This policy explains what we do with personal data. It covers our website, our contact form, and the RepairSphere service. Please read section 3 first — it decides which parts of this policy apply to you.
1. Who we are
Xegen Ltd, a company registered in Scotland with company number SC745778, registered office Summit House, 4-5 Mitchell Street, Edinburgh, EH6 7BD, United Kingdom.
For any question about this policy, or to exercise your rights, contact privacy@repairsphere.com.
This is a data protection contact, not a Data Protection Officer. We are not required to appoint one and have not done so; the address above is monitored and reaches the people responsible.
We are registered with the Information Commissioner's Office (ICO), the UK supervisory authority. Registration number: ZC213126.
2. Where we operate
We are established in the United Kingdom and offer RepairSphere to businesses in the United Kingdom. We have not appointed a representative in the European Union under Article 27 UK/EU GDPR, because we do not offer the service to people in the EU and do not monitor their behaviour. If that changes we will appoint one and name them here before it does.
3. Two different roles — which one applies to you
RepairSphere is software we provide to accident repair businesses. That means we handle personal data in two quite different capacities, and your rights work differently in each.
3.1 Where we are the controller
We decide why and how this data is handled, so this policy governs it:
- Contact form enquiries — your name, email address, telephone number, company name and your message. We send these to our own inbox to reply to you. We rate-limit submissions by IP address to stop abuse, and we log when a submission is rejected as suspected spam.
- Account and user records — the names, email addresses and language preferences of the people at a customer business who sign in to RepairSphere, plus our own platform administrators.
- Billing and business records — the contact and payment details we need to invoice a customer and keep proper accounts.
3.2 Where we are only the processor
Everything a repair business records about its own customers, we hold on that business's behalf and on its instructions. That includes:
- names, email addresses, telephone and WhatsApp numbers, and postal addresses;
- messaging preferences recorded per channel;
- vehicle and registration details, damage photographs, job and repair status history;
- insurer and assessor contacts;
- staff time entries and work records.
For this data the repair business is the controller, not us, and this policy is not the notice that governs it. If a garage repaired your vehicle and you want to know what it holds about you, ask the garage — its own privacy notice applies. Section 8 explains what happens if you ask us instead.
4. Why we are allowed to handle it
| What | Why | Lawful basis |
|---|---|---|
| Contact form enquiries | Replying to you and following up | Legitimate interests — responding to someone who contacted us |
| Account and user records | Operating the service the customer subscribes to | Performance of a contract |
| Security logging and rate limiting | Keeping the service and our inbox usable | Legitimate interests — protecting our systems |
| Billing records | Invoicing, accounts, tax | Contract and legal obligation |
| Messages to a repair business's customers | Sending status updates on their vehicle | Consent — obtained and held by the repair business, not by us |
5. Who else is involved
We use a small number of providers to run the service. They act on our instructions and may not use the data for their own purposes.
| Provider | What they do | What they handle | Where |
|---|---|---|---|
| OVH SAS (France) | Hosting and infrastructure | All service data | London, United Kingdom |
| Amazon Web Services | Sending transactional email (Amazon SES) | Recipient name, email address, message content | Ireland (eu-west-1) |
| WhatsApp Ireland Limited (Ireland) | WhatsApp Business Cloud API | Recipient phone number, message content, delivery status | Meta infrastructure, which may be outside the UK and EEA |
| SupportLayer.app — our own support desk product, also operated by Xegen Ltd | Handling support tickets raised through the in-app Support Tickets feature | The name and email address of the staff member raising the ticket, their tenant and site, and the ticket's subject and description | London, United Kingdom |
SupportLayer.app is not a separate company — it is another product we run ourselves, so this row exists for transparency about where the data physically goes rather than because a third party is involved.
Meta is involved only where messages are sent from a WhatsApp number we provide. Where a repair business connects its own WhatsApp Business Account, its relationship with Meta is its own and we are not party to it.
We may also disclose personal data where the law requires it, or to professional advisers under a duty of confidence. We do not sell personal data, and we do not share it for advertising.
6. Where data is held and sent
Our hosting is in the United Kingdom and our transactional email is processed in Ireland. A hosting region in Germany is also available, and a customer's Order Form records which region applies to them. Every region we offer is in the UK or the EEA.
These are the transfers we make, and what each one relies on:
- Hosting — no transfer. Production runs in London and the data stays in the United Kingdom, where we are established.
- Email to Ireland, and the optional German hosting region. Both are in the EEA, and the UK's adequacy regulations allow personal data to be sent from the UK to the EEA without further safeguards.
- WhatsApp, where the message is sent from a number we provide. We contract with WhatsApp Ireland Limited, which is in the EEA — so that leg rests on the same adequacy regulations as the row above it. Messages then reach Meta's wider infrastructure, which may be located outside the UK and EEA; the standard contractual clauses in our contract cover that onward transfer, with the UK Addendum where it starts in the UK. Where a repair business uses its own WhatsApp Business Account, its arrangement with Meta is its own and this does not apply.
7. How long we keep it
| What | How long |
|---|---|
| Contact form enquiries | 24 months from your last contact with us |
| Account and user records | For the life of the subscription, then 30 days |
| Billing and accounting records | 6 years, as tax law requires |
| Security and rate-limiting logs | 12 months |
| A repair business's own customer records | Decided by that business. We delete on its instruction, and 30 days after its subscription ends |
8. Your rights
You have the right to ask for access to your personal data, to have it corrected or erased, to restrict or object to how it is used, to receive it in a portable form, and to withdraw consent where consent is the basis we rely on. Withdrawing consent does not affect what was done before you withdrew it.
Write to privacy@repairsphere.com. We will respond within one month. There is no charge in ordinary circumstances.
If your request is about records held by a repair business — what a garage knows about you or your vehicle — that business is the controller and only it can decide the request. Send it there. If you send it to us instead, we will pass it to the relevant business and tell you we have done so, but we cannot decide it ourselves.
9. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we have a chance to put it right.
You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. If you are in the European Union, you may instead complain to the supervisory authority in your own country.
10. Cookies
This site uses only strictly necessary cookies. We do not use analytics or advertising cookies, and there are no third-party trackers on our site. Our Cookie Policy lists every cookie we set and explains how to change your preferences.
11. Changes to this policy
We may update this policy. The version and effective date are shown at the top of this page. If a change materially affects how we handle your personal data, we will tell affected customers by email before it takes effect.
12. Language
This policy is published in more than one language. If a translation differs from the English version, the English version prevails.