OAS Privacy Notice

1.1 This notice applies to OAS websites, accounts, support and the hosted platform. OAS is supplied to UK businesses and is not a consumer subscription. References to UK data-protection law include the UK GDPR, the Data Protection Act 2018 and amendments in force under the Data (Use and Access) Act 2025.

1.2 A customer generally acts as controller for the personal data it puts into a workspace. OAS generally acts as processor for that Customer Data under the Data Processing Agreement. The customer remains responsible for its own worker and driver notices, lawful bases, retention and decisions.

1.3 OAS acts as an independent controller for limited purposes such as account administration, security, service communications, legal records and support. The applicable role depends on the processing activity.

2.1 We may use business and account information such as names, work contact details, roles, workspace memberships, operator details, support correspondence and commercial records.

2.2 Customer Data may include driver and worker details, licence and qualification records, right-to-work and DVLA evidence, vehicle and trailer records, maintenance and inspection history, tachograph information, compliance findings, documents, signatures and audit history.

2.3 A customer may choose to record information that requires extra protection, including health-related details or information relating to endorsements and alleged offences. The customer must only collect what it needs and must establish the required UK GDPR and Data Protection Act conditions before doing so.

2.4 We also process technical, security and service information needed to operate accounts, protect the platform and maintain reliable records.

3.1 OAS uses controller data to provide and secure accounts, deliver support and service communications, administer the agreement, prevent misuse, maintain legal and audit records, and improve the reliability of the service. The lawful basis will normally be contract, legitimate interests, legal obligation or consent where the law requires it.

3.2 For Customer Data, the customer determines the purpose and lawful basis. A customer must give people clear information and must not treat acceptance of OAS Terms as blanket consent to workforce or driver processing.

3.3 OAS does not intend to make solely automated decisions with legal or similarly significant effects about drivers. Calculations, extraction, alerts and reports are aids that require appropriate human review.

4.1 We may use service providers needed to host, secure, support and communicate about OAS. The current public list is in the Subprocessor Register; the DPA contains the contractual controls.

4.2 At present, OAS does not disclose Customer Data to independent commercial partners for their own services. A customer may later direct an integration or sharing feature to send identifiable information to a named partner. The customer must have authority to do so and must provide any required notice, lawful basis and choice before new processing begins.

4.3 Properly anonymised and aggregated information may be used for statistics, benchmarking and service improvement. We do not sell or license identifiable driver data solely for advertising or data-broker activity.

5.1 Supplier locations and any restricted international transfers are assessed before production use. OAS will use an appropriate lawful transfer mechanism and supplementary safeguards where required. Customers can request current transfer information through the contact below.

5.2 We keep information only for as long as needed for the relevant purpose, the agreement, customer instructions, legal duties or legal claims. Information that has been irreversibly anonymised may be retained for ongoing statistics, benchmarking or service improvement; pseudonymised, hashed or vehicle-registration information remains personal data where people can still be identified. Customers remain responsible for exporting records they must retain.

5.3 OAS applies proportionate access, authentication, secure transport, logging and service-provider safeguards. Further contractual information is in the DPA; no security certification is claimed by this notice.

6.1 People may have rights to access, correct, delete, restrict, receive or object to the use of their information. Requests should normally be made to the organisation that decided why the information was used. OAS will assist a customer with a request where it acts as processor.

6.2 Contact [email protected] first so that we can route the request safely. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

7.1 Contact [email protected] about this notice, a data-protection request or a suspected incident. This notice applies from the effective date shown above.

7.2 We may publish a new version when our processing or the law changes. We will give advance notice of material changes where required. The version and effective date above identify the notice that applied at the relevant time.