Privacy Policy
_Last updated: 15 October 2026 · Version 6_
This Privacy Policy explains how CoachComp ("we", "us", "our") collects, uses and protects personal data when you use the CoachComp platform at coachcomp.co.uk (the "Service").
CoachComp is the data controller for information about account holders (operator staff who sign up and use the Service). Where operators upload records about their drivers, vehicles and compliance activity, CoachComp acts as a data processor on the operator's behalf, and the operator remains the data controller for that content. The relevant terms are set out in our Data Processing Agreement.
1. Who we are
- Trading name: CoachComp
- Registered company: Coachcomp Limited, registered in England and Wales, company number 17362338
- Registered address: SY11 4EE, England
- ICO registration: registered with the Information Commissioner's Office as Coachcomp Limited, registration reference ZC223321
- Contact for privacy enquiries: info@coachcomp.co.uk
If you are a driver or member of staff whose employer uses CoachComp, please contact your employer first — they control your record on the platform.
2. Information we collect
Account and profile data — name, email address, role, operator/licence number, authentication metadata.
Operator compliance data uploaded by operator admins:
- Driver records (name, licence number, CPC/medical/DBS dates, endorsements, training)
- Vehicle records (registration, MOT/tax/tacho/PMI dates, DVSA MOT lookup results)
- O-licence discs and assignments
- Case records, ad-hoc tasks, audit runs and answers
- Policy documents and reviews
Usage data — Q&A questions and answers, in-app search, feature usage.
Technical data — IP address, browser/device identifiers, log data, cookie identifiers.
Payment data — subscription status and billing metadata handled by Stripe. We do not store card numbers.
Lite plan: workspaces on the Lite plan do not hold driver, staff or vehicle records. For those workspaces we only process account and login details and any personal information users choose to type into questions, reviews or policies, or include in uploaded documents.
3. Why we use your data (lawful bases under UK GDPR)
| Purpose | Lawful basis |
|---|---|
| Providing the Service to signed-in operators | Contract |
| O-licence, driver-hours, MOT and other transport compliance records | Legal obligation |
| Product security, fraud prevention, service improvement | Legitimate interests |
| Cookies (non-essential) and marketing emails | Consent |
| Billing and payment processing | Contract / legal obligation |
4. Who we share data with (subprocessors)
We share data only with vetted service providers acting on our documented instructions. The current, live list — including the purpose and hosting region of each provider — is published at coachcomp.co.uk/legal/subprocessors.
At the date of this version those providers are:
- Lovable Cloud (Supabase, AWS EU Ireland region, eu-west-1) — hosting, database, authentication, storage
- Lovable AI Gateway (Google Gemini / OpenAI, EU / US) — model routing for AI features (policy review, Q&A, audits)
- Perplexity (US) — supplementary research for Q&A citations
- DVSA MOT History API — vehicle MOT lookups
- Stripe (EU / US) — subscription billing
5. International transfers
Your stored data (the database, files and backups) is held in the EU (Ireland region, eu-west-1) and is not moved out of that region. A small number of listed subprocessors process limited, specific data outside the UK/EEA for a single task (see the subprocessors list); any such transfer is covered by an adequacy decision or the UK International Data Transfer Addendum.
AI features receive only the minimum fields needed for the request. Driving licence numbers, dates of birth, addresses and contact details, medical information, endorsements and drug and alcohol test results are never sent to any AI provider, and AI providers do not train their models on data sent from CoachComp. Full details are in section 6.1 of the Data Processing Agreement.
6. Retention
We keep personal data only for as long as necessary for the purpose it was collected, or for legal-obligation periods that apply to transport operators. Detailed periods are set out in our Retention Policy. Deleted data is removed from the live database immediately; encrypted backups in the Ireland region are overwritten on a rolling cycle of approximately 7 days.
7. Your rights
Under UK GDPR you have the right to: access your data, request correction or erasure, restrict or object to processing, receive a copy in a portable format, and withdraw consent at any time.
Account holders can exercise these rights from Settings → Your data (export and erasure). Workspace admins and transport managers can also download a full export of the workspace's compliance records there. To contact us directly, email info@coachcomp.co.uk. We respond within one month.
If you are dissatisfied, you may complain to the Information Commissioner's Office (ico.org.uk). Our entry on the ICO's public data protection register is held under reference ZC223321.
8. Security
We apply encryption in transit and at rest, row-level access controls, server-side authentication and least-privilege database roles. Access to production data by CoachComp staff is limited to what is needed to operate and support the Service. Suspected vulnerabilities can be reported to info@coachcomp.co.uk.
9. Cookies
We use strictly-necessary cookies for authentication and load balancing. Non-essential analytics and preference cookies are only set with your consent, which you can change at any time via the cookie banner.
10. Changes to this policy
We will publish material changes here and, where appropriate, notify account holders by email or in-app notice.