PRIVACY POLICY

REFIND ("we", "us", "our") provides mobile detailing, paint correction, ceramic coatings, paint protection film and vehicle security installation across Leeds, Harrogate and Knaresborough.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR") and the UK GDPR together with the Data Protection Act 2018, we are the data controller for the personal data described in this policy.

Contact us about privacy through the contact page.

• Enquiry data — name, phone number, email address, location or postcode, vehicle make, model and registration where you supply it, photos of the vehicle, and the description of the work you want.
• Booking and job data — appointment details, service selected, access arrangements, work carried out, before/after photographs, and any aftercare or warranty notes.
• Security installation data — installation records and device or immobiliser identifiers needed to support the product fitted.
• Payment data — the amount, date and method. Card details are handled by the payment provider, not stored by us.
• Communications — messages you send by email, WhatsApp, SMS, phone or social media, and our replies.
• Technical and usage data — IP address, device and browser type, pages viewed and referring source. Non-essential analytics and advertising data are only collected where you consent (see the Cookie Policy).

Under Article 6 EU GDPR / UK GDPR we rely on the following lawful bases:

• Steps prior to a contract and performance of a contract (Art. 6(1)(b)) — responding to enquiries, preparing quotes, scheduling and carrying out work, aftercare, warranty and invoicing.
• Legitimate interests (Art. 6(1)(f)) — keeping job records, protecting our business against disputes and fraud, securing our website, and improving our services. We balance these interests against your rights.
• Consent (Art. 6(1)(a)) — analytics and advertising cookies, optional marketing messages, and publishing photographs of your vehicle on our website or social media. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — tax, accounting and other statutory record keeping.

We do not knowingly collect special category data and we do not use automated decision-making or profiling that produces legal or similarly significant effects.

We photograph work for quality records. Photos are published only where you have agreed, and number plates are obscured or removed on request. You can withdraw that permission at any time and we will remove the images from channels we control.

We never sell personal data. We share it only where necessary, with processors acting on our documented instructions under Article 28 contracts:

• Website hosting, form delivery and email providers.
• Analytics and advertising platforms, where you have consented.
• Payment processors and our accountant.
• Product suppliers or manufacturers where a warranty registration requires it.
• Insurers, legal advisers, law enforcement or regulators where we are legally required or permitted to do so.

Some providers process data outside the UK and European Economic Area. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses (plus the UK International Data Transfer Addendum where applicable), with supplementary safeguards where needed. You can ask us for details of the safeguards used.

• Enquiries that do not become bookings: up to 12 months.
• Customer and job records, including coating or film warranty records: 6 years after the last job, or the warranty term if longer.
• Accounting and tax records: 6 years plus the current financial year.
• Cookie consent records: up to 12 months, then we ask again.

We apply appropriate technical and organisational measures, including encrypted transport (HTTPS), access controls on accounts and devices, and limiting access to those who need it. No transmission over the internet can be guaranteed fully secure, but we take all reasonable steps and will notify you and the relevant supervisory authority of a qualifying personal data breach within the statutory timeframes.

Under the EU GDPR and UK GDPR you have the right to:

• be informed about how your data is used;
• access a copy of your data;
• have inaccurate data corrected;
• have data erased where it is no longer needed;
• restrict processing in certain circumstances;
• data portability for data you provided under contract or consent;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing already carried out.

We respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to verify your identity.

Please raise any concern with us first. You also have the right to complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113), or in the EU the data protection authority in your country of residence, place of work or the place of the alleged infringement.

We review this policy regularly and will update the date at the top when it changes. Material changes affecting how we use your data will be communicated directly where we hold your contact details.