# Data Protection Information for Winter Maintenance Staff

## 1. Controller

**[Company name]**
[Address]
Email: [Email]

## 2. Purpose of processing

In the course of your work in winter maintenance, the following personal data is collected and processed:

- **GPS location data** during operational hours, to document the gritting and snow-clearance services performed
- **Operational times** (start and end) for working-time records
- **Vehicle assignment** to enable traceability of the vehicles used
- **Photographs and notes** as evidence of the work carried out

## 3. Legal basis

Processing is carried out on the basis of **Article 6(1)(f) UK GDPR / EU GDPR** (legitimate interests). The legitimate interest of the employer lies in fulfilling the duty to maintain safe traffic conditions and in providing evidence that winter maintenance operations have been carried out properly.

## 4. Collection of GPS data

GPS data is collected via the **OwnTracks** app installed on your work device. Location data is recorded only during active operational hours and transmitted to the employer's server. The app does not track you outside of recorded shifts.

## 5. Retention period

The data collected is retained for the duration of statutory retention obligations (typically three years, in line with limitation periods for traffic-safety liability claims). After this period the data is deleted or anonymised.

## 6. Your rights

Under the UK GDPR / EU GDPR you have the following rights:

- **Right of access** (Article 15): you may request information about the personal data we hold about you.
- **Right to rectification** (Article 16): you may request correction of inaccurate data.
- **Right to erasure** (Article 17): you may request deletion of your data, subject to overriding legal retention obligations.
- **Right to restriction of processing** (Article 18)
- **Right to data portability** (Article 20)
- **Right to object** (Article 21)
- **Right to lodge a complaint** with the competent supervisory authority (ICO in the UK; the national DPA in other jurisdictions).

## 7. Contact for data protection enquiries

For any questions regarding data protection please contact:

**[Data Protection Officer / Contact]**
Email: [DPO email]

---

*This is a template — review and adapt the wording to your organisation and jurisdiction before publishing to staff.*
