Privacy notice
Last updated 15 June 2026
Who we are
CleaningTrackeris a business-to-business dispatch and fleet platform for ready-mix concrete delivery. The platform is multi-tenant: each customer organisation (“tenant”) controls the delivery, customer and operational data it enters, and CleaningTracker acts as a data processor for that data. For the staff accounts used to sign in to the platform, CleaningTracker acts as a data controller. Questions about this notice can be sent to chris@cleaningtracker.co.uk.
What personal data we process
- Account & staff data: name, email, phone, password (stored only as a salted Argon2id hash), role and permissions, and sign-in / lockout activity.
- Customer & site contacts: names, emails, phone numbers and addresses entered to manage deliveries.
- Operational data: jobs, deliveries, schedules, invoices, costings and related notes.
- Location data: site and plant coordinates, and — where the fleet/GPS features are enabled — vehicle position while a delivery is active.
- Usage & audit logs: a record of significant actions (with personal identifiers minimised) for security and accountability.
- Cookies: strictly-necessary only — see our cookie notice.
Why we process it & our legal bases
- To provide the service (manage deliveries, accounts, invoicing) — performance of a contract.
- To secure the service (authentication, rate-limiting, audit logging, abuse prevention) — legitimate interests.
- To meet legal obligations (e.g. retaining financial records) — legal obligation.
Who we share it with (sub-processors)
We use a small number of vetted sub-processors to run the service — hosting and database, transactional email, SMS, mapping, and error monitoring. Our policy is to keep personal data in the UK / European Economic Area; compute and the primary database are hosted in the UK/EU. We maintain an internal register of each sub-processor, the data shared, its location and the transfer safeguards. We do not sell personal data or use it for advertising.
International transfers
Personal data is hosted in the UK/EEA. Where a sub-processor is outside the UK/EEA, we rely on an adequacy decision or appropriate safeguards (e.g. Standard Contractual Clauses) and minimise what is shared.
How long we keep it
Operational and personal data is retained while your account is active. Deleted records are held in a recycle bin for a configurable retention period (90 days by default) and then permanently purged. Financial records (e.g. invoices) are retained for the period required by law. Audit logs are retained on a fixed schedule and are tamper-evident.
Your rights
Subject to the controller/processor split above, you may have the right to access your data, correct it, have it erased, restrict or object to processing, and to data portability. We support right-to-erasure: a tenant administrator can erase a customer's or user's personal data, anonymising it while retaining records we are legally required to keep. To exercise a right, contact your tenant administrator or chris@cleaningtracker.co.uk. You can also complain to the UK Information Commissioner's Office (ICO).
How we protect it
Strict tenant isolation, role-based access control, encrypted connections, hashed passwords, login rate-limiting and account lockout, security response headers, and an append-only audit log. Access is limited to what each role needs.
Contact
Email chris@cleaningtracker.co.uk with any privacy question or request.