Privacy notice

TMS Drive is an internal system for people who work for the Transport Made Simple group. It plans duties, records hours, handles leave and absence, and lets a driving colleague see their shifts and clock on and off. It is not a service for the travelling public. If you are a passenger, nothing here applies to you and this is the wrong page: please use the contact details on the operator website for the service you travelled on.

The data controller is Transport Made Simple Limited, company number 15754458, registered office Roswold House, Oak Drive, Diss, England, IP22 4GX. The group trades under several brands, including Central Connect, Simonds and Flagfinders.

For anything about this notice, or to exercise any of the rights below, write to tom.singleton@transportmadesimple.co.uk.

Almost all of it comes from TMS Insights, the group HR system. Insights is the source of truth for colleague records: no colleague exists in Drive who does not exist in Insights, and Drive does not let anybody create one. A nightly sync copies across the fields Insights owns, so a change made in HR reaches Drive without anybody retyping it.

The fields Drive receives from Insights are:

• your name
• your work email address
• your mobile number, where HR holds one
• your payroll reference
• your depot
• your job title
• which company in the group you work for
• whether you are currently working for us, whether a salary already covers your normal hours, your contracted weekly hours, the days per week you work and your annual leave entitlement
• your line manager, where HR holds one

Drive does not receive or hold your bank details, your National Insurance number or your date of birth. That is a deliberate rule in the code, not an accident of what HR happened to send.

Everything else is created by the work itself: the duties you are given, the hours you work, the leave you ask for, the times you clock on and off, and the messages we send you.

Taking it in the order it accumulates.

Your work

The duties allocated to you, the rota line you sit on, the shifts you are down for, the vehicle allocated to a duty (its registration and fleet number), your planned and actual sign on and sign off times, the hours you worked and the hours that count towards pay. Weekly hours are reviewed and approved by a manager and then sent to Insights, which is what feeds payroll. Drive itself never talks to the payroll system and never stores a pay rate.

Why: we cannot run a bus operation without knowing who is driving what and when, and we cannot pay you correctly without a record of the hours. Lawful basis: performance of your contract with us (UK GDPR Article 6(1)(b)); our legal obligations to keep working time and pay records (Article 6(1)(c), including the Working Time Regulations 1998 and National Minimum Wage record keeping); and our legitimate interests in running a safe, lawful and properly resourced operation (Article 6(1)(f)).

Leave

Leave requests, the dates and the number of days, whether a request was approved or refused, who decided it and when, any reason you gave, and any note a manager wrote when refusing. If you cancel leave that had already been approved, that is recorded too, because it hands a body back to the depot that the roster had written off.

Lawful basis: your contract, and our legal obligation to give and record statutory annual leave.

Your app account

Your work email address, the status of the account (invited, registered, suspended), who invited you and when, when you registered, and when you last signed in. Your password is never stored. What is stored is a bcrypt hash of it, which cannot be turned back into the password. The tokens that keep you signed in are stored only as SHA-256 hashes, so a copy of that table is worth nothing to anybody who takes it. A sign in token lasts fifteen minutes before it is refreshed, the refresh token lasts thirty days, and a set password or reset link lasts twenty four hours and can be used once.

Sign in records, for portal users

If you use the Drive web portal rather than the app, we record each sign in: the time, the email address used, and whether you signed in with a password or arrived from Insights.

Lawful basis: our legitimate interests in keeping an operational system secure and knowing who has been in it.

Messages we send you

When we text or email you about a duty, we store the message exactly as it was sent, word for word, along with the number or address it went to, when it was sent, and whether the provider accepted it, refused it or nothing was sent at all. That covers the duty allocation message, the night before reminder, the alert when sign on has passed and nobody has clocked in, the message when a shift is taken off you, leave requests and cancellations, and the Sunday digest of next week.

Why we keep the body and not just the fact: what somebody actually read is what they will later ask about. Storing only "a reminder was sent" cannot answer "what did it say".

This is the part of the system people care most about, so it is set out in full and without softening. This is workplace location monitoring.

When

At the moment you press clock in, at the moment you press clock out, and at the start and the end of a walkaround check. At no other time. The app does not follow you during a shift, does not record where the bus goes, and does not track you when it is closed or in the background. There are four moments, and you start all of them.

The two check fixes are there because a walkaround means walking round the vehicle. Taken together they show whether the phone moved while the check was being done, which is the difference between a check carried out at the bus and one filled in sitting in the cab. See walkaround checks below.

What

• latitude and longitude, as your handset reports them
• the accuracy figure your handset gives with the fix, in metres, which is the phone saying how wrong it might be
• the time your handset thinks it is, kept alongside our own server time so that a phone with a wrong clock can be spotted rather than acted on

What we do with it

Our server, never the app, works out how far you are from your depot and compares that against the depot radius (250 metres unless a depot has its own figure). We store the distance it calculated and the radius that was in force at the time, so that changing a depot radius later cannot quietly rewrite whether a clock in from last month was inside it.

A refused clock in is recorded too, with its location

If the system says no, whether because you were too far away, too early, had no duty allocated, were already clocked in, or the location fix was too old, the attempt is still written down, marked as refused, with the reason, the time and the coordinates it was refused on.

That is deliberate and it is in your favour more often than not. "I did try, at 05:38, and it would not let me" is a question a depot can answer with that row and cannot answer without it. If the refusals were discarded, an attempt that failed would look identical to no attempt at all.

Why we do this at all

Because clocking on is what pay is built from, and a clock in from somewhere other than the depot means either a mistake worth correcting or hours claimed that were not worked. Recording the location makes that a question somebody can ask, rather than a fact nobody holds.

Lawful basis: our legitimate interests (UK GDPR Article 6(1)(f)) in paying accurately, in knowing that duties are being started from the depot, and in being able to answer a pay query with evidence. We have weighed that against your privacy, which is why the capture is limited to moments you trigger yourself rather than continuous tracking, and why nothing about your location is used outside pay, attendance and vehicle safety. The two fixes taken during a walkaround check rest on a different basis, set out under walkaround checks below. You have the right to object to this processing: see your rights below.

Before taking a vehicle out you carry out a walkaround check in the app. It is a legal record rather than a form: DVSA expects these to be kept and produced, and after an incident it may be read by an examiner, an insurer or a solicitor. That is why it holds more than your answers.

What the check records

• your answer to every item, in the wording you were asked
• anything you typed to describe a fault
• the vehicle, the mileage you entered and the fuel reading
• when you started and when you signed, and how long the check took in total
• how long each individual line took, worked out from the gap between one answer and the next
• where you were at the start and at the end, as set out above
• which version of the app you used, and the model of handset

Photographs

A photograph is required whenever you mark an item as failed. The app also asks for a small number of photographs at random as you work through the check, against items it picks itself, so that they cannot be predicted or prepared. Each photograph is stored with the time the shutter fired and the handset's last known position.

These are pictures of vehicles, not of people. If you appear in one by accident, that is incidental and the photograph is still only used for the purpose below.

Your signature

You sign to declare that you carried out the check and whether the vehicle is fit for service. The image of your signature is stored with the check. If a check is not accepted and you sign it again, the new signature replaces the old one and the one it replaced is deleted, so only the signature that stands is kept.

How long photographs and signatures are kept

At least 15 months, and then the images are deleted. Fifteen months is the period DVSA expects maintenance records to be available for. After that:

• the photographs are deleted, and the record simply notes that a photograph was taken of that item at that time
• the image of your signature is deleted
• the fact that you signed, and the moment you signed, is kept permanently, because that is the declaration itself rather than corroboration of it

The check, your answers and any defect raised from it are kept beyond that period, because they are the maintenance record for the vehicle.

What we do with the timings

We look at how long checks take. A check completed far faster than the typical check at your depot is flagged for a manager to look at, as is a check carried out a long way from the depot, or a photograph taken a long time before or after the check it belongs to.

Why we hold all of this

Lawful basis: our legal obligations as the holder of an operator's licence, including the duty to have an effective driver defect reporting system and to keep the records (UK GDPR Article 6(1)(c)); and our legitimate interests in vehicle safety, in being able to evidence that a vehicle was checked, and in defending or resolving a claim after an incident (Article 6(1)(f)).

Checks are visible to your depot managers, to engineering, and to the group compliance team. A single check may be produced to DVSA, to an insurer or to a court where it is relevant.

Information about your health is special category data under Article 9 of the UK GDPR. It gets stricter treatment than everything else on this page, so it is set out separately.

What Drive holds:

• absences recorded as sickness, with the start date, the end date where the absence has ended, the working days it covered, whether it affects pay, and who recorded it
• any reason recorded against the absence, which may describe a medical condition or symptom
• your return to work record, where one has been completed
• your Bradford Factor score, which is a number calculated from how many separate absences you have had and how long each one lasted

Article 6 basis: our legal obligations and our legitimate interests in managing attendance and covering duties safely.

Article 9 condition: Article 9(2)(b), processing necessary for carrying out our obligations and exercising our rights in the field of employment and social security law. In UK law that condition is used with Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018, which requires us to keep an appropriate policy document covering how we handle this information and how long we keep it.

Inside the group, your record is visible to your managers, to the depot planning your duties, and to HR. Managers are scoped to their own depots. Pay figures are restricted further again.

Outside the group, the information sits with a small number of suppliers who process it on our instructions and for no purpose of their own:

• Vercel, which hosts the application
• Railway, which hosts the database everything is stored in
• Resend, which delivers our emails
• Twilio, which delivers our text messages
• Vercel Blob, which stores walkaround check photographs and signature images
• Google, whose mapping service draws the map of where a walkaround check was carried out. The map is requested by our server rather than by your handset, so your phone does not contact Google

Approved weekly hours are passed to TMS Insights, which is part of the same group and the same data controller, and Insights is what sends pay information to the group payroll provider. Drive has no connection to the payroll provider itself.

We do not sell your information, we do not use it for advertising, and there is no analytics or tracking product in the app or in this website.

Some of this is decided by the design and some of it is not decided yet.

What is fixed:

• a sign in token expires after thirty days, and a set password or reset link after twenty four hours
• clock events are never edited. A correction is a new record, because a history that can be rewritten cannot answer a pay query
• when you leave, your record stays rather than vanishing, because a duty you worked last week still needs your name against it and the hours still have to reconcile. You are excluded from allocation, not deleted
• walkaround check photographs and signature images are deleted after 15 months, and that deletion runs automatically every night rather than waiting for somebody to remember. The check itself, your answers and the moment you signed are kept beyond that, as the maintenance record for the vehicle

Under UK data protection law you can ask us to:

• Show you what we hold about you, and give you a copy. This is a subject access request and we have one month to answer it
• Correct anything that is wrong or incomplete
• Delete information, where we have no continuing reason to hold it. Records we are legally required to keep, such as working time and pay records, cannot be deleted on request
• Restrict what we do with it while a dispute about it is sorted out
• Object to processing we do on the basis of legitimate interests. That includes the location captured at clock in and clock out. If you object we have to stop unless we can show compelling grounds that override your objection, and we have to actually consider it rather than refuse by reflex
• Receive it in a portable form, for the information you gave us or that we hold under your contract

None of this costs anything. Ask at tom.singleton@transportmadesimple.co.uk, or through your depot if you would rather not email directly.

Come to us first if you can, at tom.singleton@transportmadesimple.co.uk. We would rather fix something than have you told to wait by somebody else.

You do not have to, and you never lose the right to go to the regulator. The Information Commissioner is the UK supervisory authority for data protection and you can complain to them directly:

• ico.org.uk/make-a-complaint
• helpline 0303 123 1113
• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If we change what we collect or why, this page changes and the date at the top changes with it. Anything that materially affects you will also be told to you directly rather than left for you to notice.

See also the terms of use for the app, how to get help and what the app is and who it is for.