HERO Management System — Johno Service Hire Ltd
This Privacy Policy explains how Johno Service Hire Ltd ("we", "us", "our") collects, uses, stores, and protects personal data in connection with the HERO Management System platform. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Johno Service Hire Ltd is the Data Controller for personal data processed in connection with the HERO Management System. For data we process on behalf of our Clients, we act as a Data Processor under the terms of our Data Processing Agreement.
Contact: support@johno-servicehire.co.uk
Company Data: Company name, registration number, VAT number, address, contact details, bank details (for billing).
User Data: Names, email addresses, job titles, login credentials (hashed — never stored in plain text).
Driver Data: Names, NI numbers, driver licence numbers, tachograph card data, vehicle check records, timesheet records.
Location Data: GPS coordinates from vehicles and IoT devices for fleet tracking and route history.
Operational Data: Fuel transactions, vehicle maintenance records, job records, waste transfer notes, sensor readings from connected devices.
Technical Data: IP addresses, browser type, session logs, API request logs for security and performance monitoring.
• Contract performance: Processing is necessary to deliver the Platform services.
• Legal obligation: Tachograph data, driver records, and waste documentation may be required by law (e.g., Road Transport Act, Environmental Protection Act 1990).
• Legitimate interests: System security monitoring, fraud prevention, and service improvement.
• Consent: Where we rely on consent (e.g., marketing communications), you may withdraw at any time.
• Delivering and maintaining the Platform and its features.
• Billing and account management.
• Regulatory compliance assistance (tachograph, WTN, operator licensing).
• Technical support and incident resolution.
• Platform security monitoring and fraud detection.
• Service improvement and feature development (using anonymised/aggregated data).
• Sending service notifications and updates (not marketing without consent).
We do not sell your personal data. We may share data with:
• Hosting and infrastructure providers (UK-based server infrastructure).
• Payment processors for subscription billing.
• Regulatory authorities where required by law (e.g., DVSA, Environment Agency, HMRC).
• Professional advisors (legal, accounting) under confidentiality obligations.
All third-party processors are subject to appropriate data processing agreements.
We process and store data primarily within the United Kingdom. Any transfers outside the UK are made under appropriate safeguards (UK Standard Contractual Clauses or adequacy decisions) in compliance with UK GDPR Chapter V.
• Active account data is retained for the duration of the subscription.
• Tachograph and driver compliance records: minimum 2 years as required by UK law.
• Waste Transfer Notes: minimum 3 years as required by the Environmental Protection Act 1990.
• Financial records: 7 years as required by HMRC.
• Upon account termination, data is deleted within 30 days unless longer retention is legally required.
• Backups may retain data for up to 60 days before deletion.
Under UK GDPR, you have the right to:
• Access your personal data (Subject Access Request).
• Rectify inaccurate data.
• Erase data where no longer necessary (right to be forgotten).
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Rights related to automated decision-making.
To exercise these rights, contact us at support@johno-servicehire.co.uk. We will respond within 30 days.
We implement appropriate technical and organisational measures including:
• Encrypted data transmission (HTTPS/TLS).
• Hashed password storage (bcrypt).
• JWT-based authentication with role-based access control.
• Regular security audits and penetration testing.
• Server-level firewall and intrusion detection.
Despite these measures, no system is entirely secure. Please report any suspected data breach to us immediately.
The Platform uses session cookies essential to its operation. We do not use advertising or tracking cookies. You can disable cookies via your browser settings, but this may affect Platform functionality.
If you have concerns about our data handling, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Where your employer or transport operator uses our optional driver-licence checking add-on, we obtain your driving licence record from the DVLA. The data disclosed may include your driving entitlement and category/restriction codes, valid endorsements, penalty points, disqualifications, and (where requested) your Driver CPC and digital tachograph card details.
Source: the DVLA. Purpose: solely to confirm your entitlement to drive for work — this data is never used for identity checking. Lawful basis: your consent (a signed data-protection declaration), together with the operator's legitimate interest in meeting its legal duties as an employer of drivers. You may withdraw consent at any time, and consent in any event expires three years after it is given, or when you stop driving for the operator, whichever is first.
Retention: your signed declaration is kept for 2 years after you stop being checked; the detailed DVLA response is kept for a limited period (by default around 2 years) and then deleted, while a record that the check took place (date and reference) is retained for audit. This add-on applies only where your operator has enabled it.
Where your employer or its accountant uses the Platform's financial module, we process financial, accounting, tax and payroll information — which may include names, National Insurance numbers, pay and tax details and company financial data — in order to prepare and submit returns and filings to HM Revenue & Customs (VAT, payroll RTI, Corporation Tax) and Companies House (statutory accounts), on the instruction of your employer.
Recipients: HMRC and Companies House receive the data your employer instructs us to submit. Lawful basis: compliance with your employer's legal obligations and its legitimate interests in meeting its statutory duties. Retention: financial and tax records are retained for the periods required by law (generally at least six years).
We may update this Privacy Policy from time to time. Clients will be notified of material changes via the Platform or by email at least 14 days before they take effect.
Johno Service Hire Ltd — Registered in England and Wales — support@johno-servicehire.co.uk
Effective Date: 30 June 2026 • Version: 2.1 • Issued by: Johno Service Hire Ltd