Privacy Policy

This policy explains how CollectiveMiles handles personal information when you visit our website, enquire about the platform, create an operator account, use the fleet workspace, or submit information through an operator's booking experience.

For our website, sales, billing, and account administration, CollectiveMiles generally decides why and how information is handled. For hirer and driver information entered by a fleet operator or its customer, the operator generally controls the business purpose and CollectiveMiles processes the information to provide the service.

Depending on how you use the service, we may collect:

• name, work email, telephone number, business name, location, and account details;
• subscription, invoice, and payment-status information (payment card details may be handled by the payment provider rather than stored by us);
• fleet records such as vehicle details, registration identifiers, photographs, availability, maintenance notes, and locations;
• booking and operational records, including dates, pickup and return details, customer contact details, notes, incident records, and operator activity;
• messages, support requests, demo requests, and information you choose to provide; and
• technical and security data such as IP address, browser, device, timestamps, authentication events, and service logs.

Please do not enter sensitive information unless it is necessary and your organisation is authorised to collect and use it.

We collect information directly from you, from authorised users in your organisation, from customers using an operator's booking form, and automatically when the service is used. We may also receive limited account, payment, delivery, or authentication information from service providers that help us operate the platform.

We use personal information to provide and secure accounts; operate bookings, fleet records, notifications, support, and backups; process subscriptions; respond to requests; prevent misuse; maintain audit records; improve reliability; and meet legal obligations.

Where the law requires a legal basis, processing may rely on performance of a contract, legitimate interests, consent, or compliance with law. We do not sell personal information.

We use essential browser storage to remember necessary preferences and maintain site functionality. Optional analytics is disabled until you choose “Allow analytics” in the cookie banner.

If analytics is enabled, we may collect aggregated information about page visits, device type, approximate region, and interactions so we can improve the website. You can decline optional analytics and continue using the public website. Clearing this site's browser storage resets your preference.

We may disclose information to vetted providers that support hosting, databases, authentication, communications, payments, monitoring, and customer support. They may use it only to provide contracted services and must protect it appropriately.

We may also disclose information when required by law, to protect people or the service, in connection with a business transfer subject to appropriate safeguards, or when you direct or authorise us. An operator may disclose booking information to its staff, insurers, repairers, or other parties under its own policies and legal obligations.

CollectiveMiles serves operators in multiple regions, so information may be accessed or processed outside the country where it was collected. We assess providers and use contractual and technical safeguards appropriate to the transfer.

For New Zealand information, overseas disclosures are handled with regard to Information Privacy Principle 12. For Australian information, we take reasonable steps relevant to Australian Privacy Principle 8. UAE transfers are handled subject to the applicable federal or free-zone data protection regime.

We retain information only for as long as reasonably needed for the purposes above, an active account, dispute resolution, security, backups, and legal or financial record-keeping. Retention periods vary by data type and operator instructions. When information is no longer required, we delete, de-identify, or securely isolate it from ordinary use, subject to backup cycles and legal holds.

We use layered safeguards designed to protect confidentiality, integrity, and availability. These include controlled authentication, role-based access, database Row-Level Security policies, tenant-scoped queries, transport encryption, logging, backups, and operational review.

No online service can promise absolute security. Operators are responsible for managing authorised users, strong credentials, exports, devices, and appropriate access to their workspace. More detail is available on our Security & RLS page.

Depending on where you are located, you may request access to or correction of personal information, ask for deletion or restriction where available, withdraw consent, object to certain processing, or complain to a regulator. Some requests may be limited by legal exceptions.

If your information was provided to a fleet operator, contact that operator first. We will assist the operator with verified requests where CollectiveMiles acts on its instructions. You can also contact privacy@collectivemiles.com.

New Zealand. The Privacy Act 2020 and its information privacy principles may apply. You may raise concerns with the Office of the Privacy Commissioner.

Australia. Where the Privacy Act 1988 and Australian Privacy Principles apply, you may complain to us and then to the Office of the Australian Information Commissioner.

United Arab Emirates and Dubai. Federal Decree-Law No. 45 of 2021 may apply outside excluded free zones. In the Dubai International Financial Centre, DIFC Data Protection Law No. 5 of 2020 may apply. The applicable regulator depends on the establishment and processing context.

We assess suspected incidents, contain risk, preserve relevant records, and notify affected parties or regulators when required. In New Zealand, qualifying breaches that have caused or may cause serious harm must be notified as soon as practicable. In Australia, the Notifiable Data Breaches scheme applies to eligible breaches for covered entities. UAE notification duties depend on the applicable federal or free-zone regime.

Questions, access or correction requests, and privacy complaints can be sent to privacy@collectivemiles.com. We may ask for enough information to verify your identity and locate the relevant record.

We may update this policy when the service, providers, or legal requirements change. The revised version will appear here with a new update date. We will use an appropriate notice for material changes affecting active customers.