1. Who we are
Code Monkey Studios Ltd (“we”, “us”) provides the CodeMonkey vehicle tracking and fleet management service. This policy covers the CodeMonkey websites, the CodeMonkey app for Android and iOS, and the data reported by tracking devices, cameras and sensors installed in vehicles and other assets.
- Data controllerCode Monkey Studios Ltd
- Company number08252010
- Registered addressUnit 4E The Gateway, Silkwood Park, West Yorkshire, WF5 9TJ, GB
- Emailinfo@codemonkeystudios.co.uk
- Telephone01924976921
- Websitehttps://fleet.codemonkey.uk.com
2. Who controls your data
The service is used in two different ways, and which one applies to you decides who is legally responsible for your personal data.
- You hold the account yourself
- If you signed up for CodeMonkey in your own name or your own business’s name, we are the data controller. This policy describes what we do and why.
- Your employer or fleet operator holds the account
- If your account was created for you by an employer, a fleet operator, an installer or a reseller, then that organisation is the data controller. They decide which vehicles are tracked, which alerts are switched on, who may see the data and how long it is kept, and we act as their data processor under contract. Ask them for their own privacy notice first; we will always help them answer you.
Either way you can contact us using the details in section 14 and we will make sure your request reaches the right people.
3. What information we collect
Account and sign-in information
Your name, username, email address, telephone number, the account and sub-account you belong to, your role and permissions, and a securely hashed version of your password. When you sign in we record the time, your IP address and basic browser or app version information so we can secure the account, and — if you choose to use one — the public key of a passkey.
Vehicle, asset and device data
This is the substance of the service. Depending on the hardware fitted, a tracking device may report position (latitude, longitude, speed, heading, altitude and satellite quality), ignition and movement state, journey starts and stops, idling, harsh driving events, distance and engine hours, inputs and outputs, battery and external power, temperature and other sensor readings, driver identification tag reads, engine, CAN bus, FMS and tachograph data where the vehicle supports it, trailer identity and braking data, and — where a camera is fitted — video clips and still images recorded by that camera.
Most of this describes a vehicle. It becomes personal data about a person when it can be connected to an identifiable driver, for example through a driver login, a driver ID tag, a shift rota or in-cab camera footage.
Location from your phone
The CodeMonkey app asks for your phone’s location only while you are using the app, and only for features that need it — centring the map on where you are, and recording where a stolen-vehicle alarm was cleared from so that a recovery can be evidenced. The app does not collect your phone’s location in the background, and it does not track your phone when it is closed. You can refuse the permission, or withdraw it later in your device settings, and the rest of the app keeps working. Vehicle positions always come from the tracking device in the vehicle, never from your phone.
Notifications
If you turn on push notifications we store the notification token issued by Apple or Google (handled for us by OneSignal) together with the alert types you chose, so that we can deliver those alerts. Turning notifications off removes that registration.
Payments
Where you buy or renew a subscription, your card details are entered directly into Stripe’s payment form and are never received or stored on our systems. We keep the record Stripe returns to us — the amount, currency, status, invoice, and the card brand and last four digits — together with your billing name and address.
Support and messages we send you
Support requests, tickets and correspondence you send us, and a per-recipient log of the alerts and service messages we sent you by email, SMS, push, voice or webhook, so that delivery problems can be investigated and proven.
Diagnostics
If the app or the website fails, it reports the error type, message, stack trace, page, app version and an anonymous install identifier so that we can fix it. Device connections are also logged at protocol level for a short period when we are diagnosing a fault. These are our own first-party diagnostics: the app contains no advertising SDK, no third-party analytics SDK and no advertising identifier, and does not use the Android App Set ID.
Cookies and local storage
We use strictly necessary cookies and browser storage to keep you signed in, to remember your preferences (such as theme, toolbar layout, map choice and — only if you ask — saved usernames), and to remember which brand of the service you arrived through. We do not use advertising cookies and we do not track you across other websites.
Biometrics
If you switch on “require fingerprint to unlock”, the check is performed entirely by your own device. Your fingerprint or face data never leaves your device and is never sent to, seen by or stored by us — the app only records a setting on the device saying the lock is on.
4. How we use it, and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the tracking, mapping, reporting and history features you or your employer signed up for | Performance of a contract |
| Sending the alerts and notifications configured on the account | Performance of a contract |
| Theft deterrence, stolen-vehicle tracking and recovery | Legitimate interests (protecting property), and the contract where a stolen-vehicle product is bought |
| Driver safety, duty of care, vehicle checks, tachograph and compliance reporting | Legitimate interests of the fleet operator, and their legal obligations |
| Taking payment, invoicing, credit control and preventing fraud | Performance of a contract; legal obligation |
| Answering support requests and installation queries | Performance of a contract; legitimate interests |
| Keeping the service secure, preventing abuse, and fixing faults using diagnostics | Legitimate interests (a secure, working service) |
| Optional AI assistance features, where the account has enabled them | Performance of a contract; legitimate interests |
| Marketing about our own products | Consent, or legitimate interests for existing customers — you can opt out at any time |
We do not sell personal data, we do not share it with anyone for advertising or profiling, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects.
6. If you are a driver or an employee
If a vehicle you drive is tracked because your employer decided to track it, your employer — not us — chooses what is recorded, who can see it and how long it is kept. Under UK and EU data protection law they must tell you that the vehicle is tracked and why, keep the monitoring to what is necessary and proportionate, and carry out a data protection impact assessment where one is required.
Ask your employer for their privacy notice and their vehicle-tracking policy. If you believe tracking data is being misused, raise it with them first; you can also contact us at the address in section 14, and you always have the right to complain to your data protection regulator.
7. How we protect it
- Traffic between the app, the website and our servers is encrypted with TLS.
- Passwords are stored hashed, never in readable form, and passkeys and device biometrics are supported as stronger alternatives.
- Access is restricted by role and permission, and administrative actions are recorded in an audit log.
- Device data ingested over MQTT is authenticated with per-device certificates.
- Payment card details never reach our systems — they go directly to Stripe.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to present a risk, we will notify the relevant regulator and, where required, the people affected.
8. How long we keep it
| Information | Kept for |
|---|---|
| Position and journey history | Available live for approximately three months, then moved to archive storage, and deleted after five years at the latest. An account can ask for a shorter period. |
| Camera video and images | The retention period configured on the account; deleted sooner on request. |
| Record of alerts and messages sent to you | Retained for the account’s audit needs; the support view over it only ever shows the last seven days. |
| App and website error diagnostics | 30 days |
| Device connection and protocol diagnostics | 7 days |
| Account, user and preference records | For as long as the account is open, then deleted or anonymised (see section 10). |
| Invoices, payments and tax records | As long as accounting and tax law requires — normally six years after the end of the relevant financial year in the UK. |
Backups are kept on their own rolling cycle and age out automatically, so deleted data can persist inside a backup for a short period after it disappears from the service.
9. Your rights
Subject to the conditions in data protection law, you have the right to:
- ask what personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- have your data erased (see section 10);
- restrict or object to processing, including processing based on legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time, where we relied on consent; and
- complain to a data protection regulator. In the UK that is the Information Commissioner’s Office, ico.org.uk.
Contact us using section 14 and we will respond within one month. Where your employer is the controller of the data you are asking about, we will pass your request to them and support them in answering it.
10. Deleting your account and your data
How to ask
- Email info@codemonkeystudios.co.uk from the address on the account, with the subject “Delete my account” and the account name.
- Or, if your employer or fleet operator holds the account, ask their administrator — they can remove your user from the account immediately.
What is deleted
- Your user login, name, email address, telephone number and role.
- Your saved preferences and saved logins, any passkey registered to the account, and the push-notification tokens registered to your devices.
- Any device biometric setting, which is stored only on your own phone and is removed when you uninstall the app.
- App error diagnostics linked to your session, which are deleted automatically within 30 days.
What we may have to keep
- Invoices, payment records and correspondence we are required to retain by tax, accounting or legal-claims rules.
- Vehicle and tracking history belonging to the account holder. If your employer owns the account, that data is theirs, and we cannot delete it on your instruction — ask them.
If you hold the account yourself, closing it removes the account, its users, its devices and its tracking history, subject only to the legal retention above. We action deletion requests within 30 days and will confirm when it is done.
Uninstalling the app on its own does not delete your account — it only removes the app from that device. Use one of the routes above to delete the account itself.
11. Children
The service is a business tool and is not directed at children. We do not knowingly create accounts for, or knowingly collect personal data from, anyone under 16. If you believe a child’s data has reached us, contact us and we will delete it.
12. International transfers
Some of the providers listed in section 5 process data outside the United Kingdom and the European Economic Area. Where that happens we rely on an adequacy decision for the destination country, or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus any additional safeguards the transfer needs. You can ask us for details of the safeguards used for a particular transfer.
13. Changes to this policy
We update this policy when the service changes. The current version is always at http://fleet.codemonkey.uk.com/privacy-policy and carries the date it was last updated at the top of the page. If a change materially affects how we use your personal data we will tell you in the app or by email before it takes effect.
14. Contact us
For any question about this policy, or to exercise any of the rights in section 9:
- CompanyCode Monkey Studios Ltd
- PostUnit 4E The Gateway, Silkwood Park, West Yorkshire, WF5 9TJ, GB
- Emailinfo@codemonkeystudios.co.uk
- Telephone01924976921
- Websitehttps://fleet.codemonkey.uk.com