How we handle your information
Privacy notice
Version 2026-08-14 · effective 14 August 2026
Parts of this notice are still being completed.
A dedicated privacy contact address and the details of the company that hosts this website are being arranged. Everything else below describes what happens today. In the meantime you can reach us by telephone or by post, using the details in the first section.
Who we are
AUTOTECH GARAGE LTD (company number 15069152) is the data controller for the personal data described in this notice. That means we decide why it is collected and what happens to it, and we are answerable for it.
Registered office: 23A Hambledon Road, Bournemouth, Dorset, BH6 5PJ.
We trade as AutoTech Garage from 23A Hambledon Road, Bournemouth, Dorset, BH6 5PJ.
To ask us anything about your personal data, or to make any of the requests described further down this page, telephone us on 07935 326377 (Monday to Friday, 08:30–18:00), or write to us at the address above.
We are setting up a dedicated email address for privacy enquiries and this notice will name it once it exists. Until then the telephone number and the postal address are the routes to us, and neither is a lesser one: a request made by either is treated exactly the same way.
We have not appointed a Data Protection Officer. We are not required to — that obligation applies to public authorities and to organisations carrying out large-scale monitoring or large-scale processing of special category data, and a single garage does none of those.
What we collect, and why
Almost everything we hold about you arrives because you asked us to do something with a vehicle. If you send an enquiry through this website we collect your name, your telephone number, and — if you give them — your email address and your vehicle’s registration mark. We also collect the make and model of the vehicle, the kind of work you are asking about, how and when you would prefer to be contacted, and whatever you write in the message box.
We use it to answer you: to tell the garage that your enquiry has arrived, to send you an acknowledgement, and to contact you back to arrange the work you asked about.
Our lawful basis is that the processing is necessary to take steps at your request before entering into a contract with you (Art. 6(1)(b) UK GDPR). Asking a garage to look at your car is a request to be dealt with, and answering it is what the processing consists of. That is why you do not have to agree to marketing in order to send us an enquiry, and why we do not treat an enquiry as permission to send you anything other than a reply to it. Anything else we might want to send you — an offer, a reminder, a newsletter — is separate, and we would ask you first.
The message box is free text and nothing constrains what goes in it. We do not ask for information about your health or your circumstances, and please do not include more than you need to; if you do, we treat it as part of your enquiry and nothing else.
Everything this website does with personal data, in full
The table below is the record we keep of our processing. It is the same record the business uses internally, published rather than summarised.
Account creation and authentication
Create and maintain a user account, verify the email address, sign the user in, and keep the session secure.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- Name; Email address; Password hash; Profile picture; IP address; Browser user-agent; Sign-in timestamps
Payments and subscriptions
Take payment, manage subscriptions, issue invoices and maintain the credit ledger.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- Name; Email address; Billing country and currency; Billing address; Tax identification number; Payment provider customer and subscription ids; Invoice amounts, tax amounts and dates
Service email
Send email the service cannot work without: verification codes, password resets, receipts and security alerts.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- Name; Email address; Message content
Marketing email
Send product news, offers and announcements to people who asked for them.
- Lawful basis
- Consent (Art. 6(1)(a))
- Data involved
- Name; Email address; Send and open status
Contact and support messages
Receive and answer messages sent through the contact form.
- Lawful basis
- Legitimate interests (Art. 6(1)(f))
- Data involved
- Name; Email address; Message content
Why our interest does not override yours: Answering someone who contacted us is what they asked for; the data is what they chose to send; and no reasonable person contacting a company expects their message not to be read. The balance clearly favours processing.
Vehicle enquiries
Receive an enquiry sent through the website about work on a vehicle, tell the garage about it, acknowledge it to the person who sent it, and contact them back to arrange the work they asked for.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- Name; Telephone number; Email address (optional — an enquiry may legitimately carry none); Vehicle registration mark; Vehicle make and model; The kind of work being asked about; Preferred means of reply, and a preferred date to bring the vehicle in; Message content — free text, written by the person themselves; Enquiry reference, and the dates it was received, notified to the garage and acknowledged; Whether it is a booking request or a general enquiry, how far the garage has got with it, and when it was last changed or withdrawn
Arranging a workshop appointment
Arrange for a vehicle to be brought into the workshop: take a request for an appointment made through this website, and — where an online booking service has been configured — hand the visitor over to that service so that they can choose a time in it. The handoff is not enabled in this deployment: it becomes live only when the booking configuration names a destination, and until it does, every appointment is arranged by the garage itself from a request sent through this site or from a telephone call. Whether the operator of that service would act on this business’s instructions or decide for itself what to do with what a visitor enters on its own site has not been established, and this record will say which it is before the handoff is switched on rather than assert one of them now.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- Name; Telephone number; Email address (optional — a booking request may legitimately carry none); Vehicle registration mark; The kind of work the appointment is for; Preferred date to bring the vehicle in, and preferred means of reply; Message content — free text, written by the person themselves; Booking reference, and the dates the request was received, notified to the garage and acknowledged; Nothing further where a visitor chooses to book through an online booking service: what they enter there is entered on that service’s own site and does not come back to this website
File uploads
Store files a user uploads, and serve them back to them.
- Lawful basis
- Performance of a contract (Art. 6(1)(b))
- Data involved
- File contents (whatever the user chose to upload); File name, type and size; Uploader identity
Staff photography on the public website
Publish photographs of the garage and the people who work in it, so that a stranger deciding where to take their vehicle can see the actual premises and the actual staff rather than stock imagery.
- Lawful basis
- Consent (Art. 6(1)(a))
- Data involved
- Photographic image of an identifiable individual; Workplace and role context visible in the frame
Security and audit logging
Record who changed what, detect unauthorised access, and demonstrate accountability.
- Lawful basis
- Legitimate interests (Art. 6(1)(f))
- Data involved
- Actor identity (name and email snapshot); IP address; Browser user-agent; Action, path and outcome
Why our interest does not override yours: Recital 49 recognises network and information security as a legitimate interest, and Art. 5(2) and Art. 32 effectively require the record to exist. It is minimised (no request bodies beyond a redacted summary), retained for a defined period, and pseudonymised when a subject is erased — so the intrusion is bounded and the subject retains a remedy.
Error monitoring and diagnostics
Detect, diagnose and fix faults in the application.
- Lawful basis
- Legitimate interests (Art. 6(1)(f))
- Data involved
- Opaque user id; Page path; Error message and stack trace
Why our interest does not override yours: A service that does not work serves nobody, and the operator cannot fix what it cannot see. Reports are scrubbed of cookies, credentials, query strings and IP addresses before transmission, and the subject can object with one switch. Session replay, which is far more intrusive, is separated out and requires consent instead.
Consent and privacy request records
Record what each person agreed to and when, and track privacy requests to their statutory deadline.
- Lawful basis
- Legal obligation (Art. 6(1)(c))
- Data involved
- Opaque subject key; Consent decisions and timestamps; IP address; Browser user-agent; Email address (for requests)
Website measurement
Count page views and referring sources across the public website, so the operator can tell which pages help customers find the garage and which do not.
- Lawful basis
- Legitimate interests (Art. 6(1)(f))
- Data involved
- Page path; Referring site; Coarse country; Device type
Why our interest does not override yours: A small business cannot improve a website it cannot measure, and the alternative — a consent gate — produces a self-selected sample that answers the question wrongly rather than not at all. The measurement is aggregate: no cookie is set, no browser storage is written and no persistent identifier is created, so nothing collected can be linked to a person across visits or across sites. The visitor can object with a single switch that takes effect immediately, and a Global Privacy Control signal switches it off without being asked. The residual impact on a visitor is that one page view is counted; the benefit is the operator knowing which of nine pages a customer actually used to reach them.
Who sees it
An enquiry sent through this website is stored in this website’s own database and is sent on to the garage internally by email, so that somebody here reads it. A copy of the acknowledgement goes back to you the same way. Nobody outside the business is given your details in order to sell you anything, and we do not sell or otherwise disclose personal data for money or for advertising.
We do not yet have a service provider to name here. This list is maintained on this page and is updated when one is engaged.
One further provider is being arranged — the company that will host this website and its database. We would rather say so than name a company that has not been chosen. This list is maintained on this page and is updated before any such provider handles your data.
How long we keep it
We do not keep personal data for longer than we need it for the purpose it was collected for. The periods below are the periods we work to, measured from the point each one names.
Expired sign-in sessions
- Kept for
- 30 days
- Measured from
- the session expires or is revoked
Expired verification codes
- Kept for
- 7 days
- Measured from
- the code expires
Closed accounts
- Kept for
- For as long as the account exists
- Measured from
- not applicable — the row is anonymised at deletion, not later
Suspended accounts
- Kept for
- For as long as the account exists
- Measured from
- an operator suspends the account
Payment provider webhook events
- Kept for
- 365 days
- Measured from
- the event is received
Invoices
- Kept for
- 2555 days
- Measured from
- the invoice is issued
Refunds and disputes
- Kept for
- 2555 days
- Measured from
- the refund is recorded
Credit notes
- Kept for
- For as long as the account exists
- Measured from
- the credit note is issued
Credit ledger
- Kept for
- 2555 days
- Measured from
- the ledger row is written
Ended subscriptions
- Kept for
- 2555 days
- Measured from
- the subscription is cancelled
Closed reconciliation findings
- Kept for
- 365 days
- Measured from
- the finding is resolved or dismissed
Billing email records
- Kept for
- 730 days
- Measured from
- the notification is recorded
Superseded consent decisions
- Kept for
- 1095 days
- Measured from
- a newer decision replaces it
Deleted contact messages
- Kept for
- 30 days
- Measured from
- an operator deletes the message
Website enquiries
- Kept for
- 730 days
- Measured from
- the enquiry is submitted
Deleted files
- Kept for
- 30 days
- Measured from
- the user deletes the file
Abandoned uploads
- Kept for
- 1 day
- Measured from
- the presigned upload URL is issued
Audit trail
- Kept for
- 730 days
- Measured from
- the event is recorded
Closed data-subject requests
- Kept for
- 1095 days
- Measured from
- the request is resolved
These periods are being confirmed by the business owner, and automatic removal is not switched on yet. Until it is, records past their period are identified and removed by hand, and you can ask us to delete yours at any time using the routes in the section below.
Cookies and similar technologies
This website stores a small amount of information on your device. Some of it is needed for the site to work at all; anything that is not is only stored if you say so.
You can change your mind at any time: select “Privacy choices” at the foot of any page, and the privacy banner opens again with the answers you gave, ready to be changed.
Every item is listed, with what it does and how long it lasts, on our cookies and storage page. We do not use advertising or cross-site tracking technologies, and we honour the Global Privacy Control signal if your browser sends one.
Where this website sends you on to another company’s website — to get directions, for example — anything that company stores on your device is stored by them, on their own site, after you have left ours. It is not in our list and the choices you make here do not reach it; their own notice governs it.
If we ever present something belonging to another company inside a page on this website — a booking system or a map, rather than a link to one — then whatever it stores counts as storage on this site: it goes in the list on our cookies page, and we ask you before it loads.
Your rights
You have the following rights over your personal data. Exercising any of them is free, and we will respond within 30 days.
- Get a copy of my data — A copy of the personal data held about you. (GDPR Art. 15 / CCPA §1798.110)
- Export my data to take elsewhere — A machine-readable copy you can give to another service. The export is JSON. (GDPR Art. 20)
- Delete my account and data — Close the account and erase the personal data held about you. (GDPR Art. 17 / CCPA §1798.105)
- Correct something that is wrong — Ask for inaccurate or incomplete information about you to be corrected. (GDPR Art. 16)
- Pause processing of my data — Ask for your data to be stored but not otherwise used, while a dispute is resolved. (GDPR Art. 18)
- Object to how my data is used — Object to processing based on legitimate interests, or to direct marketing. (GDPR Art. 21)
- Withdraw a consent I gave — Withdraw consent for something you previously agreed to. (GDPR Art. 7(3))
- Ask for a human to review a decision — If a decision about you was made automatically, ask for a person to review it. (GDPR Art. 22)
- Raise a privacy complaint — Tell us you are unhappy with how we handled your data. (GDPR Art. 77)
To make a request, telephone us on 07935 326377 or write to us at 23A Hambledon Road, Bournemouth, Dorset, BH6 5PJ. You do not need an account with us, and you do not have to give a reason. We may ask you something only you would know about your enquiry, so that we do not hand your details to somebody else.
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office (UK). You can do that at any time, and you do not have to come to us first.
Booking online
You can ask us to book a vehicle in through this website, and doing so involves nobody but us. You send the details through our own form, they arrive in this website’s database and by email to the garage, and we contact you to confirm a time. It is handled exactly as described further up this page — the same information, the same lawful basis, the same people reading it. You can also simply telephone us.
What this website does not do is hand you over to an online booking system run by somebody else, where you would pick a slot for yourself in their diary. If we add one, this notice will be updated to say what that means for your personal data — what is collected, who holds it and on what basis — before it is switched on, and its version number will change so that you are asked to look again.
Children
This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.
Changes to this notice
This is version 2026-08-14, effective 14 August 2026. If we materially change what we do with personal data we will publish a new version and ask you to review your privacy choices again — a choice you made under an older version does not carry over to a new one.