Fleetpin Limited provides vehicle fleet tracking. We supply a GPS device that is installed in your vehicle or asset, and a cloud-based user interface and apps that show you the information the device collects.
To do that, we collect and hold personal information. This notice explains what we collect, why, where we keep it, how long we keep it, and what rights you have.
We take your privacy seriously and we are committed to protecting your personal information.
This notice is written to meet our obligations under the New Zealand Privacy Act 2020, and in particular information privacy principle 3, which requires us to tell you what we are collecting and why. Our Privacy Officer can explain on request how we meet each of the thirteen information privacy principles.
“Personal information” means information about an identifiable person. That is the definition used in the Privacy Act 2020.
There are several sources and types of information that we collect;
Location and time data from the GPS device fitted to your vehicle or asset. We convert it into other information for you, such as speed, idling, engine time, and time in or out of a location. We collect this to provide the tracking service you have asked for.
If you are a driver rather than the customer: the vehicle you drive may carry a Fleetpin device, and while that device is powered it records where the vehicle is. Your employer, not Fleetpin, decides to fit the device and decides what the data is used for. Your employer is responsible for telling you that the vehicle is monitored and what the data will be used for. Fleetpin only uses this information to run and support the service, to bill for it, or where the law requires us to. If you have questions about why your vehicle is monitored, ask your employer first. If you want to know what Fleetpin holds about you, you can still contact our Privacy Officer.
Information that you, or we at your request, enter into your Fleetpin user interface or apps. This can include names of drivers, employees and users, geofence location labels, vehicle registration numbers and fleet IDs, driver licence numbers, phone numbers, email addresses, postal and physical addresses, and other personal details. We collect this so the system can identify your vehicles, drivers and users, and so it works the way you have set it up.
We do not store your password. Sign-in is handled by AWS Cognito, which stores only a secure signature of your password.
Driver licence numbers and vehicle registrations. The driver licence field is optional and it is your choice whether to fill it in. We do not use a driver licence number to identify your Fleetpin account or login, we do not check it against any outside database, and we do not use it to link records between different customers. We treat vehicle registration numbers the same way.
Your name, contact details, and billing or purchasing information. Our accounts, support and sales teams use this to deal with you and to provide and invoice the service.
We may keep records of chats, emails, phone calls and conversations, so that our sales, support and accounts teams can help you properly. Business interaction information and interaction records are mostly held in our CRM system, HubSpot.
We may use your contact details to send you marketing material, newsletters and product updates by email. Every marketing email has an unsubscribe link. If you unsubscribe, we will stop, and we will keep only the minimum record needed to make sure we do not email you again.
Every Fleetpin device contains a SIM card so it can send and receive data over a mobile network. Because of that, the mobile network operator that owns the SIM may also hold location data for it, generated as the SIM connects to cell towers. That data is created by the network operator as part of the service they provide to us and to you. We do not control it. Those operators have their own privacy policies. If you want a copy of the privacy statement of the telcos we use, ask us.
When you use our website we may collect your IP address, your browsing history on the site, and anything you enter into the site, which may include your name, email address, location and phone number. We may use your browsing history for web analytics to help us market our products and services.
Our website uses cookies. You can turn them off in your browser settings. Instructions are available from:
Read more about how to turn advertising identifiers off on:
Fleetpin staff can access your user interface, software and apps using our super-user access. We use it for three things only:
We do not use it for anything else. Every Fleetpin employee and contractor signs a confidentiality agreement. Access is granted on a need-to-know basis and logins and significant actions are recorded.
Your data in the Fleetpin user interface is accessed by users with passwords, issued by whoever you have given administrative rights to. You can see the list of users, their permissions and their login information in the Administration Suite, under Users and Drivers. You can add and remove users yourself on most of our applications. If you cannot, contact us.
We recommend you use strong, unique passwords and turn on two-factor authentication, which is available in the platform.
We do not share your information with any third party without your written consent, or unless we are legally obliged to. A legal obligation means something like a Police search warrant, a court order or a statutory notice. Where we are compelled to release information, we will tell you unless the law prevents us from doing so.
The exceptions are the service providers we use to run the service, who are bound by contract to protect your information and to use it only for the purpose we have given it to them for. These are:
Your data is stored outside New Zealand.
All data on the Fleetpin user interface, software and apps is stored and processed on Amazon Web Services in the ap-southeast-2 region, which is in Sydney, Australia. It is held across several data centres in that region. Our backups and archived data are held in the same region.
Information privacy principle 12 of the Privacy Act 2020 covers sending personal information overseas. We consider that this arrangement provides comparable safeguards to New Zealand law, because:
Our CRM, HubSpot, also processes business contact data outside New Zealand, in HubSpot’s Asia-Pacific (AP1) data centre.
Your data is encrypted while it is stored (AES-256) and while it travels between your browser or the mobile app and our platform (TLS 1.2 or higher). It sits inside a private network that is not reachable from the public internet except through the parts of the service that have to be.
There is one exception we want to be clear about. The transmissions from our telematics devices in your vehicles to our platform are not currently encrypted. Those transmissions carry location data only, with no name, account or login details attached, and everything is encrypted as soon as it reaches our AWS environment. We are working to enable encryption on devices where the hardware supports it.
AWS publishes information about its security and compliance at aws.amazon.com/compliance, including its New Zealand and Australian data privacy pages.
We take every reasonable step to protect your data. No system connected to a global network can be guaranteed completely secure, and we will not claim otherwise.
We do not keep personal information for longer than we need it. These periods match our internal Data Protection & Handling Policy and Staff Handbook.
You can ask us at any time to delete your historic fleet tracking data. The request must be in writing and signed by you as the authorised account owner. We will complete the deletion within 30 days. We keep the written authority as a business record for 7 years.
When our business relationship ends, we will offer you a copy of your data. You have 14 days to accept or decline in writing. If we do not hear from you within 14 days, we will delete all of your data from our servers. An administration fee may apply to preparing and providing the copy, and we will tell you the amount before we do the work.
When we delete data, we delete it permanently, including from our backups as they cycle through.
You can ask us whether we hold personal information about you, and ask for a copy of it. Contact our Privacy Officer.
We will respond as soon as we can, and no later than 20 working days after we receive your request. If we need longer, we will tell you within those 20 working days, explain why, and tell you that you can complain to the Office of the Privacy Commissioner about the delay.
We will check who you are before we release anything. Sometimes we cannot give you access, for example where doing so would release someone else’s personal information. If that happens we will tell you in writing why, and tell you that you can complain to the Office of the Privacy Commissioner.
If the information you are asking about was entered into a customer’s Fleetpin account by that customer, for example your employer, then that customer controls it. We will tell you that, pass your request to them, and let you know we have done so.
We do not charge you for access to your own personal information, except where the Privacy Act allows a charge. If a charge applies we will tell you before we do the work.
If you think information we hold about you is wrong, you can ask us to correct it.
How to ask. Email our Privacy Officer, write to us, or ask through any Fleetpin support channel. Tell us what information you think is wrong, what it should say, and send us anything you want us to look at. There is no form to fill in.
How long we take. We will acknowledge your request within 5 working days and decide it as soon as we can, and no later than 20 working days after we receive it. If we need longer we will tell you within those 20 working days and give you a date.
If we correct it. We will make the change, tell you, and if we have given the incorrect information to anyone else in the last 12 months we will take reasonable steps to tell them about the correction too.
If we decline. Sometimes we will not agree that information is wrong, or the information is a record of something that happened, such as a GPS position that was recorded at the time or a note of a support call. If we decline to change it, we will:
If the information was entered by a customer into their own account, we will pass your correction request to them and tell you we have done so.
You can decline to give us some information. In some cases that will mean we can provide only a reduced service, and in some cases we will not be able to provide the service at all.
A privacy breach is unauthorised access to, or disclosure, alteration, loss or destruction of, personal information we hold.
If we have a privacy breach that has caused, or is likely to cause, serious harm to anyone affected, then under Part 6 of the Privacy Act 2020 it is a notifiable privacy breach. In that case we will:
Our internal standard is to complete our assessment and any required notification within 72 hours of becoming aware of a breach. If we can tell you sooner, we will.
If the people affected are your drivers or your users, we will tell you as the customer and agree with you who tells them. That will not delay the notification.
If you are unhappy with how we have handled your personal information, tell us.
Step 1: Tell us. Contact our Privacy Officer. We will acknowledge your complaint within 5 working days, look into it, and respond in writing as soon as we can and no later than 20 working days after we receive it. We will tell you what we found, why, and what we are doing about it. If we need longer we will tell you within those 20 working days and give you a date.
Step 2: Go to the Office of the Privacy Commissioner. If you are not happy with our response, or we do not respond, you can complain to the Office of the Privacy Commissioner. You can also go to them directly at any time. You do not have to come to us first.
We will cooperate fully with any inquiry from the Office of the Privacy Commissioner, and we will never treat you differently because you have made a complaint.
If you are a Fleetpin customer, you are responsible for giving proper privacy notices to your own end users, which means anyone who uses our services, software or apps through your account, and to the people whose information you collect, use, share or store using our service. That includes your drivers.
When you accept our terms of trade, or use our services, software or apps, you are telling us that you have given all the necessary privacy notices and have all the necessary consents.
If you would like help with wording for a privacy notice for your drivers, ask us.
If you have a question about privacy, want to see or correct information we hold about you, or want to make a complaint, contact our Privacy Officer.
We will acknowledge anything you send us within 5 working days.
