Privacy Notice — GarageVo

1. Data Controller & Processor Roles

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, data responsibilities are divided based on how you interact with our platform:

When GarageVo is the Data Controller:

We act as the Data Controller for your user account registrations (both workshop operators and motorists), platform billing, direct marketplace directory searches, and security telemetry.

When GarageVo is the Data Processor:

When you book directly with an independent garage via their branded workshop site or booking widget, the garage operator is the Data Controller. We act as their Data Processor to record and transmit your service request.

2. Information We Collect & Data Minimisation

We strictly adhere to the principle of data minimisation. We only collect the specific details necessary to book automotive servicing, communicate workshop updates, and maintain platform security.

Motorist Booking Information: Full name, telephone number, email address, vehicle registration mark (VRN), requested workshop service, appointment date and time, and any vehicle notes you supply.
Vehicle Specification Data: Vehicle make, model, fuel type, transmission, and MOT expiry date retrieved via official DVLA / DVSA vehicle enquiry services.
Workshop Operator Information: Trading business name, registered garage address, contact telephone, contact email, opening hours, service catalogue, and VAT registration number.
Security & Technical Telemetry: Anonymized or hashed IP addresses, timestamp logs, and cryptographically verified challenge tokens to prevent brute-force attacks and bot spam.

What We Never Collect: GarageVo does not collect dates of birth, biometric data, sensitive personal categories, or payment card numbers (all bookings operate on a pay-at-workshop basis unless otherwise explicitly agreed with the workshop).

3. Legal Bases for Processing (UK GDPR Art. 6)

Processing Activity	Legal Basis (UK GDPR)
Processing and confirming garage service appointments	Article 6(1)(b) — Performance of a Contract / Pre-contractual steps
Sending operational booking confirmations & SMS/email status alerts	Article 6(1)(b) — Performance of a Contract
Preventing fraudulent bookings, DDoS attacks & rate limit enforcement	Article 6(1)(f) — Legitimate Interests
Maintaining statutory accounting & tax records (HMRC)	Article 6(1)(c) — Compliance with Legal Obligation
Optional service reminders or marketing updates	Article 6(1)(a) — Explicit Consent (Freely withdrawable)

4. Data Retention Periods

We store personal information only for as long as necessary to fulfill the operational and statutory purposes outlined above:

Completed Service Bookings: Retained for 6 years from appointment completion in accordance with the UK Limitation Act 1980 for legal and warranty record-keeping.
Uncompleted / Cancelled Booking Inquiries: Securely purged after 90 days.
Security Audit Logs & IP Telemetry: Retained for a maximum rolling window of 12 months for fraud monitoring and threat mitigation.
User Accounts: Retained while your account remains active; deleted within 30 days upon verified account closure request.

5. Third-Party Sub-Processors & Data Sovereignty

Your data is stored and processed with robust technical safeguards. All data transmission uses TLS 1.3 encryption, and database storage is encrypted at rest using AES-256. Our vetted sub-processors include:

Database & Authentication Infrastructure: Supabase Inc. (Hosted in UK / EU AWS data centres, compliant with UK International Data Transfer Agreements).
Transactional Email Delivery: Resend / AWS SES (used exclusively for operational dispatch of booking confirmations and password resets).
Government Vehicle Registers: DVLA / DVSA official API endpoints for verification of vehicle specifications and MOT status.

6. Your Rights Under UK GDPR

As a data subject in the United Kingdom, you possess clear statutory rights regarding your personal data:

Right to Access: Request a copy of the personal information held about you (Subject Access Request).

Right to Rectification: Ask us to correct inaccurate or incomplete vehicle and contact records.

Right to Erasure: Request deletion of your data when retention is no longer legally necessary.

Right to Restrict or Object: Object to processing based on legitimate interests or request processing restriction.

To exercise any of these rights, please email our Data Protection Officer at: hello@garagevo.co.uk.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or via telephone on 0303 123 1113.

7. Cookies & Tracking Technologies

We strictly limit the use of cookies. We do not set third-party marketing or tracking cookies without your prior, explicit consent. Please review our full Cookie Policy for details on essential cookies and preference controls.