Privacy policy
Last updated 4 October 2026
Haulage One Stop Solution Ltd (“HOSS”, “we”, “us”) runs the HOSS web platform and mobile apps. This policy explains what data we collect, how we use it, and your rights.
Data we collect
- Account information. Name, email address and phone number.
- Location data. Precise GPS location of drivers during active jobs.
- Photos. Images taken for proof of delivery and vehicle inspection checks.
- Addresses. Collection and delivery addresses related to jobs.
- Device information. Device type and operating system, for app functionality.
- Documents and emails. Booking emails, PDFs, fuel receipts and supplier invoices that your organisation chooses to import.
How we use it
Your data is used to deliver and improve the HOSS service:
- Provide and operate the haulage management platform.
- Authenticate your account and manage access.
- Track driver locations during active jobs.
- Record proof of delivery, including signatures and photos.
- Complete daily vehicle inspection checks.
- Generate invoices and manage billing.
- Send notifications related to job updates.
- Read imported emails and documents, and check POD photos, using AI so the office can review the result.
How long we keep it
We keep data only as long as we need it. The periods below match UK statutory minimums for haulage operators. When a period ends, records are deleted or stripped of personal data automatically by a daily retention job.
| Record | Kept for | Basis |
|---|---|---|
| Invoices and financial records | 6 years | HMRC statutory minimum (Companies Act, VAT Act) |
| Proof of delivery (signatures, photos) | 6 years | Part of the invoice record |
| Daily walkaround checks and defect records | 15 months | DVSA Guide to Maintaining Roadworthiness |
| Driver hours and tachograph data | 1 year | EU and UK drivers’ hours regulation |
| Audit logs (security investigation trail) | 2 years | UK GDPR Article 30 records of processing |
| Job records (collection, delivery, timeline) | 6 years | Linked to invoices and the contract record |
| Account information (name, email, phone) | Until the account is closed | Necessary to operate the account |
| Push notification tokens | 90 days after last device use | Data minimisation: inactive tokens are purged automatically |
| Marketing and contact form submissions | 24 months | Consent; deleted earlier on request |
Lawful basis and our role
When we process your data
- Contract: running jobs, billing, and the platform you signed up for.
- Legal obligation: keeping financial and DVSA records as UK law requires.
- Legitimate interest: tracking driver location during active jobs, security audit logging, fraud prevention, and counting visits and enquiries to this website, including which advert or search brought them, in a way that stores nothing on your device. Until you choose, Google Ads receives cookieless signals that cannot be tied to you and are used only for aggregate measurement.
- Consent: marketing emails, optional integrations, and cookies you accept on this site. If you accept them, Google Ads uses cookies to measure which adverts bring people here, and PostHog records how you use this website (the pages you open, what you click and how far you scroll) so we can improve it. The recording leaves out anything you type into a form. You can change your choice at any time from the Cookie settings link at the foot of every page. The cookie policy lists exactly what is stored.
Controller and processor
When your employer, or the company you subcontract to, runs HOSS, they are the data controller for your job, driver and customer data. HOSS is the processor, acting on their instructions.
For our own marketing, billing and platform accounts, HOSS is the controller. Both roles are covered by a Data Processing Agreement, available to enterprise customers on request.
Your rights
Under UK GDPR you can ask for a copy of your personal data, or ask us to correct it, delete it, or restrict how we use it. You also have rights to data portability and to object. Email info@thehoss.co.uk and we will respond within 30 days.
Include your full name, the organisation you work with, and the right you want to exercise. We may ask for proof of identity before releasing data.
Where UK law requires us to keep certain records (for example, six years of invoices for HMRC), we anonymise your personal data instead of deleting the underlying record. The operational entry remains without your name, email or contact details.
Data breaches
If a personal data breach is likely to put your rights at risk, we will notify the UK Information Commissioner’s Office within 72 hours and contact affected users directly without undue delay. You can complain to the ICO at any time at ico.org.uk/make-a-complaint.
Contact
Questions about this policy or how we handle your data: email info@thehoss.co.uk or use the contact page.