Legal
Privacy Policy
What personal data Road XS collects, why we collect it, how long we keep it and what rights you have over it. Written to be read rather than skimmed past.
Road XS is operated by OJE Technology Limited. This policy covers our website and the Road XS software, and applies whether you are a transport operator, a coordinator, a driver or a passenger.
Introduction
We are committed to safeguarding the privacy of everyone who visits our website or uses Road XS. This policy explains what personal data we hold, why we hold it, and what you can ask us to do with it.
Personal data means any information relating to an identified or identifiable person, as defined in Article 4(1) of the UK GDPR. That includes a name, an identification number, location data, an online identifier, or anything else that could identify someone directly or indirectly.
By using our website you agree to our use of cookies as set out in this policy. Where consent is required, we will ask before setting non essential cookies.
Our website includes privacy controls that affect how we process your data. You can use these to say whether you want to receive direct marketing and to limit what information about you is published.
How we use your personal data
This section sets out the categories of personal data we may process, where that data came from when we did not collect it directly from you, why we process it, and the legal basis we rely on.
Usage data. Your IP address, approximate location, browser type and version, operating system, referral source, length of visit, pages viewed and navigation paths, along with the timing and frequency of your use of the service. The source is our analytics tracking system. We use it to understand and improve the website and the software. Legal basis: our legitimate interest in monitoring and improving our service.
Account data. Your name, email address, contact telephone numbers, address, gender, date of birth and next of kin. This applies where you are a user of Road XS, or where a transport operator registers you to use their service. None of it is captured in the software without consent. The source is you or your transport operator. We use it to provide the service, keep it secure, maintain backups and communicate with you about your use of Road XS. Legal basis: our legitimate interest in the proper administration of the software and business.
Profile data. The information in your profile on the software, which may include your name, address, telephone number and email address. We use it to enable and monitor your use of the service, and we may contact you by email or phone. Legal basis: our legitimate interest in the proper administration of our business.
Service data. Your name, email address, contact number and address, provided in the course of using the service by you or your transport operator. We use it to operate the website, deliver the service, keep it secure, maintain backups and communicate with you. Legal basis: our legitimate interest in administering our business, or performance of a contract with you.
Publication data. Anything you post for publication on our website or through the service, used to enable that publication. Legal basis: our legitimate interest in administering our business, or performance of a contract with you.
Enquiry data. Information contained in any enquiry you send us about our products or services, used to offer, market and sell relevant products or services to you. Legal basis: consent.
Transaction data. Details of purchases you make with us or through our website, including your contact details, card details and the transaction itself. We use it to supply what you have bought and keep proper records. Legal basis: performance of a contract, and our legitimate interest in administering our business.
Notification data. Information you give us to subscribe to our email notifications or newsletters, used to send you those notifications. Legal basis: consent, or performance of a contract.
Correspondence data. The content and metadata of any communication you send us. Metadata for messages sent through our website contact forms is generated by the website. We use it to reply to you and keep proper records. Legal basis: our legitimate interest in administering our business and communicating with users.
We may process any personal data described in this policy where necessary to establish, exercise or defend legal claims, whether in court or out of it. Legal basis: our legitimate interest in protecting our legal rights and the rights of others.
We may also process your personal data where necessary to comply with a legal obligation, or to protect your vital interests or those of another person.
Please do not give us anyone else’s personal data unless we have asked you to.
Providing your personal data to others
We may disclose your personal data to any member of our group of companies, meaning our subsidiaries, partners, our ultimate holding company and its subsidiaries, so far as reasonably necessary for the purposes in this policy.
We may disclose your personal data to our insurers and professional advisers, so far as reasonably necessary for obtaining insurance, managing risk, obtaining professional advice and managing legal disputes.
Financial transactions are handled by our payment services provider, Square. We share transaction data with them only to the extent needed to process payments and refunds and to deal with related queries and complaints. Their privacy information is available at squareup.com.
We may disclose enquiry data to selected third party suppliers so they can contact you about relevant goods or services. Each of those third parties acts as its own data controller for that data, and will give you its own privacy policy when it contacts you.
We use Help Scout for support requests and Formaloo for data capture and website enquiries. Their privacy information is available at helpscout.com and formaloo.com.
We may also disclose your personal data where necessary to comply with a legal obligation, or to protect your vital interests or those of another person.
Retaining and deleting personal data
This section sets out our retention policies, which are designed to help us meet our legal obligations on keeping and deleting personal data.
We do not keep personal data for longer than is necessary for the purpose it was collected for.
Your name, email address and telephone number are retained from the date of enquiry and for as long as you remain a client, and are deleted from our systems after that.
Where we cannot specify a retention period in advance, we determine it based on our legitimate business needs.
We may retain your personal data for longer where necessary to comply with a legal obligation, or to protect your vital interests or those of another person.
Security of personal data
We take appropriate technical and organisational precautions to secure your personal data and prevent its loss, misuse or alteration.
Your personal data is stored on secure servers, computers and mobile devices, and in secure manual record-keeping systems where those apply.
The following data is stored by us in encrypted form: your name, contact information, passwords and cardholder data.
Data relating to enquiries and financial transactions sent between your browser and our servers is protected using encryption in transit.
You acknowledge that transmission of unencrypted or inadequately encrypted data over the internet is inherently insecure, and that we cannot guarantee the security of data sent that way.
You are responsible for keeping your password confidential and for making sure it is not easy to guess, by a person or a program. We will never ask you for your password other than when you log in.
Amendments
We may update this policy from time to time by publishing a new version on our website.
Access and marketing preferences
You may ask us to provide any personal information we hold about you. We may first ask for appropriate evidence of your identity. We will usually accept a photocopy of your passport certified by a solicitor or bank, together with an original utility bill showing your current address.
We may withhold personal information you request to the extent the law permits.
You may instruct us at any time to stop processing your personal information for marketing purposes.
In practice you will either agree in advance to our use of your information for marketing, or we will give you the opportunity to opt out.
Your rights under data protection law
This section summarises your rights. Some of them are complex, so this is a summary rather than a full legal explanation. You should read the relevant law and regulator guidance for the full position.
Your principal rights are:
the right to access your data;
the right to have inaccurate data corrected;
the right to have your data erased in certain circumstances;
the right to restrict how we process your data;
the right to object to our processing;
the right to data portability;
the right to complain to a supervisory authority; and
the right to withdraw consent.
Access. You have the right to confirmation of whether we process personal data about you and, where we do, access to that data together with certain additional information: the purposes of the processing, the categories of data concerned and who we share it with. Provided the rights of others are not affected, we will supply a copy. The first copy is free and additional copies may carry a reasonable fee.
Rectification. You have the right to have inaccurate personal data corrected and, taking into account the purposes of the processing, incomplete data completed.
Erasure. In some circumstances you have the right to erasure without undue delay: where the data is no longer necessary for the purpose it was collected for, where you withdraw consent to consent-based processing, where processing is for direct marketing, or where data has been processed unlawfully. There are general exclusions, including where processing is necessary for freedom of expression and information, for compliance with a legal obligation, or for legal claims.
Restriction. In some circumstances you have the right to restrict processing: where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, where we no longer need the data but you need it for legal claims, or where you have objected to processing pending verification of that objection. Where processing is restricted we may continue to store the data, but will otherwise only process it with your consent, for legal claims, to protect the rights of another person, or for reasons of important public interest.
Objection. You have the right to object to processing on grounds relating to your particular situation, where the legal basis is a task carried out in the public interest or in the exercise of official authority vested in us, or our legitimate interests or those of a third party. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is for legal claims.
Direct marketing. You have the right to object to processing for direct marketing, including profiling for direct marketing. If you object, we will stop.
Research and statistics. You have the right to object to processing for scientific or historical research or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for a task carried out for reasons of public interest.
Portability. Where the legal basis is consent and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used and machine readable format. This does not apply where it would adversely affect the rights and freedoms of others.
Complaints. If you consider that our processing infringes data protection law, you have the right to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office.
Withdrawing consent. Where the legal basis is consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it.
You may exercise any of these rights by giving us written notice.
Third party websites
Our website includes links to, and details of, third party websites.
We have no control over, and are not responsible for, the privacy policies or practices of those third parties.
Personal data of children
Our website and services are aimed at organisations rather than individuals.
If we have reason to believe we hold the personal data of someone under 18, we may delete it. We will only retain that information where it relates directly to the use of transport services on the software and has been authorised and approved by the transport operator using Road XS to deliver that service.
Updating your information
Please let us know if any personal information we hold about you needs to be corrected or updated.
Our details
This website and the Road XS software are owned and operated by OJE Technology Limited.
We are registered in England and Wales under company number 09943955. Our registered office and principal place of business is 3 Kenton House, Oxford Street, Moreton-in-Marsh, Gloucestershire, GL56 0LA, United Kingdom.
You can contact us:
by post, using the address above;
using our website contact form;
by telephone, on the number published on our website; or
by email, using the address published on our website.
Data protection registration
We are registered as a data controller with the UK Information Commissioner’s Office.
Our data protection registration number is ZB669107.
Data protection officer
Our data protection officer is Oliver Kemp, contactable using the details in section 16.
This policy was last updated on 2 July 2026.
Back to the top →