Privacy Policy

We collect personal data when you use our website, contact us, or bring your vehicle to our premises. The categories of data we collect include:

Information You Provide

• Contact and booking details: your name, phone number, email address, and any message or service request you provide via our website forms or by phone.
• Vehicle information: vehicle registration number (VRN), make, model, year, mileage, and VIN where required for parts ordering or diagnostics.
• Service and repair records: details of work carried out, MOT test results (pass, fail, advisories), diagnostic fault codes, and parts fitted.
• Payment information: we process card payments at our premises but do not store your full card details. Payment is handled by our card terminal provider.

Information Collected Automatically

• CCTV footage: our premises are monitored by CCTV for security and crime prevention. Footage may include images of individuals and vehicle registration plates entering or leaving the site.
• Website analytics: with your consent, we collect anonymised data about how you use our website (pages visited, time on site, device type) via Google Analytics 4.
• Cookies: essential cookies for website functionality, plus analytics and marketing cookies with your explicit consent. See the Cookies section below for full details.

We only process your personal data when we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). The table below sets out our purposes and the corresponding lawful basis:

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your rights. You can request details of these assessments by contacting us.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data with the following categories of recipients, only as necessary for the purposes described above:

• Driver and Vehicle Standards Agency (DVSA): MOT test results are submitted electronically to the DVSA as a legal requirement.
• Parts suppliers: vehicle details (make, model, VRN) may be shared with parts suppliers to order correct components for your repair.
• Payment processor: your card payment is processed securely by our card terminal provider.
• Website hosting (Hetzner Online GmbH): our website is hosted on servers in Germany. Hetzner acts as a data processor under a data processing agreement.
• Email delivery (Resend): booking confirmations and notifications are delivered via Resend, a US-based email service provider.
• Google (Google Analytics 4 and Google Tag Manager): with your consent, anonymised website usage data is processed by Google.
• Meta Platforms (Facebook Pixel): with your consent, marketing measurement data is processed by Meta.
• Professional advisors: our accountant and, where necessary, legal advisors may access records containing personal data for the purposes of providing professional services to us.
• Subcontractors: in rare cases where specialist work is subcontracted at your request, relevant vehicle details will be shared with the specialist provider. We will inform you before any such sharing occurs.

Some of our third-party service providers are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• Google (US): Google is certified under the UK Extension to the EU-US Data Privacy Framework, providing an adequate level of data protection.
• Meta Platforms (US): Meta is certified under the UK Extension to the EU-US Data Privacy Framework.
• Resend (US): transfers are covered by Standard Contractual Clauses (SCCs) approved by the ICO.
• Hetzner (Germany): the UK recognises the EU/EEA as providing adequate data protection. No additional safeguards are required.

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Our retention periods are:

After the retention period expires, data is securely deleted or anonymised. You can request earlier deletion at any time (subject to legal obligations that require us to retain certain records).

Under UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your personal data (right to be forgotten), subject to legal retention requirements.
• Restriction: ask us to limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
• Data portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Withdraw consent: where we process data based on your consent (e.g. analytics cookies), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• Not be subject to automated decision-making: we do not make any decisions about you based solely on automated processing.

To exercise any of these rights, contact us at info@bedlingtonmot.co.uk or write to us at 70 Glebe Rd, Bedlington, NE22 6JU. We will respond within one calendar month of receiving your request.

If you believe we have not handled your personal data correctly, you have the right to complain directly to us. To make a data protection complaint:

1. Contact us at info@bedlingtonmot.co.uk with details of your concern.
2. We will acknowledge your complaint within 30 days.
3. We will investigate and provide you with a full response, including any actions taken, within 3 months.

If you remain unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

We take the security of your personal data seriously. Measures we have in place include:

• Our website is encrypted using HTTPS (TLS) for all data in transit.
• Access to customer records is restricted to authorised staff only.
• Electronic records are stored on password-protected, access-controlled systems.
• Paper records containing personal data are stored securely and disposed of by shredding.
• CCTV footage is stored on a secure, on-premises system with automatic 28-day overwrite.

Our use of cookies complies with the Privacy and Electronic Communications Regulations 2003 (PECR) as amended. When you first visit our website, a consent banner asks you to accept or reject non-essential cookies. No analytics or marketing cookies are set until you give explicit, informed consent.

Essential Cookies

Required for the website to function correctly. These cannot be switched off.

Analytics Cookies

Set only with your consent. Used to understand how visitors interact with our website via Google Analytics 4 (delivered through Google Tag Manager).

Marketing Cookies

Set only with your consent. Used to measure the effectiveness of advertising campaigns via Meta (Facebook) Pixel.

Managing Your Preferences

You can change your cookie preferences at any time by clicking Cookie Settings in our website footer. You can also clear your browser cookies and revisit the site to see the consent banner again. We retain a record of your consent choice as evidence of valid consent under PECR.

Our website and services are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page will be revised accordingly. For significant changes that materially affect how we use your data, we will take reasonable steps to notify you (for example, by placing a prominent notice on our website).