Privacy policy
Who we are
Garage Command Centre ("GCC", "we") is operated by Joshua Law, a sole trader trading as Garage Command Centre, Gloucester, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC103739. You can contact us about this policy at hello@garagecommandcentre.co.uk.
What GCC is
GCC is software for independent garages: quotes, bookings, workshop jobs, MOT reminders, customer messaging, and the GCC Finance Suite, which keeps the garage's books, reconciles its bank and card payments, and prepares and submits its VAT return to HM Revenue & Customs (HMRC) under Making Tax Digital.
The garage that uses GCC is the data controller for the information about its customers. GCC is the garage's data processor. If you are a garage customer with a question about your data, please contact the garage first; we will help them answer it.
What we process, and why
| Information | Why | Lawful basis |
|---|---|---|
| Garage staff names, email addresses and sign-in details | To provide each person with their own login and keep an audit record of who did what | Contract with the garage |
| Garage customers' names, phone numbers, email addresses, vehicle registrations and job details | To produce quotes, bookings, invoices and reminders on the garage's behalf, and to keep the garage's accounting records | The garage's contract with its customer, and its legal obligation to keep accounting and VAT records |
| Payments (amounts, dates, card payment references — never full card numbers) | To record what has been paid and reconcile it against the garage's bank | Legal obligation (accounting records) |
| The garage's bank transactions, where the garage connects a bank feed | To keep the books and reconcile payments | Contract with the garage |
| VAT registration number, VAT obligations and VAT return figures | To prepare and submit the garage's VAT return to HMRC when the garage asks us to | Legal obligation (VAT) |
| Technical information about the device and browser used to submit a VAT return (IP address, browser, screen size, time zone, a random device identifier) | HMRC requires this "fraud prevention" information with every Making Tax Digital submission | Legal obligation (HMRC fraud-prevention rules) |
The HMRC connection
When a garage connects the Finance Suite to HMRC, it signs in on HMRC's own website and grants GCC permission to read its VAT obligations and submit its VAT returns. We never see or store the garage's HMRC user ID or password. HMRC issues GCC an access token; we store that token encrypted, use it only for the purposes the garage granted, and delete it when the garage disconnects. HMRC's own privacy notice applies to what HMRC does with a submission.
Where your data is kept
Our database is hosted by Supabase in London, United Kingdom. Our web services run on Cloudflare's network, which processes requests at the location nearest the user; for garages in the UK that is normally the UK or the European Economic Area. Encrypted backups are kept in the same region.
Who else handles data on our behalf
We use these suppliers to run the service. Each processes data only on our instructions and under a written contract.
- Supabase — database and file storage (London)
- Cloudflare — hosting, security and email routing
- Blink Payment — card payment links (the garage's own merchant account)
- SMS and WhatsApp providers (FireText, PureSMS, Meta) — customer messages the garage sends
- Intuit QuickBooks — only where the garage has chosen to connect its QuickBooks account
- Anthropic — the AI assistant "Lois", which answers staff questions about the garage's own records
We do not sell personal data and we do not share it for anyone else's marketing.
How long we keep it
Accounting and VAT records are kept for six years after the end of the financial year they relate to, as HMRC requires. Other records are kept while the garage uses GCC and deleted within 90 days of the garage closing its account, unless the garage asks for them sooner or the law requires us to keep them longer.
Security
Data is encrypted in transit (TLS) and at rest. HMRC tokens are additionally encrypted with a key held outside the database. Every person has their own sign-in; a garage can issue read-only access (for an accountant, for example) and revoke any access at once. Every change to the books is written to an audit log that records who made it. If we ever suspect a breach involving personal data, we will tell the affected garages, HMRC (where the HMRC connection is affected) and the ICO within 72 hours.
Your rights
Under UK GDPR you can ask to see the personal data held about you, have it corrected or deleted, restrict or object to its processing, and receive a copy in a portable form. A garage can export its books at any time and can ask us for a complete copy of its data if it moves to another provider. To exercise any right, email hello@garagecommandcentre.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
This website uses no tracking cookies. The GCC application stores a sign-in token and your preferences in your browser so it works; nothing is used for advertising.
Changes
We will post any change to this policy here and update the date at the top. Material changes will be announced to garages inside the application.