Privacy Policy

1. Who We Are

This website, cargarages.co.uk, is operated by CAR GARAGES DIRECTORY LTD, a company registered in England and Wales under company number 17377200, trading as CarGarages.co.uk ("we", "us", "our"). We are the data controller for the personal data processed through this website. Our postal address is given in section 2 of our Terms of Service, and you can reach us any time through our contact page.

2. What Data We Collect

We collect different types of personal data depending on how you use the website:

Account Data

When you register an account, we collect your email address and store a secure hash of your password. We also record your user type (car owner or business owner).

Business Owner Data

If you claim or add a business listing, we collect information you provide including your name, role, business details, contact information, and any gallery images you upload.

Vehicle Data

If you use our MOT reminder service, we collect your vehicle registration number, make, model, and MOT/tax/insurance expiry dates. This data is used solely to send you timely reminders.

Job and Quote Data

If you post a job to get quotes, we collect the details you give us: your vehicle, a description of the work needed, your postcode and the approximate location of the work, your name and phone number, any photos you attach, and the messages you exchange with a garage. Your name and phone number are not shown to garages while they are quoting — see section 7 below for exactly when and to whom they are released.

Payment Data

Where you pay us for anything, we store transaction IDs, amounts, and what the payment was for. We do not store your credit or debit card details. All card processing is handled securely by our payment providers (Stripe and PayPal).

Usage Data

We collect anonymised usage data including garage page views, click-through actions, and pages visited. This helps us understand how the website is used and improve it.

Car Problems Data

The Car Problems section of our website uses aggregated, anonymised MOT testing data published by the DVSA under the Open Government Licence v3.0. This data does not contain any personal information — it consists of statistical summaries about vehicle makes, models, and common faults. No personal data is collected from you when you browse Car Problems pages.

3. How We Use Your Data & Lawful Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out each purpose and the legal basis we rely on:

Where we rely on legitimate interest, we have assessed that the processing is necessary for our purposes and that your rights and interests do not override those purposes. You have the right to object to processing based on legitimate interest at any time.

4. Email Tracking

Some of our emails include a small invisible image (a tracking pixel) that tells us whether the email was opened, and links that let us know if they were clicked. We use this data to measure the effectiveness of our communications and to improve future emails. You can prevent open tracking by disabling image loading in your email client.

5. Cookies & Local Storage

We use a limited number of cookies and browser local storage entries:

• Authentication cookies (essential) — these keep you signed in and are required for the site to function. No consent is needed for essential cookies under UK GDPR.
• Analytics cookies (Google Analytics) — these help us understand traffic patterns and improve the site. They are only set if you accept cookies via the banner shown on your first visit.
• Local storage — we store recently viewed garages in your browser's local storage for convenience. This data never leaves your device.

For full details, see our Cookie Policy.

6. Third-Party Services

We share data with the following third-party services as necessary to operate the website:

• Cloud database & authentication provider — stores your account data and manages sign-in sessions. Data is hosted in the EU.
• Stripe & PayPal — payment processing for premium listings. Your card details are handled directly by these providers and are never stored on our servers.
• Email delivery provider — used to send transactional emails (e.g. MOT reminders, account notifications) and marketing campaigns.
• Geolocation service — your IP address is used to determine your approximate location so we can show garages near you. Your IP address is not stored by us.
• Postcode lookup service — used for location-based searches. No personal data is shared.
• Google — used to source business data and reviews displayed on garage listings.
• DVSA — the Driver and Vehicle Standards Agency's public API is used to look up vehicle MOT history for our MOT reminder service. We also use DVSA bulk MOT testing data (published under the Open Government Licence v3.0) to power our Car Problems feature. This bulk data is anonymised and contains no personal information.

7. Sharing Your Data With Garages

This section applies when you post a job to get quotes. It is the only situation in which we pass your personal data to a garage, and it happens in two stages.

Stage 1 — while garages are quoting

Garages near the location you gave are invited to quote. A garage that opens your job sees the work required, your vehicle details, the general area, and any photos you attached. It does not see your name, your phone number, your email address, or your full address.

Stage 2 — when you accept a quote

When you accept a quote, we release your name and phone number to that garage only, so they can contact you to arrange the work. They are not released to any garage whose quote you did not accept, and not at any earlier point. This is how the service puts you in touch with the garage you chose, and it is the reason we ask for a phone number.

Once released, that garage is an independent data controller of your details — not our processor. They are responsible for how they handle your information and for their own obligations under UK data protection law. Under our Terms of Service they may use your details only to carry out and arrange the job you accepted, and not for marketing. If a garage misuses your details, please tell us — we can act against their listing, though you may also raise it with the ICO.

Photos. Photos you attach to a job are stored privately and are visible only to garages that have opened your job, and to us. They are never public and are not used for marketing. Please avoid including images that show other people, documents, or anything you would not want a garage to see.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services to you. Specifically:

• Account data: retained until you delete your account or request erasure.
• Vehicle data: retained while your MOT reminder is active. You can delete vehicles from your dashboard at any time.
• Jobs, quotes, photos and messages: retained while your account is active, so that you and the garage both keep a record of what was agreed. You can ask us to delete a job at any time.
• Payment records: retained for 7 years to comply with UK tax and accounting regulations.
• Usage and analytics data: retained in anonymised form indefinitely.
• Contact form messages: retained for up to 2 years.

9. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom. Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place:

• European Union: Our cloud database is hosted in the EU, which the UK Government has recognised as providing adequate data protection.
• United States: Some service providers (including our payment processors) may process data in the US. These transfers are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) or the provider's participation in recognised data protection frameworks.

10. Data Security

We take the security of your personal data seriously. We use industry-standard measures to protect your information, including encrypted connections (HTTPS) across the entire website, securely hashed passwords (your password is never stored in plain text), access controls restricting who can view personal data, and regular review of our security practices. While no method of transmission over the internet is completely secure, we take reasonable steps to protect your personal data from unauthorised access, alteration, or destruction.

11. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

12. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your personal data ("right to be forgotten").
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us via our contact page. We will respond to your request within one month.

Right to complain: If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

13. Marketing & Unsubscribe

We will only send you marketing emails if you have given us explicit consent or if you are an existing customer and the emails relate to similar services. Every marketing email we send includes an unsubscribe link at the bottom.

You can also unsubscribe at any time by contacting us. Please note that unsubscribing from marketing emails will not affect transactional emails (such as MOT reminders or account notifications).

14. Children

Our website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

15. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this page periodically for the latest information on our privacy practices.

16. Contact for Data Requests

For any data protection enquiries, subject access requests, or to exercise your rights under UK GDPR, please use our contact form and select "General Enquiry" as the subject. We aim to respond to all data requests within one calendar month.