1. Who we are
Excubia Ltd is a company registered in England and Wales, Company Number 16522916, with its registered office at The Wesley Centre, Blyth Road, Maltby, Rotherham, S66 8JD.
For the purposes of UK data protection law, our contact point for all privacy matters is support@excubia.uk.
We are registered with the Information Commissioner's Office as a data controller. Registration number: ZC239310.
2. When we are a controller, and when we are a processor
This distinction matters, because it determines who you should contact about your data.
We are the controller
For our own account holders and for people who contact us — your account details, billing information, enquiries through our website, and support conversations. We decide why and how that data is used.
We are a processor
Where a business customer uses Excubia Fleet to track vehicles driven by their staff, that business is the controller of their drivers' data. We process it on their instructions. If you are a driver and want to know why you are being tracked, or want to exercise your rights, your employer is the right first point of contact — though we will always help where we can, and we will tell them we have heard from you only where we are required to.
Where we act as a processor, our Data Processing Agreement applies. A copy is available on request from support@excubia.uk.
3. What we collect
| Category | What it includes |
|---|---|
| Account data | Name, email address, phone number, business name, and account credentials. |
| Billing data | Billing address, subscription tier, invoice and payment records. Card details are handled by our payment provider — we do not store full card numbers. |
| Location data | GPS position, timestamp, speed, heading, ignition state and trip history from tracking devices. |
| Device data | Device identifiers, SIM and connection status, battery level, firmware version, and reporting health. |
| Driver and operational data | On Fleet accounts: driver names, licence categories, working time records, absence records, vehicle inspections, defects, incident reports and driver risk scores. |
| Usage data | Sign-in times, pages and features used, IP address, browser and device type. |
| Enquiry data | Anything you send us through our contact form or by email. |
| Misuse and security reports | Anything you send us when reporting a tracker you did not agree to, or a security vulnerability, including your contact details if you choose to give them. |
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the tracking service you have subscribed to | Performance of a contract |
| Taking payment and keeping accounting records | Contract, and legal obligation |
| Support, and responding to enquiries | Contract, and legitimate interests |
| Monitoring device health and platform security | Legitimate interests — keeping the service working and secure |
| Improving the platform | Legitimate interests |
| Investigating reports of misuse, and helping the police where a crime may have been committed | Legitimate interests — protecting people from being tracked without their agreement — and legal obligation where it applies |
| Meeting legal and regulatory obligations | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms. You can object to processing based on legitimate interests — see section 10.
We do not use your data for automated decision-making that produces legal or similarly significant effects about you. Driver risk scores are a tool for a human to interpret, not an automatic judgement.
5. Location data, specifically
Location data is the most sensitive thing we handle, so it is worth being direct about it.
- We collect it only from devices linked to an account, and only while that account is active.
- We use it to show positions and history in the platform, to trigger alerts you have configured, and to produce reports you have asked for.
- We do not sell it. We do not share it with advertisers, data brokers, or insurers.
- We access individual location records only where necessary to investigate a fault, respond to a support request, or comply with a legal obligation.
- We will disclose it to police or another authority only where we are legally required to, or where we reasonably believe it is necessary to prevent serious harm.
If a tracker is being used on you. Tracking a person without a lawful basis is a breach of our terms. If you have found a device you did not agree to, see report a tracker. We will investigate, and we will not tell the account holder who made the report.
Consent-based sharing on Locate. If you grant someone else visibility of a tracked pet or item, you are choosing to share that location with them. You can withdraw that access at any time, and doing so stops their access from that point forward.
6. How long we keep it
| Data | Retention |
|---|---|
| Historical telematics and location data | By subscription tier, as set out in clause 7.2 of our Terms of Service |
| Account data | For the life of the account, and up to 12 months after closure |
| Billing and accounting records | 6 years, as required by UK tax law |
| Support and enquiry correspondence | 24 months |
| Incident and accident reports | 6 years, reflecting the limitation period for related claims |
| Website form submissions that do not become accounts | 12 months |
| Misuse reports | 6 years from closing the report, so that we can assist any later police investigation or claim |
Where an account becomes Inactive for non-payment, device data collection stops but existing data is retained under these periods rather than deleted immediately, so that you do not lose your records while a billing issue is resolved.
7. Who we share it with
We use a small number of service providers to run the platform. Each is bound by contract to process data only on our instructions, and none of them may use it for their own purposes.
| What they do for us | Data involved |
|---|---|
| Website hosting and contact form delivery — Netlify, Inc. | Website visit logs and anything you submit through a form on excubia.uk |
| Platform hosting and infrastructure (UK) | All platform data, including location data |
| Email and text message delivery, for sign-in codes, alerts and account messages | Your email address or phone number, and the content of the message |
| Mobile network connectivity for tracking devices | SIM and device identifiers, and network connection data |
| Vehicle registration lookups | Vehicle registration numbers, on Fleet accounts |
| AI-generated reports on Fleet Enhanced and Platinum, when a customer uses them — Anthropic, PBC (United States) | The fleet data needed to answer the customer's question, such as trips, vehicles and alerts |
| Payment processing | Billing details and payment records. Card details go directly to the payment provider |
A current list of the named providers we use is available on request from support@excubia.uk.
We may also disclose data to professional advisers, to our insurers where needed to deal with a claim, to a purchaser in connection with a sale of the business, or where required by law. We never sell personal data.
8. Where it is stored
Excubia runs its own servers in the United Kingdom, and your platform data, including all location data, is stored there. Some service providers, including our website host and our AI report provider, are based outside the UK. Where personal data is processed outside the UK, we make sure an appropriate safeguard is in place, such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
9. Security
We use encryption in transit, access controls limiting who can see customer data, logging of administrative access, and regular patching of our systems. We monitor our own device fleet for unexpected behaviour. If you find a security weakness in our website, platform or devices, our security page explains how to tell us.
No system is completely secure. Keep your credentials confidential, and tell us promptly if you believe an account has been accessed without authorisation. If a personal data breach occurs that is likely to result in a risk to people's rights, we will notify the ICO within 72 hours and tell affected people without undue delay where required.
10. Your rights
Under UK data protection law you have the right to:
- Ask what personal data we hold about you, and get a copy
- Have inaccurate data corrected
- Ask for data to be deleted, where we have no overriding reason to keep it
- Ask us to restrict how we use it while a concern is resolved
- Object to processing based on legitimate interests
- Receive your data in a portable format
- Withdraw consent, where consent is the basis we rely on
Email support@excubia.uk and we will respond within one month. There is no charge. We may ask you to confirm your identity first, so that we do not hand your data to someone else.
11. If you are a driver or employee
If your employer tracks a vehicle you drive, they are the controller of that data and they decide why it is collected. They are responsible for telling you what is tracked, when, and why — including whether tracking continues outside working hours.
You can exercise your rights against your employer directly. If you contact us instead, we will help where we can, but for most requests we are required to refer you to them.
12. Cookies
This website sets no cookies. It uses only what is necessary to serve the pages and to deliver our contact forms. We do not use advertising or tracking cookies, and we do not share website visitor data with advertising networks. Pages load the Manrope typeface from Google Fonts, which means your browser requests it from Google and Google receives your IP address as part of that request.
The Excubia platform itself uses cookies necessary to keep you signed in and to remember your settings. These are essential to the service and cannot be switched off without preventing sign-in.
13. Children
Our service is not directed at children, and we do not knowingly create accounts for anyone under 18. If you believe a child's personal data has been provided to us, contact us and we will delete it.
14. Changes to this policy
We may update this policy. If we make a material change to how we use personal data, we will tell account holders by email or in-app notice before it takes effect. The version number and effective date at the top of this page always show the current version.
15. Contact and complaints
Excubia Ltd
The Wesley Centre, Blyth Road, Maltby, Rotherham, S66 8JD
Company Number 16522916
ICO registration ZC239310
support@excubia.uk
01709 278468
If you are unhappy with how we have handled your data, tell us first — most things are quicker to fix directly. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline on 0303 123 1113.