Privacy Policy — RSM Cars

1. Who we are

RSM Cars ("we", "us", "our") is a car repair and servicing business. Our registered address is The New Barn, Eysey, Cirencester, Gloucestershire, SN6 6LP. We are the data controller for personal data collected through this website.

You can contact us about data protection matters at admin@rsmcars.co.uk or by calling 01285 709800.

2. What personal data we collect

2.1 Contact and enquiry data

When you submit our contact form or get in touch directly, we collect:

Your name
Your email address
Your phone number (if provided)
The service you are enquiring about
The content of your message

2.2 Customer portal account data

If you register for or use our Customer Portal, we collect and process:

Your name and email address (used to create your account)
Your account password (stored in hashed form — we never see your plain-text password)
Repair video content we upload on your behalf (title, description, video URL)
Comments and messages you post in the portal
Your session tokens (stored in your browser to keep you logged in)

2.3 Analytics data

With your consent, we use Google Analytics 4 to collect anonymised usage data about how visitors interact with our website. This may include pages visited, time on site, device type, and approximate geographic location (country/region level). No personally identifiable information is sent to Google Analytics. You can withdraw consent at any time via the cookie banner on our website.

2.4 Cookies and technical data

We use the following types of cookies:

Essential cookies — required for the website and customer portal to function (e.g. session authentication). These cannot be disabled.
Analytics cookies — Google Analytics cookies (only set with your consent). You can accept or decline these via our cookie banner.

We do not use advertising, tracking, or profiling cookies.

3. How we use your data

We use your personal data for the following purposes:

To respond to your enquiry or service request
To provide and manage the car repair or servicing you have booked
To operate and secure your Customer Portal account
To share repair videos and updates with you through the portal
To communicate with you about your vehicle or booking
To analyse website usage and improve our services (analytics, with consent only)
To comply with our legal obligations

We will not use your data for direct marketing without your explicit consent, and we will never sell your personal data to third parties.

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

Contract performance (Article 6(1)(b)) — processing necessary to provide the services you have requested or booked.
Legitimate interests (Article 6(1)(f)) — responding to enquiries, securing our systems, and operating the customer portal.
Consent (Article 6(1)(a)) — analytics cookies (Google Analytics). You may withdraw consent at any time.
Legal obligation (Article 6(1)(c)) — where we are required to retain records by law (e.g. financial records).

5. Who we share your data with

We may share your data with the following third parties only where necessary:

GoDaddy / Airo — our website hosting and infrastructure provider. Data is processed within the UK/EEA under appropriate safeguards.
Google LLC — Google Analytics (analytics cookies, consent-gated only). Google may process data in the USA under Standard Contractual Clauses.

We do not sell, rent, or trade your personal data with any other third parties.

6. How long we keep your data

Contact enquiries — retained for up to 2 years from the date of enquiry, then securely deleted.
Customer portal accounts — retained for as long as your account is active. If you request deletion, we will remove your account and associated data within 30 days.
Repair videos and comments — retained for as long as your portal account is active or until you or we delete them.
Financial and service records — retained for 6 years as required by HMRC regulations.
Analytics data — retained by Google Analytics for 14 months (our configured retention period).

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your data ("right to be forgotten")
Right to restrict processing — ask us to limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — withdraw analytics consent at any time via the cookie banner

To exercise any of these rights, contact us at admin@rsmcars.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

Encrypted HTTPS connections for all data in transit
Hashed (bcrypt) storage of all account passwords
Token-based authentication for the customer portal
Access controls limiting who can view customer data

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

10. Contact us

For any questions or concerns about this Privacy Policy or how we handle your data, please contact us:

Email: admin@rsmcars.co.uk
Phone: 01285 709800
Post: RSM Cars, The New Barn, Eysey, Cirencester, Gloucestershire, SN6 6LP