UK GDPR centre
Who is responsible for what.
Last reviewed
25 July 2026
Customer: controller
Decides why and how orders, drivers, GPS, recipients and proofs are used. Provides notices, chooses lawful bases and handles rights.
Trackely: processor
Runs the configured service on documented instructions, secures the platform, manages subprocessors and assists the customer.
Trackely: limited controller
Manages its own accounts, billing, support, security, enquiries and lawful business communications.
No certification claim
These documents and controls support compliance; they are not an ICO endorsement, ISO certificate or guarantee that every customer use is lawful.
The documents
- Privacy Notice — Trackely's transparent controller information and explanation of processor activity.
- Data Processing Addendum — binding Article 28 processor terms, automatically incorporated into the customer contract.
- Subprocessor Register — provider, purpose and service-change information.
- Cookie Policy — the actual browser storage in use and a preference control.
- Security Overview — current safeguards and their limits.
A customer's practical checklist
- Map what order, recipient, driver, location and proof information is put into Trackely.
- Choose and record a lawful basis for each purpose; do not assume employee consent is freely given.
- Give drivers, recipients and staff a clear controller privacy notice before collection.
- Use only the necessary fields, roles, tracking periods and retention settings.
- Complete a DPIA before high-risk monitoring, systematic GPS tracking or sensitive integrations.
- Set a process for access, correction, deletion, objection and complaint requests.
- Review the DPA, subprocessors, transfers, security posture and any sector-specific rules.
Driver stop guidance in privacy terms
Trackely can give a driver the next address, access notes, delivery instructions, contact options, required checks and what proof to collect. It can record arrival, completion, an unsuccessful outcome, notes, photos, signatures and location where enabled. This is intended to help complete the assigned job consistently—not to make hidden employment decisions. The employer or delivery organisation decides the rules and must explain monitoring, limit access and provide a route for drivers to challenge inaccurate records.
Rights and complaint handling
Customers normally receive requests about their operational data. Trackely provides available search, export, correction, deletion and audit support under the DPA. For data controlled by Trackely, email support@trackely.co.uk. We acknowledge data-protection complaints within 30 days and investigate without undue delay. Individuals may also contact the ICO.
UK and EU coverage
The contract addresses the UK GDPR, Data Protection Act 2018 and the UK changes made by the Data (Use and Access) Act 2025. Where the EU GDPR directly applies to a customer use, the same controller/processor structure and DPA safeguards apply, supplemented by any legally required transfer terms.