1. Introduction
This Privacy Policy explains how Torq'd Ltd ("we", "us", "our") collects, uses, stores and protects personal data when you use our garage management software platform ("the Service"). We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Torq'd Ltd is the data controller for information collected through our website and for account-level data. For garage customer and vehicle data entered by workshop users, the garage operates as data controller and Torq'd acts as data processor (see our Data Processing Agreement for details).
2. Data Controller
Torq'd Ltd
Email: privacy@torqd.uk
Registered in England and Wales.
3. Data We Collect
3.1 Account Data
When you register for Torq'd, we collect:
- Full name and email address
- Workshop/garage business name and address
- Phone number
- Payment information (processed by Stripe; we do not store card numbers)
- Login credentials (passwords are hashed and never stored in plaintext)
3.2 Workshop Operational Data
Data entered by garage users during normal use of the platform:
- Customer names, contact details, and communication preferences
- Vehicle registrations, makes, models, mileage and service history
- Booking and appointment records
- Quotes, invoices and payment records
- Vehicle health check results
- Internal notes and staff assignments
3.3 Technical Data
- IP addresses and browser/device identifiers
- Usage analytics (pages visited, features used, session duration)
- Error logs and performance data
4. Lawful Basis for Processing
We process personal data on the following bases:
- Contract: To provide the Service you have subscribed to, manage your account, and process payments.
- Legitimate interests: To maintain security, prevent fraud, improve our Service, and provide customer support.
- Legal obligation: To comply with UK tax, financial, and regulatory requirements.
- Consent: For optional marketing communications and non-essential cookies (you may withdraw consent at any time).
5. How We Use Your Data
- Providing and maintaining the Torq'd platform
- Processing subscription payments via Stripe
- Delivering transactional emails (account confirmations, password resets, billing notifications)
- Enabling customer messaging workflows (SMS/WhatsApp via Twilio where configured by the garage)
- Providing customer support and resolving technical issues
- Monitoring platform security and preventing abuse
- Generating anonymised usage analytics to improve the Service
6. Data Sharing and Third Parties
We share data only with the following categories of third-party processors:
- Supabase — Database hosting and authentication infrastructure
- Stripe — Payment processing and subscription billing
- Twilio — SMS and WhatsApp message delivery (where configured by the garage)
- Vercel/hosting provider — Application hosting and CDN
We do not sell, rent, or trade personal data to third parties. We do not share data with advertisers.
7. International Transfers
Some of our subprocessors operate infrastructure outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or reliance on adequacy decisions where applicable.
8. Data Retention
- Active accounts: Data is retained for the duration of the subscription.
- Cancelled accounts: Account data is retained for 90 days after cancellation, then permanently deleted.
- Billing records: Retained for 7 years to comply with UK tax and accounting obligations.
- Support tickets: Retained for 2 years after resolution.
- Technical logs: Retained for a maximum of 12 months.
9. Your Rights
Under UK GDPR, you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Request correction of inaccurate data.
- Erasure — Request deletion of your data (subject to legal retention requirements).
- Restriction — Request that we limit processing of your data.
- Portability — Receive your data in a structured, machine-readable format.
- Objection — Object to processing based on legitimate interests or direct marketing.
- Withdraw consent — Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email privacy@torqd.uk. We will respond within 30 days.
10. Data Security
We implement appropriate technical and organisational measures including:
- Encryption in transit (TLS 1.2+) and at rest
- Row-level security and tenant isolation at the database layer
- Principle of least privilege for all system access
- Regular security reviews and dependency updates
- Multi-factor authentication available for all accounts
11. Breach Notification
In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to affected individuals, we will notify them directly without undue delay.
12. Children's Data
Torq'd is a business-to-business service designed for use by workshop professionals aged 18 and over. We do not knowingly collect data from children under 18.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to the account holder and posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance of the revised policy.
14. Complaints
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
15. Contact
For any privacy-related queries, contact:
Torq'd Ltd
Email: privacy@torqd.uk