a DVLA declaration or approval is a requirement of the ADD checking process; the customer must separately ensure that its processing has an appropriate lawful basis under data protection law.

7. Who we share information with

We share information only where necessary for the purposes described in this policy. Recipients may include:

• The organisation that provides or manages the user’s Data Trak account and its authorised administrators.
• DVLA, when a driving licence enquiry is submitted or where required to operate the ADD service.
• Vetted service providers that support hosting, storage, communications, security, support or maintenance.
• Professional advisers, insurers, regulators, courts, law enforcement or public authorities where disclosure is necessary and lawful.

We do not sell or rent personal information, and we do not share personal or location information for third-party advertising.

8. International transfers

Our core service and DVLA data are intended to be hosted and processed in the United Kingdom. If an approved supplier processes other personal information outside the UK, we will ensure that an appropriate UK data transfer safeguard is in place and carry out any required risk assessment.

9. How long information is kept

We keep personal information only for as long as it is needed for the purpose for which it was collected, to follow the customer’s documented instructions, or to meet legal, contractual, security and audit requirements.

• Customer operational information, including location and DVLA check results, is retained for the period set by the customer under its retention requirements and our contract, then deleted or anonymised securely.
• Account and security records are kept while the account or customer service is active and for a limited period afterward where needed for security, audit, dispute resolution or legal claims.
• Business contracts, invoices and associated records may be kept for up to six years after the relevant financial year or contract ends where required for accounting, tax or legal purposes.
• Backups are retained on a limited rolling cycle and are protected from ordinary access until overwritten.

The maximum validity of a DVLA declaration is not, by itself, a retention period. The customer must choose a justified retention period for licence information and delete it when it is no longer required.

10. How we protect information

We use appropriate technical and organisational measures proportionate to the risks involved. These include encrypted network communications, unique user accounts, password controls, role-based access, restricted administrative access, logging and monitoring, software and security updates, malware protection, backups, incident management, supplier controls and physical security measures.

No system can be guaranteed to be completely secure. Users and customer administrators must protect their credentials, use only authorised devices and promptly report suspected loss, misuse or unauthorised access.

11. Your data protection rights

Depending on the circumstances, you may have rights to access personal information, correct inaccurate information, request deletion, restrict or object to processing, receive portable information, and withdraw consent where processing relies on consent. Some rights are subject to legal limitations.

If Nitor Plus Limited processes information only for your employer or another customer through Data Trak, please contact that organisation first. We will assist the customer in responding where required.

You may complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113. We would appreciate the opportunity to address your concern first.

12. Cookies and app permissions

Our website may use cookies that are necessary for login sessions, security and core functionality. Any non-essential cookies will be used only where permitted and described in the relevant cookie controls.

The app may request the following permissions when required by a selected feature:

• Location – required for delivery tracking, journey logging and related operational features during an active shift.
• Camera (optional) – used to capture delivery evidence, inspection or incident photographs, and to scan barcodes or QR codes.
• Files or storage (optional) – used to upload and store photographs and documents.
• Notifications (optional) – used for jobs, compliance reminders, operational messages and service notices.

Permissions are used only for their stated purposes and can be managed in device settings. Disabling a required permission may prevent the related feature from working.

13. Children

Data Trak is a business service and is not designed for use by children under 16.

14. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The current version will be published at https://datatrak.app/privacy-policy/ with its effective date. Material changes will be communicated where appropriate.

15. Contact us

For privacy questions or requests, contact:

Nitor Plus Limited
C/O Andersons, White Gables Farm, Blunham Road, Bedford, Bedfordshire, MK44 3RA
Email: [email protected]
Website: https://datatrak.app