How Podium Uses Your Information

1. Who Controls Your Information

Data controller: Laurus Group Limited (trading as Podium Vehicle Solutions).

Company number: 17295288. Registered in England and Wales. Registered office: 316 Warwick Road, Banbury, OX16 1AZ.

Contact email: [email protected].

Service area: Based near Banbury, Oxfordshire, with mobile services across surrounding counties.

2. Information We Collect Through Forms

Depending on the form, we collect:

• Identity and contact details, such as name, email address and phone number.
• Vehicle details, such as registration, make, model, mileage and service needs.
• Address information for visit planning and service delivery.
• Booking preferences and enquiry notes.
• Your privacy acknowledgement and any optional marketing preference you provide.

3. Why We Use Your Information

• To respond to requests and take steps before providing services.
• To book and deliver diagnostics, servicing, inspections and related support.
• To communicate about your enquiry, appointment and recommended next steps.
• To keep records, manage quality and meet legal or regulatory duties.
• To send occasional Podium email updates only where you have opted in.

4. Lawful Bases Under UK GDPR

We rely on one or more of the following lawful bases, depending on context:

• Taking steps at your request before entering into a contract.
• Performance of a contract where you ask us to provide services.
• Legal obligations, where processing is required by law.
• Legitimate interests, such as operating and improving our services, handling customer communications and keeping business records in a proportionate way.
• Consent for optional marketing emails where you have actively opted in.

Your privacy acknowledgement checkbox is used as confirmation that you have read this notice and that the details provided are accurate. It is not used as the legal basis for ordinary service processing.

5. Organisations We Use and Share Information With

We do not sell personal data. We do use a small number of other organisations to run the website, deliver our services and look up vehicle information. What each one sees, and why, depends on the category below - some act on our instructions as part of running the site, others are independent sources or suppliers we query for specific vehicle or address data.

• Hosting, infrastructure and communications. Cloudflare (website hosting and the server-side functions the site runs on) and Supabase (our customer account database and sign-in system) run the technical infrastructure behind this site and My Garage. Resend delivers transactional emails we send you (account verification, welcome and admin notification emails). These providers handle data as part of operating the systems we use to run our business.
• Government vehicle-data sources. When you add a vehicle in My Garage, we look up its details using the DVSA MOT History API and, where needed, the DVLA Vehicle Enquiry Service (VES) - the UK Government's own MOT and vehicle-tax data services. We query these using your vehicle's registration; they are independent government data sources, not a service we outsource work to.
• Commercial address and vehicle-data providers. getAddress.io helps you find your service address from a postcode when booking. UK Vehicle Data / Vehicle Data Global Ltd supplies additional vehicle specification details (and, where available, a manufacturer stock image) for vehicles in My Garage, looked up by registration or VIN. Both are commercial suppliers we query for specific information, not general marketing partners.
• Booking-form provider. When you submit a booking or upgrade enquiry, the form is processed by FormSubmit (formsubmit.co), which delivers it to our inbox. We do not keep a separate copy of that submission in our own database - see the Cookie Notice for how FormSubmit itself may handle your submission.

Where an organisation processes personal data on our behalf and on our instructions, we expect it to apply appropriate safeguards and to use the data only for the purpose we've engaged it for. We are currently confirming the formal data-processing arrangements with each supplier above as part of an ongoing review of this notice.

Specialist and subcontracted work. Some work - for example, vehicle remapping or work outside our own in-house capability - may be carried out with a specialist partner or subcontractor. Where that happens, we share only the vehicle information genuinely needed for that work (typically the registration, VIN and technical specification) and do not share your name or contact details unless it is genuinely necessary for that partner to carry out the work.

Accounting and invoicing. Invoicing and payment records are handled in a separate accounting system, not through this website. We'll name that provider here once it's confirmed.

6. International Transfers

Where a provider processes personal data outside the UK, we use appropriate safeguards, such as UK-approved transfer mechanisms and contractual protections, where required.

7. How Long We Keep Information

We keep personal information only for as long as needed for the purposes above. As a guide:

• Booking and enquiry form submissions - kept for around 12 months from your last meaningful contact with us, unless the enquiry becomes a customer or service record, in which case the relevant details are kept as part of that record instead.
• My Garage account, vehicle, MOT history, health-check and vehicle-specification information - kept while your account and vehicle record remain active, and reviewed against this schedule if you ask us to delete your account (see Section 9).
• Staff access records for our internal systems - kept for around 12 months.
• Accounting, invoice and transaction records - kept for at least 6 years, as required for UK tax and accounting purposes.
• Records connected to a complaint, dispute, warranty claim or legal matter - kept for as long as necessary to deal with that matter, which may be longer than the periods above.

When information is no longer needed, we securely delete it or anonymise it.

8. Security

We use appropriate technical and organisational measures to protect personal information, including access controls, secure communication practices and provider-level safeguards.

9. Your UK GDPR Rights

You may have rights to:

• Request access to your personal data.
• Request correction of inaccurate data.
• Request erasure in certain situations.
• Request restriction of processing in certain situations.
• Object to processing based on legitimate interests.
• Request data portability where applicable.
• Withdraw marketing consent at any time.

To exercise your rights, contact [email protected]. For a deletion request, tell us which account or information you'd like deleted; a member of our team will review your request against the retention periods in Section 7 and confirm what has been deleted or anonymised, and what (if anything) we need to keep and why.

10. Complaints

If you have concerns about how we handle personal data, please contact us first so we can try to resolve them.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk.