Who we are

Jamie Mawhinney trades as My Service Record, a UK sole trader. Postal contact details are published in our Terms & Conditions. Contact support@myservicerecord.co.uk. Our website is https://www.myservicerecord.co.uk. This notice describes personal information used to operate our vehicle-history service.

Our operating model is a shared vehicle-history platform. My Service Record is a controller for its independently determined account, access, security and shared vehicle-history purposes. Garages are independent controllers for their servicing/customer activities and lawful submission of records. For private historical-file import handling, a garage instructs My Service Record to import its records and My Service Record acts on those instructions; this processor activity requires the applicable processing terms. My Service Record separately determines retention, correction and permitted shared-platform availability of eligible admitted service-history records as controller. Sharing a platform does not by itself make the parties joint controllers.

Information we collect and where it comes from

You or your garage may supply names, email addresses, garage or branch details, address/postcode, telephone number, staff roles and permissions, account credentials, vehicle registrations and VINs, make/model/year, mileage, service dates and work descriptions, invoice references, MOT results/advisories and reminders. Ownership invitations and claims record identity/contact details, verification information and ownership dates. Assisted imports, support requests and correction requests may contain uploaded files, notes, proposed changes and correspondence. Please do not include unrelated personal or sensitive information in vehicle notes or uploads.

We also obtain vehicle/MOT information from Check Car Details when that integration is enabled, and information from participating garages, authorised staff, previous vehicle-history entries and ownership-transfer participants. Vehicle identifiers can be personal data where linked to a person. We record billing identifiers and subscription status from Stripe; technical information includes IP address, browser/device information, session activity, security events, actions and timestamps. Payment details entered into Stripe-hosted payment screens are processed by Stripe; our integration does not store full card details in the application.

Why we use information and our legal bases

Account and subscription administration, responding to requests and providing a service to an individual account holder: performance of our contract or steps requested before a contract (Article 6(1)(b)). For employees/staff representing a garage, administration normally relies on legitimate interests rather than a contract with that individual.

Operating an accurate, traceable vehicle-history service; verifying access and ownership claims; maintaining corrections and record provenance; preventing misuse; and supporting users: legitimate interests (Article 6(1)(f)). The interests are safe account operation, reliable vehicle records and protection of users and the service. This basis requires an assessment of necessity and the effect on individuals; it does not justify unlimited retention or access.

Tax, accounting and responding to binding legal requirements: legal obligation (Article 6(1)(c)), only where a relevant obligation applies. Optional reminder communications that require consent rely on valid consent (Article 6(1)(a)) and applicable electronic-marketing rules. The software records a garage-entered reminder-consent flag; that flag alone does not prove valid consent. The existing shared-history legitimate-interests assessment records purpose, necessity, balancing and safeguards; the import-processing terms and supplier arrangements described below apply to those activities. This notice is information, not a request for blanket consent.

Who can see vehicle history

The service separates garage, staff, vehicle-owner and administrator access. Staff access depends on assigned permissions. A managing garage can see the customer information needed for its vehicle workflow. An active verified owner can access their linked vehicle history; previous-owner names are masked in the ownership timeline. Authorised garage owners may obtain limited, time-limited read access to another garage’s recorded history after an explicit registration lookup. That shared view suppresses customer contact details, VIN, private notes, invoice references and servicing-garage identity. It does not grant permission to alter another garage’s records.

Vehicle service-history facts may remain associated with a vehicle after a change of owner or garage. The interface limits disclosure of previous-owner personal details. Buyer-report projections exclude owner/contact information, private documents, invoices and servicing-garage identities. Buyer payment/report availability remains subject to separate activation; this notice does not announce a live paid service. Authorised administrators may access information to administer the platform, investigate security/support issues and review corrections. No security control can guarantee that information is never misused.

Providers and other disclosures

Stripe receives account/contact and subscription information needed for garage billing and returns billing identifiers, status and events. Its standard Services Agreement incorporates its DPA and transfer terms; Stripe also acts for its own payment, fraud-prevention and legal purposes (https://stripe.com/gb/privacy). Check Car Details receives vehicle registrations and technical request information for enabled vehicle/MOT lookups; these requests do not require customer contacts or private service-history files. It supplies vehicle information from its own data service; we do not describe all its activities as processing a private database on our instructions. Hosting uses one.com Cloud Server M under standard terms incorporating its processor agreement; its published unmanaged-VPS schedule identifies Envia TEL and Dogado in Germany. We make no guaranteed UK-only or Netherlands-only hosting claim. Google Workspace Business Starter, purchased through Wix, provides email relay and encrypted off-VPS backup storage in Workspace Drive under the business processing terms. Wix administers the subscription and may have administrative access. We encrypt backups before upload and hold the recovery key independently. Older encrypted recovery archives remain restricted in the previous personal Google Drive account at the owner's instruction; they are not covered by the Workspace DPA and no new production backups are directed there. We do not represent those legacy consumer terms as business processor terms.

Application pages request fonts from Google-hosted services, which receive IP address and browser/request information; Google processes that service information under its own privacy terms. The legal pages use system fonts without external assets. We may disclose relevant information where required by law or to establish or defend legal rights, subject to appropriate limits. We do not treat disabled integrations as active recipients.

International processing

Hosting and supplier access can involve processing outside the UK. The one.com unmanaged-VPS schedule identifies German providers; transfers to the EEA can rely on UK adequacy regulations where applicable. Google Workspace and Stripe may process data internationally, including in the United States, under their business terms and published subprocessor arrangements. Their data-processing terms provide contractual transfer mechanisms, including applicable UK provisions, where a restricted transfer requires them. These are not UK-only storage services. Google-hosted fonts and the legacy personal Drive account are governed by Google's consumer privacy arrangements, not the Workspace DPA. We do not claim a separately verified API transfer mechanism for Check Car Details. Ask support@myservicerecord.co.uk for information about the safeguards relevant to your data or a copy where available. Supplier information: https://www.one.com/en-gb/legal/dpa/ ; https://cloud.google.com/terms/data-processing-addendum ; https://workspace.google.com/terms/subprocessors.html ; https://stripe.com/gb/legal/dpa ; https://policies.google.com/privacy .

Emails and reminders

At launch we support factual service reminders, MOT reminders and essential operational/account messages, including verification, security, ownership invitations and necessary billing notices. Promotional garage messages, special offers, advertising and lapsed-customer or customer-retention campaigns are not available at launch. Future promotional messaging would require a separately reviewed release and applicable permissions, suppression and unsubscribe controls; no such permission is inferred from Terms acceptance or reminder preferences.

Garages determine which of their customers should receive their factual vehicle reminders, subject to available records, authority and preferences; My Service Record provides the reminder processing/delivery on their instructions, separately from its controller use of eligible shared history. A purely factual reminder must not contain offers, booking solicitations or other promotional material. Calling a message a reminder does not remove UK GDPR or PECR requirements if its actual content or purpose is marketing. Imported or shared history does not itself establish permission to contact a person.

You can stop optional reminders through your garage or support@myservicerecord.co.uk. Essential security/account messages may still be necessary. The existing reminder preference records a garage action and time; it is not a marketing-consent record. Requests to stop reminders must be applied before subsequent delivery. Historical queues remain held unless separately released under their existing safety controls.

Cookies, local storage and automated processing

We minimise tracking. Genuinely necessary cookies/storage can support requested sign-in, request security and essential operation. Nonessential technologies require consent where the law requires it; neither this notice nor terms acceptance is blanket permission. We do not use Terms acceptance as cookie consent.

We use an essential session cookie to maintain secure sign-in, with Secure, HttpOnly and SameSite protections. Sessions are subject to expiry and inactivity controls. Our service worker caches an allowlist of same-origin static assets rather than private account/vehicle pages. Google Fonts requests and provider-hosted payment screens are subject to the relevant provider's processing described above.

We do not operate an advertising or analytics integration as part of this launch. Automated rules check access, subscription status, security limits and reminder due dates. We do not use this platform for credit scoring or solely automated decisions producing legal or similarly significant effects. Contact us for human review if an automated access restriction affects you.

Retention, closure and deletion

Our retention approach preserves legitimate service-history facts with the vehicle after account closure or ownership changes, while deleting or anonymising personal information no longer needed. Retention must have appropriate lawful grounds and account for applicable legal duties. A vehicle identifier may remain personal data; calling a record “vehicle history” does not automatically anonymise it or justify keeping all associated information.

Personal account/contact details are retained only as needed while administering the account and any justified closure/support obligations. Ownership links and verification evidence require review when ownership changes or a dispute ends, separating provenance from unnecessary past-owner identity. Correction/audit and security evidence should be limited to what remains necessary for accuracy, abuse investigation, accountability or a specific dispute; billing records to applicable accounting/legal needs. Assisted-import files should be removed or de-identified once the import/support purpose and a justified review period have ended; retaining imported service facts does not require keeping every original file. Automatic backup deletion remains disabled. Independent off-VPS recovery is verified; enabling deletion still requires separate explicit approval. The approved future target is the latest 30 successful UTC backup dates, with separate approval before deletion is enabled; this is not a promise of deletion after 30 calendar days. Backups also require procedures that do not silently reinstate erased personal data. Legal holds must be specific and reviewed. Retention is managed against these purposes, including manual review; we do not promise that every category is automatically deleted.

Disabling or removing a garage does not automatically erase historical service facts or cancel Stripe billing. Contact us to close an account or exercise rights; we assess deletion or anonymisation separately from retaining legitimate history and explain any lawful exception. We do not promise a single fixed deletion period for every category. Source imports, verification evidence, security logs and support material require purpose-based review, including specific legal or dispute needs. Restricted encrypted backup copies may remain until separately authorised retention disposal; a restore must respect recorded erasure requirements rather than silently reinstating erased personal data.

Security and required information

Our security measures include password hashing, restricted sessions and roles, administrative MFA, request-forgery checks, rate limits and audit trails. Certain sensitive material is encrypted and backups are encrypted before off-VPS storage. These measures reduce risk but do not guarantee absolute security, universal encryption or recovery in every incident. Keep credentials private, use authorised accounts and report suspected misuse promptly.

We need account contact and authentication information to create/manage an account, vehicle identifiers to link the requested history, and relevant billing information for a garage subscription. Without necessary information we may be unable to provide that part of the service. Optional profile fields need not all be supplied. Do not provide information you lack authority to share.

Your rights and right to object

Depending on the processing and applicable exceptions, you can request access, correction, erasure, restriction or portability of your information. Where we rely on consent, you can withdraw it at any time. These rights are not all absolute; we will explain any lawful restriction. Contact support@myservicerecord.co.uk or write to the postal address in our Terms & Conditions. We may need proportionate identity verification and will respond within the applicable legal time limit.

RIGHT TO OBJECT: You can object to processing based on legitimate interests because of your particular situation. You can object to direct marketing at any time. Contact us using the details above; we will consider the objection and stop the processing where the law requires it. You can ask for a record correction without needing to accept deletion of the whole vehicle history.

Terms acceptance records

New garage and customer registrations require an affirmative Terms & Conditions choice, recorded with account identity, accepted version/content reference and server time. The Privacy Policy is linked separately and is not a consent checkbox. Existing accounts are not retrospectively marked accepted. Any fresh acceptance or material-change process requires notice and affirmative action. Acceptance evidence is restricted and retained for justified contract/accountability purposes.

Complaints and updates

Please raise concerns with us first so we can investigate; doing so does not restrict your right to complain to the Information Commissioner’s Office. Visit https://ico.org.uk/make-a-complaint/ for the ICO’s current complaint process and contact options. We will identify the version and publication date of this notice and explain material changes where appropriate. This version takes effect when the platform opens publicly on 18 October 2026.