Data Protection Policy

German Car Services is committed to protecting and respecting your privacy. This policy sets out how we collect, process, and safeguard your personal data in accordance with UK GDPR and the Data Protection Act 2018.

• We process personal data lawfully, fairly, and transparently
• We collect data only for specified, explicit, and legitimate purposes
• We ensure data is adequate, relevant, and limited to what is necessary
• We keep accurate and up-to-date records
• We retain data only for as long as necessary
• We implement appropriate security measures to protect your data

• Identity Data: name, title
• Contact Data: email address, telephone number, postal address
• Vehicle Data: registration number, make, model, service history
• Transaction Data: payments, invoices, service records
• Technical Data: IP address, browser type (where applicable)
• Marketing and Communications Data: preferences for receiving marketing

We process your personal data for the following purposes:

• To provide vehicle servicing, repairs, and maintenance
• To manage bookings, appointments, and quotations
• To process payments and manage accounts
• To communicate about your vehicle and our services
• To comply with legal and regulatory requirements
• To improve our services and customer experience
• To send marketing communications (with your consent)

We process your personal data under the following legal bases:

• Contract Performance: necessary for fulfilling our service contract with you
• Legal Obligation: required by law (e.g., accounting, tax records)
• Legitimate Interests: for business operations, fraud prevention, and service improvement
• Consent: for marketing communications where required

We may share your personal data with:

• Parts suppliers and manufacturers for warranty claims
• Payment processors for secure transaction handling
• Professional advisers including lawyers and accountants
• HMRC and other regulatory authorities where required by law
• IT service providers for data storage and system maintenance

We retain your personal data for the following periods:

• Service and repair records: 6 years from last service
• Financial records: 7 years (HMRC requirement)
• Marketing consent records: until withdrawn or 3 years of inactivity
• CCTV footage: 30 days (where applicable)

• All personal data is stored securely using industry-standard encryption
• Access to personal data is restricted to authorized personnel only
• We conduct regular security assessments and updates
• Physical security measures protect paper records
• Staff receive regular data protection training
• We have procedures in place to detect and respond to data breaches

Under UK GDPR, you have the following rights:

• Right of Access: request a copy of your personal data
• Right to Rectification: correct inaccurate or incomplete data
• Right to Erasure: request deletion of your data (subject to legal obligations)
• Right to Restriction: limit how we use your data
• Right to Data Portability: receive your data in a structured format
• Right to Object: object to processing based on legitimate interests
• Right to Withdraw Consent: withdraw consent for marketing at any time