Privacy Policy

Privacy Policy

Last updated: 1 January 2025

Marketing IN respects your privacy and is committed to protecting your personal data. This privacy policy describes how we collect, use and store your information when you use our website marketingin.co.uk.

What data do we collect?

• Contact information – name, email address, phone number.
• Usage data – information about how you use our website, including IP address, browser type, pages visited and visit time.
• Correspondence data – information you provide when contacting us via the contact form or email.

How do we use your data?

• To provide and improve our services.
• To respond to your enquiries and communicate with you.
• To analyse website usage and optimise performance.
• To fulfil legal obligations.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict processing of, and object to the processing of your personal data. To exercise your rights, please contact us at the email below.

Third-party services

Our website may use third-party services such as Google Analytics and Google Ads which collect data about your visits. These services have their own privacy policies.

Contact

Coserva LTD
Email: [email protected]

Driver location and trip data — app “Coservices Driver Tracking” (Android package ee.coservices.drivertracking, Navigation Connect)

Version 1.0 — 12 August 2026. This section applies from the date of publication. A changelog is at the end.

1. Who is responsible for what

Responsibility depends on the purpose. The following table is authoritative; a single global statement would be inaccurate.

We do not use a customer’s driver or trip data for our own product development, model training, benchmarking or route datasets. If that ever changes, it will be a separate processing operation for which we would be the controller, it will require its own legal basis and its own advance notice, and it will not be applied to data already collected.

2. What data we receive

When a driver starts a navigation trip that is linked to our service, Google Maps or Waze transmits trip data to us through Google’s Navigation Connect API. The field set is defined by Google, not by us. It currently comprises:

• road-snapped vehicle position (latitude and longitude) with a timestamp for each update;
• trip origin and destination;
• distance travelled and distance remaining;
• duration travelled and duration remaining, and the resulting estimated time of arrival;
• for Waze, the remaining route polyline;
• traffic speed categories (for example normal, slow, traffic jam) mapped to route segments;
• trip state (for example NEW, ENROUTE, ARRIVED, SUSPENDED, FAILED, CLIENT_ERROR);
• an indication relating to stops added during navigation (whether stops were or may be added).

We do not receive the driver’s name, telephone number, contacts, message content, microphone or camera data, or any location data from outside an active trip.

The Navigation Connect API is pre-general-availability and Google may change the field set. We review and update this list when it changes, and we publish the change under §11.

3. The consent prompt in Google Maps or Waze — what it is, and what it is not

Before trip data sharing begins, Google Maps or Waze shows the driver a trip data sharing consent prompt. Per Google’s documentation this prompt is required at least every 12 months, and the driver can stop sharing at any time, in which case data sharing for that trip stops and no further data reaches us.

This prompt is a platform permission required by Google. It is not, by itself, the lawful basis under Article 6 GDPR for an employer’s processing of an employed driver’s location data. Consent given inside an employment relationship will usually not be “freely given” (Art. 4(11), Art. 7(4) and Recital 43 GDPR; § 26(2) BDSG), so neither we nor the operators we work with rely on it as the legal basis. The technical prompt and the legal basis are two separate things and both must be in place.

4. Lawful basis

Our own testing and demonstration trips (row 1 of the table in §1). We rely on Article 6(1)(f) GDPR — our legitimate interest in developing, testing and demonstrating our own service, using our own or test devices, with a documented balancing assessment on file.

Customer deployments. The transport operator is the controller and states its own legal basis in the notice it gives its drivers. We do not assert a legal basis of our own for that data: we process it only on the operator’s documented instructions under Article 28(3)(a) GDPR. In Germany this will typically rest on Article 6(1)(b) and/or 6(1)(f) GDPR together with § 26 BDSG and, where a works council exists, on a works agreement under § 87(1) no. 6 BetrVG which also defines the limits of the processing (Art. 88 GDPR, § 26(4) BDSG).

We do not enable driver tracking for a customer until (a) a written data processing agreement under Article 28(3) GDPR is signed, and (b) the customer has confirmed in writing that any works-council agreement required under § 87(1) no. 6 BetrVG and any data protection impact assessment required under Article 35 GDPR are in place. Until both are done, no driver is tracked.

5. What the service does today

For an active delivery trip, the service:

• shows the dispatcher the vehicle’s current position and trip state;
• calculates remaining distance, remaining duration and a traffic-aware estimated time of arrival;
• issues a temporary tracking link so the consignee can see where their shipment is and when it is expected.

Today the service does not perform, and is not configured to perform: driver performance scoring or ranking; the production of disciplinary evidence; fuel-use or fuel-abuse analysis; recording of driving and rest times; geofence or speeding alerts; advertising; profiling; or automated decision-making producing legal effects or similarly significant effects on the driver within the meaning of Article 22 GDPR.

6. This is not a tachograph

This service does not record driving and rest times and is not a substitute for the tachograph. Statutory recording of driving times, breaks and rest periods remains the operator’s obligation under Regulation (EU) No 165/2014 and Regulation (EC) No 561/2006, performed by the tachograph fitted in the vehicle. We never source data from tachograph records.

7. Retention

• Trip record and tracking link: kept for the duration of the trip and for a maximum of 24 hours afterwards, so the consignee’s link stays usable. The tracking link expires after 24 hours. The trip record is then deleted; we keep no archive and no backup copy of it.
• Message queue: position updates are held in a Google Cloud Pub/Sub message queue for a maximum of 24 hours, after which they expire automatically.
• Technical and security logs that may contain a trip identifier or coordinates: kept for a maximum of 7 days, then deleted.
• Statutory driving-time records: not held by us at all (see §6).
• We do not describe route data as anonymous. A single-vehicle trace can often be re-identified, so we treat it as personal data for as long as we hold it.

8. Recipients, sub-processors and international transfers

Trip data reaches us through Google (Google Maps Platform, including the Navigation Connect API, and Google Cloud infrastructure). The consignee receives only the limited view described in §9. A current list of sub-processors is available on request and is annexed to our data processing agreement.

We do not sell trip data and do not share it with advertising networks.

Coserva LTD is established in the United Kingdom. Where the controller is established in the EEA, the transfer of personal data to us relies on the European Commission’s adequacy decisions for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031 (Art. 45 GDPR). If those decisions lapse or are withdrawn, we will put Article 46 GDPR transfer safeguards in place before continuing. Any sub-processor outside the EEA or the UK is covered by Chapter V GDPR safeguards, identified in the data processing agreement.

9. The consignee tracking page

The tracking page shows trip state, current vehicle position, remaining distance and estimated arrival time. It does not name or otherwise identify the driver. The link uses a long random token that cannot feasibly be guessed, expires after 24 hours, is excluded from search engine indexing, and sets no analytics, advertising or other non-essential cookies or local storage on the recipient’s device (§ 25 TDDDG).

10. Rights

For our own testing and demonstration trips, and for account, billing and security data where we are the controller, you may exercise your rights under Articles 15 to 22 GDPR by contacting us at the address in §12.

In a customer deployment, the transport operator is the controller for the driver’s trip data. Requests should be addressed to the operator, which identifies itself in the notice it gives its drivers. If a request reaches us, we forward it to the operator without delay and assist the operator under Article 28(3)(e) and (f) GDPR. Because of the 24-hour retention period in §7, trip data will usually already have been deleted by the time a request is handled — the right to erasure will therefore often already be satisfied in fact.

You may also complain to a supervisory authority: for processing where we are the controller, the UK Information Commissioner’s Office; for a customer deployment, the supervisory authority competent for the operator.

11. Changes to this section

We describe what the service does today. If we add a new purpose — for example any form of driver evaluation, fuel analysis or working-time analysis — we will, before the feature is switched on: publish an updated version of this section with advance notice; name the legal basis for the new purpose; and, in Germany, complete the works council procedure under § 87(1) no. 6 BetrVG where a works council exists. A new purpose will never be applied retroactively to data collected under an earlier version.

We make no reservation of unspecified future uses.

12. Contact

Coserva LTD (trading as “Coservices”), company number 15613879, 20 Wenlock Road, London N1 7GU, United Kingdom. Email: [email protected]

Changelog – v1.0 — 12 August 2026 — first publication of this section (Navigation Connect pilot: live position, traffic-aware ETA, temporary consignee tracking link, 24-hour retention).