Privacy
Draft policy for pilot and local demo use. This page must be reviewed by a qualified legal adviser before production launch.
Last updated: 18 July 2026
This privacy policy explains how EMSHI expects to handle personal data when an organisation uses the service to let people request that a vehicle is moved. It is written for requesters, responsible contacts, organisation administrators, and pilot customers.
Who is responsible for the data
The legal entity operating EMSHI will be named here before launch. For now, pilot enquiries and privacy requests should be sent through the contact page. If an organisation provides EMSHI to its staff, tenants, or visitors, that organisation may also be a controller for the data it enters and manages.
Data we expect to process
For requesters, EMSHI may process the QR token scanned, approximate technical information needed to run the service, verification status for the browser session, request status, and any phone number used for requester verification.
For responsible contacts and administrators, EMSHI may process names, phone numbers, account email addresses, organisation details, billing contact details, vehicle registrations, optional vehicle make/model/colour, location names, QR issue history, notification metadata, and audit records.
We do not intend to show requester identity to responsible contacts unless a feature explicitly says so, and requesters should not see contact names, phone numbers, email addresses, or group membership.
Why we use data
We use data to operate vehicle movement requests, verify requester control of a phone number where required, notify responsible contacts, prevent abuse, support administrators, generate QR stickers, keep audit records, and maintain the security of the service.
Where analytics or optional marketing tools are added, they must stay off until the required consent has been collected. Analytics events must not include vehicle registrations, phone numbers, or other unnecessary personal data.
Who we share data with
We expect to use service providers for hosting, database storage, notification delivery, email, payments, CAPTCHA, consent management, and analytics. These providers should only process data under contract and only for the purposes needed to provide EMSHI. We may disclose information where required by law or to protect the service and its users.
How long we keep data
Retention periods will be finalised before production. The service should keep operational records only for as long as needed for vehicle movement history, abuse prevention, support, billing, audit, legal compliance, and security. Import files and unnecessary raw notification data should not be kept indefinitely.
Your rights
Depending on where you are, you may have rights to access, correct, delete, restrict, export, or object to the use of your personal data. You may also have the right to complain to your local data protection authority, such as the UK Information Commissioner's Office.
Contact
Use the contact page for privacy questions, access requests, or deletion requests during the pilot. A dedicated privacy email and legal entity details must be added before launch.