PRIVACY POLICY

Last updated: May 2026 — Version 1.1

1. Who We Are

Clean Torque Detailing (“we”, “us”, “our”) is a vehicle detailing business based in the United Kingdom. We are the data controller for the personal information we collect.

For any privacy-related questions, please contact us at: [email protected]

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following:

• Identity data: your full name
• Contact data: email address, phone number
• Vehicle data: make and model of your vehicle
• Transaction data: subscription tier, booking history, appointment details
• Payment data: payment is processed securely by Stripe or GoCardless — we never see or store your full card number or bank account details
• Technical data: IP address, browser type, and access timestamps (collected automatically for security purposes)
• Usage data: pages visited and actions taken on our website, if you have consented to analytics cookies
• Communications data: messages you send us via our contact form or email
• Consent data: records of the consents you have given us (e.g. marketing opt-in, cookie preferences)

3. Why We Collect It — Lawful Basis

UK GDPR requires us to have a lawful basis for processing your personal data. Here is the basis for each type:

4. Who We Share Your Data With

We only share your data with trusted third parties where necessary to deliver our services. We do not sell your data to any third party under any circumstance.

• Stripe — payment processing. They receive billing data necessary to take your payments. Stripe operates under its own Data Processing Agreement (DPA) and complies with UK GDPR. Stripe, Inc. is based in the United States; transfers are protected by Standard Contractual Clauses.
• Email service provider (e.g. SendGrid or Resend) — used to send booking confirmations and transactional emails. Your email address is shared for this purpose only.
• Hosting provider (e.g. Render or Railway) — our website and data are stored on their servers. Where servers are located outside the UK or EEA, transfers are protected by Standard Contractual Clauses or an equivalent adequacy mechanism.
• Google Analytics — only if you have consented to analytics cookies. Data is anonymised (IP anonymisation is enabled). Google LLC operates under a DPA with us.

All third parties are contractually required to keep your data secure and to use it only for the purposes we specify. We do not use any service that transfers data outside the UK/EEA without appropriate safeguards (Standard Contractual Clauses or equivalent).

5. How Long We Keep Your Data

When data reaches the end of its retention period, it is permanently deleted or anonymised so that you can no longer be identified from it.

6. Cookies

We use cookies on our website. A cookie is a small file stored on your device that helps our website remember your preferences and understand how you use the site.

Cookie categories we use

Non-essential cookies are not loaded until you have given your consent. You can change your cookie preferences at any time using the Cookie Settings link in the footer of our website.

Consent is stored in a first-party cookie and is re-requested every 12 months.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, please email us at [email protected]. We will respond within one month (this is the legal deadline).

• Right to Access (Article 15) — You can request a copy of all personal data we hold about you. We will provide this in a readable format, free of charge, within 30 days.
• Right to Erasure / Right to be Forgotten (Article 17) — You can ask us to delete your personal data. We will do so promptly, except where we are required by law to retain certain records (e.g. payment records for 6 years under HMRC rules).
• Right to Rectification (Article 16) — If any of the information we hold about you is inaccurate or incomplete, you can ask us to correct it.
• Right to Restriction (Article 18) — In certain circumstances, you can ask us to temporarily stop processing your data (for example, while you contest its accuracy).
• Right to Data Portability (Article 20) — You can ask us to send you a machine-readable copy of the data you have provided to us (e.g. in JSON or CSV format).
• Right to Object (Article 21) — You can object to us processing your data where we rely on legitimate interest. We will stop unless we can demonstrate compelling grounds.
• Right to Withdraw Consent (Article 7) — Where we process your data based on consent (e.g. marketing emails, analytics cookies), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8. Marketing Emails

We will only send you marketing emails (promotions, offers, newsletter) if you have explicitly opted in by ticking the relevant checkbox on our booking or sign-up form. We will never pre-tick this box for you.

Every marketing email we send includes a clear, one-click unsubscribe link. Clicking it will immediately remove your email address from our marketing list with no further action required on your part. You can also opt out at any time by emailing [email protected]. We will action your request within 10 business days.

Transactional emails (booking confirmations, payment receipts, subscription renewal notices) are sent as part of our contract with you and do not require separate marketing consent. Unsubscribing from marketing emails does not affect these transactional communications.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data in transit
• Passwords stored using bcrypt hashing (never in plain text)
• Admin access protected by multi-factor authentication (TOTP)
• Rate limiting and CSRF protection on all forms
• Access logs retained for 90 days for security monitoring
• Payment card data handled exclusively by PCI-DSS compliant processors (Stripe / GoCardless)

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and inform affected individuals without undue delay, as required by UK GDPR Article 33.

10. Automated Decision-Making

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects about you (as defined in UK GDPR Article 22). Decisions about your bookings, subscriptions, and service delivery are made by our team, not by automated systems acting alone.

11. Children’s Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it without delay.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after a change is posted constitutes acceptance of the updated policy.

13. Contact Us & Complaints

If you have any questions about this privacy policy or how we handle your data, please contact us at:

Clean Torque Detailing
Email: [email protected]

If you are unhappy with how we have handled your data and we have not been able to resolve your concern, you have the right to make a complaint to the UK data protection regulator: