Last updated: July 2026
RouteRelay is a UK vehicle logistics platform that connects motor trade dealers with approved drivers and transport companies. The platform is operated by RouteRelay Ltd, a company registered in England and Wales (Companies House number: pending — to be updated on confirmation).
RouteRelay Ltd is the data controller for personal data processed through the platform. References to "RouteRelay", "we", "us", or "our" in this policy refer to RouteRelay Ltd as the operator of routerelay.co.uk.
Data controller contact: support@routerelay.co.uk
RouteRelay is registered with the Information Commissioner's Office as a data controller. Our registration number is ZC185771.
Stored in a private, access-controlled storage bucket. Drivers can only access their own folder. Admins can access all folders for verification purposes.
Proof photos are stored in a private, access-controlled bucket. Only the assigned driver, the job's dealer, and RouteRelay admin can access photos for a given job.
When a driver records key job status events (such as on route to collection, arrived at collection, vehicle collected, in transit, arrived at delivery, and delivered), RouteRelay may capture a single location fix from the driver's browser at that moment. This is not continuous tracking — we do not record movement between events, build route replays, or track the driver outside of job actions.
What is captured: latitude and longitude, accuracy radius in metres, the time of the fix, and which job status it relates to.
Location permission is optional. If the driver declines or the fix is unavailable, the status update proceeds normally without GPS data.
Bank details are encrypted at rest and used solely to process driver payouts. Full sort code and account number are never returned to the driver's screen after entry. Access to unmasked bank details is restricted to authorised admin and finance users, and every access is audit-logged. Bank details are never accessible to dealers.
Under UK GDPR Article 6, we rely on the following lawful bases for processing your personal data:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Contract (Article 6(1)(b)) — necessary to provide the service |
| Matching and managing vehicle transport jobs | Contract (Article 6(1)(b)) |
| Verifying drivers hold valid licences and insurance | Legitimate interests (Article 6(1)(f)) — ensuring safety and regulatory compliance |
| Processing driver payouts after confirmed job completion | Contract (Article 6(1)(b)) |
| Maintaining a job status audit trail for dispute resolution | Legitimate interests (Article 6(1)(f)) — fraud prevention and dispute resolution |
| Location capture at status events (presence verification) | Legitimate interests (Article 6(1)(f)) — verifying presence at collection/delivery; fraud prevention |
| Detecting and acting on suspicious or fraudulent activity | Legitimate interests (Article 6(1)(f)) — protecting the platform and its participants |
| Signup fraud prevention and UK service-eligibility checks (IP, country, metadata) | Legitimate interests (Article 6(1)(f)) — preventing abuse and confirming eligibility (subject to legal review) |
| Complying with UK tax, VAT, and data protection law | Legal obligation (Article 6(1)(c)) |
| Improving the platform based on how participants use it | Legitimate interests (Article 6(1)(f)) — developing a better service |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. We do not sell your data or share it with third parties for marketing purposes.
Dealers can see their own company data, their own jobs, and the name and phone number of the driver assigned to their job (phone number visible after dealer account is verified). Dealers can see proof photos and the activity timeline for their own jobs. On the timeline, dealers may see a "Location captured" indicator for events where the driver shared their location — they do not see GPS coordinates.
Dealers never see: driver payout amounts, platform margin, driver bank details, GPS coordinates, or any other dealer's data.
Drivers can see their own profile, documents, and bank details (masked — no full sort code or account number is ever shown after entry). They can see jobs available to them and details of jobs they have accepted. They can upload documents and proof photos for their own jobs.
Drivers never see: other drivers' profiles or documents, dealer payout breakdowns, or any other driver's bank details.
Admin users have access to data required to manage the platform, verify users, and resolve disputes. Access to sensitive data (bank details, GPS coordinates) is restricted to authorised admin roles and is audit-logged to an immutable log.
We use the following third-party processors to operate the platform. Each is engaged under a Data Processing Agreement:
No personal data is shared with any party not listed above without explicit consent. We do not sell your data.
Supabase and Vercel operate infrastructure in the UK and EU. Where data is processed outside the UK or EEA, transfers are protected by the UK's International Data Transfer Agreement (IDTA) or equivalent adequacy decision.
| Data category | Retention period | Reason |
|---|---|---|
| Active accounts | Duration of active relationship | Operational necessity |
| Completed job records | 6 years from completion | UK tax and VAT obligations |
| Proof photos | 6 years from job completion | UK Limitation Act 1980 s.5 — 6-year limitation period for contract / property-damage claims; aligned with the job record so evidence is retained for the full claim window |
| Driver verification documents | 6 years from end of active driver status | Due diligence for insurance claims or legal action |
| Insurance documents | 6 years from policy expiry | Claims may be lodged after policy end date |
| Status history and audit log | 6 years | Dispute resolution and regulatory enquiries |
| Payment and payout records | 6 years | UK tax and VAT obligation |
| Driver bank account details | Active relationship + 6 years | Evidence of correct payment for accounting |
| Location captures | 6 years from job completion | Retained with job record — same schedule as status history |
| Rejected applications | 6 months from rejection | Handling disputes about rejection decisions |
Any data subject to an active dispute, insurance claim, legal proceedings, or fraud investigation is placed on hold and retained until the matter is formally closed, regardless of the standard schedule above.
Under UK GDPR you have the following rights in relation to your personal data:
To exercise any of these rights, email support@routerelay.co.uk with the subject line "Data subject request". We will respond within one calendar month of receiving your request.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would, however, appreciate the opportunity to address any concern before you contact the ICO.
We implement technical and organisational measures to protect your personal data, including:
To report a security vulnerability, email security@routerelay.co.uk or see our security disclosure policy at /.well-known/security.txt.
We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we will notify active users by email.
Continued use of the RouteRelay platform after a policy update constitutes acceptance of the revised policy.
For any privacy or data protection question, or to exercise your rights, contact us at: support@routerelay.co.uk
RouteRelay Ltd, England and Wales.
This policy has not yet been reviewed by a qualified data protection solicitor. A formal review is recommended before any wider public or commercial launch.