Privacy Policy

Greater London Drainage Ltd ("GLD", "we", "us") is a drainage services company registered in England.

Registered address: Hatfield, AL10 8LF, United Kingdom.

We are the data controller responsible for the personal data described in this notice under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains how we collect and use personal data in relation to:

• Our employees and drivers (HR, payroll, PAYE, holidays, expenses).
• Live GPS location of our company vehicles.
• Our customers, sites, and the jobs we carry out for them.
• Payments, invoices and estimates.

For each employee we process: name, home address, contact details, National Insurance number, tax code, pay rates, hours worked, gross/net pay, income tax and NI deductions, payslips, holiday allowance and holiday requests, and expense receipts submitted by drivers.

Purposes: paying wages, meeting our PAYE and Real Time Information (RTI) obligations to HMRC, providing payslips, managing holiday entitlement, and reimbursing legitimate work expenses.

Lawful bases: performance of your contract of employment (Art. 6(1)(b)), compliance with our legal obligations to HMRC and other authorities (Art. 6(1)(c)), and our legitimate interests in running the business (Art. 6(1)(f)).

Sharing: HMRC, our accountant, our payroll software provider, and our bank when paying wages. We never sell employee data.

Our company vehicles are fitted with GPS trackers (provided by Ram Tracking). While a driver is on shift, the tracker reports the vehicle's live location, speed and ignition status to our systems.

Purposes: dispatching drivers to jobs efficiently, providing accurate live ETAs to customers via a secure tracking link, safeguarding our vehicles, and investigating incidents or complaints.

Lawful basis: our legitimate interests in operating the business (Art. 6(1)(f)). Tracking is limited to company vehicles during working use, and drivers have been informed in advance. We do not use tracker data for general behavioural profiling or performance league tables.

Sharing with customers: when a driver is en route, the customer for that job may receive a link showing the vehicle's live position and estimated arrival time. The link is protected by a per-job token and only reveals location while the driver is actively on route to that job.

For each customer and job we may hold: contact name, phone number, email address, billing address, site address, purchase order numbers, job notes, photos and videos of works carried out, invoices, estimates, and payment records.

Purposes: quoting for work, scheduling jobs, sending ETA notifications, carrying out the work, invoicing and taking payment, and dealing with any warranty or follow-up.

Lawful bases: performance of a contract with the customer (Art. 6(1)(b)) and our legitimate interests in running the business (Art. 6(1)(f)).

Payments: card and online payments are processed by PayPal and Revolut. We do not store full card details on our systems.

Messaging: we use Twilio to send SMS notifications (ETA and post-job review requests) to the contact number provided for the job.

We keep personal data only for as long as we need it:

• Payroll and PAYE records: at least 6 years, as required by HMRC.
• Invoices, estimates and accounting records: at least 6 years.
• Job records, photos and notes: up to 6 years after the job, so we can honour warranties and respond to disputes.
• Live vehicle location events: retained short-term for operational use and cleaned up on a rolling basis (typically within 90 days), unless retained longer as evidence for a specific incident.
• ETA tracking links: expire automatically once the job is completed.
• Employee HR files: for the duration of employment plus up to 6 years afterwards.

You have the right to:

• Ask what personal data we hold about you (subject access request).
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to erase your data where we no longer need it and no legal duty requires us to keep it.
• Ask us to restrict processing, or object to processing based on legitimate interests.
• Ask for a copy of data you have provided in a portable format.
• Withdraw consent where we rely on it (this will not affect processing already carried out).

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, although we would appreciate the chance to resolve any concerns first.

Access to our job, finance and payroll systems is restricted by role-based logins. Sensitive credentials (payment gateways, SMS provider, GPS provider) are stored as encrypted secrets on our backend. Backups of the database are taken regularly and transmitted only to authorised addresses.

For any question about this policy, or to exercise any of your rights, please contact us: