If you have only joined the waiting list, sections 3–5 and 12–16 apply to you. The rest applies once you begin using the GarageCloud application.
Contents
1. Who we are
GarageCloud ("GarageCloud", "we", "us") provides workshop management software to garages, MOT centres, mobile technicians, vehicle service businesses and fleet operators in the United Kingdom.
For the purposes of UK data protection law, our details are:
Jedox Group Limited
11 Muir Place, Houstoun Industrial Estate, Livingston, Scotland, EH54 5BF
Company number: SC696315
ICO registration number: ZC071964
Email: privacy@garagecloud.co
General enquiries: hello@garagecloud.co
2. Controller and processor roles
GarageCloud acts in two different capacities depending on the data involved.
We are the controller for
- Account and billing data belonging to businesses that subscribe to GarageCloud
- Data about individual users of our application — names, email addresses, roles, login records
- Website visitor data and support correspondence
We are the processor for
- Data our customers enter about their own customers, vehicles, jobs, invoices and communications
Where a garage uses GarageCloud to store information about a member of the public, that garage is the data controller and GarageCloud is the processor acting on its documented instructions. If you are a customer of a garage and wish to exercise your rights over that data, please contact the garage directly. We will assist them in responding.
3. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account data | Business name, trading address, VAT number, contact name, email address, telephone number, password (stored hashed) | You, at sign-up |
| User data | Staff names, work email addresses, assigned roles and permissions, login timestamps, IP address at login | You or your administrator |
| Billing data | Subscription plan, active modules, billing address, invoice history, partial card details (last four digits and expiry only) | You and our payment processor |
| Workshop content | Your customer records, vehicle records, registrations, job cards, inspection results, photographs, video, estimates, invoices and messages | Entered by you |
| Vehicle data | Make, model, year, fuel type, colour, MOT status and MOT history, retrieved by registration mark | DVSA and DVLA public APIs |
| Connected service data | Data you authorise us to access from third-party accounts you connect — see sections 6 and 7 | The service, with your consent |
| Technical data | IP address, browser type and version, device type, operating system, pages viewed, timestamps, error diagnostics | Collected automatically |
| Support data | Correspondence with our support team, including any attachments you send | You |
We do not deliberately collect special category data. Please do not enter health information, or any other special category data, into free-text fields.
4. How we use data
- To provide, operate and maintain the GarageCloud application
- To authenticate users and control access to your workspace
- To process subscription payments and issue invoices
- To deliver features you have enabled, including sending communications to your customers on your behalf
- To retrieve vehicle and MOT information when you enter a registration mark
- To provide technical support and respond to your enquiries
- To monitor performance, diagnose faults and improve reliability
- To detect, investigate and prevent fraud, abuse and security incidents
- To comply with our legal and regulatory obligations
- To send service messages about outages, billing and material changes to the service
We do not sell personal data. We do not use your workshop content, or data from any connected account, to train machine learning or artificial intelligence models.
5. Lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the service under our agreement with you | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract |
| Security, fraud prevention and service improvement | Legitimate interests — operating a secure and reliable service |
| Accessing a connected third-party account | Consent, which you may withdraw at any time |
| Marketing emails to prospective customers | Consent, or legitimate interests where permitted for existing business customers |
| Retaining financial records | Legal obligation |
6. Google user data
GarageCloud offers optional integrations with Google services. These are entirely optional. If you do not connect a Google account, none of this section applies to you.
6.1 What we request and why
| Scope requested | Why we need it |
|---|---|
userinfo.emailuserinfo.profile | To identify which Google account has been connected and display it in your settings, so you can confirm you have linked the right one. |
gmail.send | To send job updates, inspection reports, estimates and invoices to your customers from your own business email address, so that replies come back to you rather than to us. This scope permits sending only. It does not permit reading your mailbox. |
calendar.events | Only if you enable calendar sync. To create, update and remove GarageCloud bookings in a calendar you nominate, so your workshop diary matches your Google Calendar. |
We request the narrowest scopes that allow each feature to work. If you enable only some features, we request only the scopes those features require.
6.2 How we store and handle it
- OAuth access and refresh tokens are encrypted at rest and are used solely to perform actions you have configured.
- We store a record of messages sent on your behalf — recipient, subject, timestamp and delivery status — so you have an audit trail against the relevant job or invoice.
- Where calendar sync is enabled, we store the event identifiers needed to keep bookings in step.
- We do not download, index or retain the contents of your mailbox.
6.3 Limited Use disclosure
GarageCloud's use and transfer of information received from Google APIs to any other app will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.
Specifically, we confirm that we:
- do not use Google user data for serving advertisements;
- do not sell Google user data;
- do not transfer Google user data to third parties except as necessary to provide or improve the features you have enabled, to comply with applicable law, or as part of a merger or acquisition;
- do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models;
- do not allow humans to read Google user data unless we have your explicit consent for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised.
6.4 Revoking access
You may disconnect a Google account at any time from Settings → Integrations within GarageCloud. You may also revoke access directly atmyaccount.google.com/permissions.
When access is revoked, we delete the stored OAuth tokens within 30 days. Records of messages already sent are retained as part of your business records, as described in section 10.
7. Third-party services
GarageCloud can connect to services you already use. In each case you sign in to that provider directly and hold your own agreement with them. We recommend reading their privacy policies.
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe, PayPal, Square, SumUp, Klarna | Payment processing | Transaction amounts, references, payment status. Full card details are handled by the provider and never reach our servers. |
| Xero, QuickBooks, Sage, FreeAgent | Accounting and VAT | Invoices, credit notes, contact records, payment status |
| Google, Microsoft 365, other SMTP providers | Sending email | Recipient address, subject, message content, delivery status |
| Twilio | SMS messaging | Mobile number, message content, delivery status |
| GoHighLevel | Online booking and CRM | Booking details, contact records |
| What3Words | Locating mobile jobs | Three-word address, approximate coordinates |
| DVSA and DVLA | Vehicle and MOT lookup | Vehicle registration mark submitted; vehicle and MOT data returned |
We also use the following providers to run the service itself:
- Cloud hosting and storage — AWS, United Kingdom / European Economic Area
- Error monitoring and application logging — AWS
- Subscription billing — Stripe
8. Sharing and disclosure
We share personal data only in these circumstances:
- With service providers listed above, acting as our processors under written contract
- With services you connect, limited to what those features require
- Where the law requires it — for example in response to a valid court order or regulatory demand
- To protect rights and safety — where necessary to investigate fraud, abuse or a security incident
- In a corporate transaction — if GarageCloud is involved in a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy
We do not sell personal data, and we do not share it with advertisers or data brokers.
9. International transfers
Our primary hosting is in the United Kingdom or the European Economic Area. Some providers listed in section 7 operate outside the UK. Where personal data is transferred outside the UK, we rely on one of the following safeguards:
- UK adequacy regulations for the destination country
- The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
- The UK Extension to the EU–US Data Privacy Framework, where the recipient is certified
You may request a copy of the relevant safeguard by contacting us.
10. Retention
| Data | Retention period |
|---|---|
| Account and workshop content | For the life of your subscription, then 90 days after termination, after which it is permanently deleted |
| Invoices and financial records | 6 years from the end of the relevant financial year, to meet HMRC requirements |
| Inspection photographs and video | Configurable per workspace. Default 12 months, then deleted |
| OAuth tokens for connected accounts | Until you disconnect, then deleted within 30 days |
| Security and access logs | 12 months |
| Support correspondence | 24 months from the last contact |
| Backups | Rolling 35 days, after which deleted data is unrecoverable |
You may request earlier deletion at any time. Where we are required by law to keep certain records, we will tell you which data we must retain and why.
11. Security
- All traffic is encrypted in transit using TLS 1.2 or above
- Data is encrypted at rest, including OAuth tokens and uploaded media
- Passwords are stored using a one-way hashing algorithm and are never recoverable in plain text
- Each workspace is logically isolated so no customer can access another customer's data
- Access to production systems is restricted, logged and reviewed
- Two-factor authentication is available on all accounts and we recommend enabling it
- Backups are encrypted and restoration is tested periodically
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours and inform affected parties where the law requires it.
12. Your rights
Under the UK GDPR you have the right to:
- Be informed about how your data is used — this policy
- Access a copy of the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data, where we have no overriding obligation to keep it
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent where processing relies on it
To exercise any of these, email privacy@garagecloud.co. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are a customer of a garage that uses GarageCloud and want to access or delete records the garage holds about you, please contact the garage directly. They control that data; we process it on their behalf and will support them in responding to you.
You also have the right to complain to the Information Commissioner's Office atico.org.uk or on 0303 123 1113. We would appreciate the chance to address your concerns first.
13. Cookies
We use a small number of cookies:
| Type | Purpose | Consent |
|---|---|---|
| Strictly necessary | Keeping you signed in, maintaining your session, security and load balancing | Not required |
| Preference | Remembering settings such as light or dark mode | Not required |
| Analytics | Understanding which pages are used, so we can improve the product | Required |
You can manage your choices at any time through the cookie banner or in your browser settings. Blocking strictly necessary cookies will prevent the application from working.
14. Children
GarageCloud is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. The version number and date at the top will change. If the changes are material — for example a new category of data, a new purpose, or a change to how connected account data is handled — we will notify account holders by email at least 30 days before the change takes effect.
Previous versions are available on request.
16. Contact
Data protection enquiries
Email: privacy@garagecloud.co
Post
Jedox Group Limited, 11 Muir Place, Houstoun Industrial Estate, Livingston, Scotland, EH54 5BF
General support
Email: hello@garagecloud.co