How GoAndTrack handles personal data
| Organisation | GoAndTrack Ltd, company number 17434007 |
|---|---|
| Registered office | 71-75 Shelton Street, Covent Garden, London, United Kingdom |
| Version | 1.0 |
| Effective date | 12 October 2026 |
In summary. GoAndTrack provides business customers with an online platform for tracking assets and shipments across connected devices and provider integrations. We use personal data to provide accounts, administer customer relationships, secure and support the platform, process orders and communicate about our services. For most tracking and shipment data, the business customer decides why and how the data is used and GoAndTrack acts as its processor.
If a GoAndTrack customer is tracking you, your vehicle or an asset associated with you, contact that customer first. The customer is normally the controller of that tracking data and is responsible for explaining the monitoring, establishing a lawful basis and responding to your rights request. We will assist the customer as required by data protection law and our Data Processing Agreement.
1 Who we are and when this policy applies
1.1 GoAndTrack Ltd is a company registered in England and Wales under company number 17434007. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom. You can contact us about privacy at privacy@goandtrack.com.
1.2 This policy applies to the GoAndTrack online application at app.goandtrack.com, related applications and APIs, customer and trial accounts, support, sales, billing and other business communications. It explains our processing under the UK General Data Protection Regulation, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.
1.3 This policy does not replace a customer organisation’s own employee, driver, recipient, visitor or shipment-tracking privacy information. Third-party websites, tracking providers, mobile networks, mapping services and integrations have their own privacy practices.
2 Our role as controller or processor
2.1 GoAndTrack is a controller when it decides why and how to process personal data for account administration, contracting, billing, security, support, service communications, sales and marketing, legal compliance and management of its business.
2.2 GoAndTrack is normally a processor when it processes tracking, shipment, alert, geofence, sensor, recipient or other Customer Data on a customer’s documented instructions. The customer is normally the controller. This processing is governed by the customer agreement and GoAndTrack Data Processing Agreement.
2.3 A customer must have authority and a lawful basis for the personal data it places in the platform, provide required privacy information, configure access appropriately and avoid covert or unlawful monitoring. Customers must not submit health data, biometric data, government identifiers or other special-category or highly sensitive personal data unless GoAndTrack has expressly agreed to that processing in writing.
2.4 We may use data that has been aggregated and irreversibly anonymised so that it no longer identifies a person, customer or individual shipment. Data that is genuinely anonymous is not personal data.
3 Personal data we collect
| Category | Examples |
|---|---|
| Account and identity data | Name, business email address, telephone number, employer, job title, workspace, user role, permissions and account status. |
| Authentication and security data | Password hash, sign-in events, IP address, browser and device information, user agent, security events, audit records and session information. |
| Customer and commercial data | Organisation details, contacts, orders, plan, device allocation, contract, pilot, billing address, invoices, payment status and correspondence. |
| Platform and tracking data | Device identifiers, provider identifiers, timestamps, approximate or precise location, route, geofence events, temperature, humidity, shock, light, motion, battery, connectivity, alerts and shipment details. |
| Recipient and operational data | Recipient or consignee name and contact details, delivery location, reference numbers, notes, alert recipients and operational instructions entered by a customer. |
| Support and communications data | Support requests, emails, meeting notes, call details, feedback, diagnostic information and records of how an issue was handled. |
| Usage and technical data | Features used, configuration changes, API activity, error logs, performance data and interaction with service messages. |
| Marketing data | Business contact details, professional interests, source, campaign engagement, communication preferences and opt-out records. |
| AI feature data | Prompts, selected platform context, instructions and generated outputs when a customer enables or uses an AI-assisted function. |
3.1 The platform is designed for business use. Tracking and sensor data may become personal data when it can be linked to a driver, employee, recipient, vehicle user or another identifiable person, even if the device primarily tracks an asset or shipment.
3.2 We do not intentionally collect payment card details into GoAndTrack systems when a specialist payment provider collects them directly. We receive transaction identifiers, payment status and limited billing information needed to administer the purchase.
4 Where personal data comes from
-
you, when you create an account, contact us, request a demonstration, buy a product, use the platform or exercise a right;
-
your employer, customer organisation, partner or workspace administrator;
-
tracking devices, gateways, mobile or satellite networks, provider platforms, webhooks, APIs and customer integrations;
-
payment, identity, security, support, email and other service providers;
-
public business sources, professional networks, events, directories and referrals, where permitted by law; and
-
your browser or device through logs, cookies and similar storage or access technologies.
5 How and why we use controller data
| Purpose | Data normally used | Lawful basis |
|---|---|---|
| Create and administer accounts and workspaces | Account, identity, authentication, usage and customer data | Contract where the individual is the customer; otherwise legitimate interests in delivering a business service. |
| Provide subscriptions, pilots, devices, billing and service communications | Customer, commercial, account and communications data | Contract; legitimate interests in administering customer relationships; legal obligation for required records. |
| Secure, monitor and improve the platform | Authentication, security, usage, technical and support data | Legitimate interests in protecting users, systems and services; legal obligation where applicable. |
| Provide support and investigate faults | Account, communications, technical and relevant platform data | Contract and legitimate interests in providing reliable support and resolving issues. |
| Prevent misuse and enforce agreements | Account, security, usage, audit and communications data | Legitimate interests in preventing fraud, abuse, unlawful tracking and contractual breaches; legal claims. |
| Send relevant business marketing | Business contact, marketing and engagement data | Legitimate interests for proportionate business-to-business marketing; consent where PECR or other law requires it. |
| Comply with law and protect rights | Relevant account, customer, transaction, security and communications data | Legal obligation, public task where applicable, and legitimate interests in establishing or defending legal claims. |
| Manage a corporate transaction | Relevant customer, contract, finance and due-diligence data | Legitimate interests in financing, restructuring or selling all or part of the business, subject to confidentiality safeguards. |
5.1 Where we rely on legitimate interests, we consider the purpose, necessity and effect on the individual. You may ask for information about that assessment or object to processing as described in section 12.
5.2 Where we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal. We do not make access to the core service conditional on consent to unrelated marketing or non-essential technologies.
6 Processing on a customer’s instructions
6.1 We process Customer Data to ingest, normalise, store and display device data; reconstruct routes; evaluate thresholds and geofences; create alerts; support shipments and workflows; enable integrations and APIs; generate reports and AI-assisted outputs; provide technical support; and perform the other documented functions selected by the customer.
6.2 The customer determines which devices, assets, vehicles, shipments and people are associated with its workspace, who receives alerts, which retention and configuration options apply and who may access the data. GoAndTrack acts only on documented instructions unless law requires otherwise.
6.3 If you make a request to us about Customer Data, we may need to identify the relevant customer and refer the request to it. We will not disclose Customer Data to a requester unless authorised by the customer or required by law.
7 AI-assisted features and automated decisions
7.1 Where a customer enables an AI-assisted function, the platform may process the customer’s prompt, selected device or shipment context and generated output to provide that function. Customers must review outputs before using them for operational, safety, employment, regulatory or commercial decisions.
7.2 GoAndTrack does not use its controller processing to make a decision about an individual that is based solely on automated processing and produces legal or similarly significant effects. A customer may configure workflows or use outputs for its own purposes and is responsible for any automated decision-making it carries out.
8 Cookies and similar technologies
8.1 The application may use cookies, local storage and similar technologies that are strictly necessary to authenticate users, maintain sessions, prevent fraud, balance traffic, remember security or interface settings and provide requested functions. These technologies do not require consent where the applicable legal exception applies, but we still provide clear information about them.
8.2 If we use analytics, marketing or other non-essential storage or access technologies, we will identify them and their providers, explain their purpose and duration, and request consent where required before activating them. Users must be able to reject or withdraw consent as easily as they give it.
8.3 The current cookie preference interface or Cookie Notice, where displayed, forms part of this policy and contains the most current technology-specific details. Browser settings may also block or delete technologies, although blocking essential technologies may prevent sign-in or other requested functions.
9 When we share personal data
9.1 We may share personal data with the following recipients where necessary and proportionate:
-
the relevant customer, its workspace administrators, authorised users, partners and configured alert recipients;
-
tracking-device and connectivity providers, mapping services, integration endpoints and other services selected or authorised by the customer;
-
cloud hosting, database, authentication, security, monitoring, support, communications, payment and professional-service providers acting under appropriate terms;
-
professional advisers, insurers, auditors, lenders, investors and prospective purchasers under confidentiality protections;
-
courts, regulators, law-enforcement bodies and other authorities where disclosure is required or legally justified; and
-
another organisation involved in a merger, financing, reorganisation or sale of all or part of our business, subject to appropriate safeguards.
9.2 We do not sell personal data. We do not permit a service provider to use Customer Data for its own unrelated marketing. A current list of material subprocessors used for Customer Data is available through the application Legal area or from privacy@goandtrack.com.
10 International transfers
10.1 GoAndTrack is based in the United Kingdom and may use providers or integrations that process personal data in the United Kingdom, European Economic Area and other countries. A customer may also configure a provider, recipient or integration in another country.
10.2 Where data protection law restricts an international transfer, we use an available lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission standard contractual clauses or another approved safeguard. We may also apply supplementary contractual, organisational and technical measures where appropriate.
10.3 You may contact privacy@goandtrack.com for information about the safeguard relevant to a particular transfer. We may redact confidential or security-sensitive material from any copy we provide.
11 How long we keep personal data
| Data | Typical retention approach |
|---|---|
| Customer tracking and platform data | During the active service, for the period configured or agreed with the customer and, where no shorter setting applies, for up to seven years. After termination, data may be retained for up to 90 days before deletion, subject to the Data Processing Agreement, legal duties and backup cycles. |
| Account and workspace data | For the account relationship and as needed to administer closure, security, disputes and legal obligations. |
| Contracts, orders, invoices and core business records | Normally for six years after the relevant transaction or end of the relationship, and longer where law or a live claim requires it. |
| Support, audit and security records | For as long as reasonably necessary to resolve issues, protect the service, demonstrate authorised activity and investigate incidents, taking account of risk and applicable limitation periods. |
| Sales and marketing records | Until an opt-out, or until the information is no longer accurate or relevant. We periodically review inactive business contacts and retain a minimal suppression record after an opt-out. |
| Cookies and similar technologies | For the session or duration stated in the current Cookie Notice or preference interface. Consent records may be kept as evidence of the choice. |
11.1 Retention may be extended where necessary to comply with law, preserve evidence, investigate security or fraud, establish or defend legal claims, or follow a customer’s lawful documented instruction. Backups are protected and deleted or overwritten according to the applicable backup cycle.
12 Your data protection rights
12.1 Depending on the circumstances and applicable law, you may have the right to:
-
ask for access to your personal data and information about its processing;
-
ask us to correct inaccurate or incomplete personal data;
-
ask for deletion or restriction of processing;
-
object to processing based on legitimate interests and object at any time to direct marketing;
-
receive personal data you provided in a structured, commonly used and machine-readable format where data portability applies;
-
withdraw consent at any time where processing relies on consent; and
-
ask for human intervention and challenge a qualifying solely automated decision.
12.2 Rights are not absolute. We may need to verify your identity, clarify the request, protect another person’s rights or retain information where law permits or requires it. We normally respond within one month, although the law permits an extension for a complex request or multiple requests.
12.3 Send requests to privacy@goandtrack.com. If the request concerns tracking or Customer Data controlled by a GoAndTrack customer, identify that organisation and contact it directly where possible. We will assist the controller where required.
12.4 You may complain to the UK Information Commissioner’s Office at ico.org.uk. If you are outside the United Kingdom, you may also have the right to complain to your local data protection authority. We would appreciate the opportunity to address the issue first.
13 Direct marketing
13.1 We may send relevant business-to-business communications about GoAndTrack products, services, events and updates where permitted by law. We use consent where required and otherwise may rely on legitimate interests for proportionate communications to corporate contacts.
13.2 Every electronic marketing message will identify the sender and provide a valid way to opt out. You can also opt out at any time by contacting privacy@goandtrack.com. We may retain a minimal suppression record so that we honour the opt-out.
13.3 Operational, security, billing, legal and service messages are not marketing. Users may continue to receive those messages while they have an account or where they are otherwise required.
14 Security
14.1 We use technical and organisational measures appropriate to the nature and risk of the processing. These may include access controls, role-based permissions, authentication controls, encryption in transit, protected cloud infrastructure, logging, monitoring, backups, incident procedures, supplier controls and staff confidentiality obligations.
14.2 No online system is completely secure. Customers and users must protect credentials, devices, API keys and integrations; use appropriate permissions; remove access that is no longer needed; and report suspected unauthorised access promptly.
14.3 Where GoAndTrack acts as processor, personal-data breach notification and cooperation are governed by the Data Processing Agreement. Where we act as controller, we will notify affected individuals and regulators when required by law.
15 Business service and children
15.1 GoAndTrack is a business service and is not directed to children. An account user must be at least 18 years old. Customers must not use the service to track children unless that use is lawful, transparent, necessary and covered by appropriate safeguards and privacy information.
16 Changes to this policy
16.1 We may update this policy to reflect changes in law, the service, our providers or our processing. The current version and effective date will be available through the application Legal area. We will provide additional notice of a material change where appropriate and obtain consent if a new use requires it.
17 Contact us
17.1 Privacy questions and rights requests: privacy@goandtrack.com
17.2 GoAndTrack Ltd, company number 17434007, 71-75 Shelton Street, Covent Garden, London, United Kingdom.