Privacy Notice
Last updated: 11 October 2026
1. Who we are; distinct privacy roles
ELVA LTD, trading as Flotaryx, 23–27 King Street, Luton, Bedfordshire LU1 2DW, England, company 10715768, is a controller for business account, support, website and billing administration data. When a customer company uploads fleet, driver, employee or vehicle-associated personal data into its workspace, that company normally decides the purposes and acts as controller; ELVA LTD acts as processor under the DPA. Contact: support@flotaryx.com.
2. Data categories
Account information may include names, business email addresses, workspace memberships, roles, login identifiers and contact details. Customer workspaces may contain driver names, phone numbers, vehicle assignments, registration and VIN details, inspection and repair notes, costs, documents, issue reports and activity records. Billing services handle subscription IDs, invoice references, plan and payment status; Stripe handles payment card data. Security records may include timestamps, device/network data and logs.
3. Why we use information
We use relevant data to provide user authentication and company access; operate fleet-management functions and reminders; answer support questions; provide subscriptions and invoices; prevent abuse and secure accounts; comply with legal obligations; and improve reliability. Marketing messages are sent only where permitted by applicable law, with an unsubscribe option where required. We do not sell customer fleet or driver data or use it for advertising profiling.
4. Legal grounds for our controller activities
For account and billing administration, we rely as relevant on performing a contract, legitimate interests in securing and maintaining a business service, complying with tax/accounting and other legal duties, and consent where it is legally required (for example for optional marketing technologies). For customer-controlled fleet data, the Customer determines and documents its own lawful grounds; we process it on documented instructions.
5. Service providers and disclosures
Our service providers can include Supabase (application database and authentication, project hosted in an EU region), Stripe (subscriptions and payment processing), Resend and Namecheap Private Email (service and support communications), and GitHub Pages (public website hosting). They receive data only to the extent relevant to their services. We may also disclose information where law requires it, to professional advisers bound by confidentiality, or in a properly safeguarded business reorganization.
6. International processing
Service providers and support operations may process data outside the UK or European Economic Area. Where restricted international transfers occur, we assess the applicable legal transfer mechanism, such as adequacy regulations/decisions or approved contractual safeguards, as appropriate. Contact us for the relevant current arrangements. We do not represent that all data always remains inside one country.
7. How long we keep data
Account and workspace information is ordinarily retained while the business account is active. After closure, we delete or return customer workspace personal data in line with the DPA and applicable legal requirements, allowing for routine secure backup expiration. Invoice and transaction records are retained for required accounting/tax periods; support and security records are retained only while needed for their purposes or legal claims. A specific deletion request can be sent to support@flotaryx.com.
8. Security
We use organizational and technical measures appropriate to the risks, including role-based workspace access, authentication controls, service-provider protections and reasonable incident response. No internet service can guarantee absolute security. The Customer should enforce strong credentials, grant minimum necessary permissions and avoid storing unnecessary sensitive data.
9. Your rights and choices
Depending on your location and applicable law, you may request access, correction, deletion, restriction, portability, objection or withdrawal of consent, and you may challenge certain automated decisions where applicable. Requests about data in an employer or customer workspace should first go to that company as controller; we help it respond. Send other requests to support@flotaryx.com. We may verify identity before processing a request.
10. Complaints, updates and contact
You may complain to the UK Information Commissioner’s Office (ico.org.uk), or to a relevant EU/EEA supervisory authority where applicable. We may revise this notice when practices change and will provide appropriate notice of material changes. Effective date: 11 October 2026. Privacy contact: support@flotaryx.com.