Privacy & Cookie Policy

How Oxford Breakdown Recovery collects, uses, stores and protects your personal data.

1. Who We Are

1.1 Oxford Breakdown Recovery ("we", "us", "our") is a breakdown recovery, towing and vehicle transport business based in Oxford, Oxfordshire, providing 24/7 services across Oxfordshire, the M40 corridor, the wider UK, and Continental Europe.

1.2 We are the data controller responsible for the personal information you provide when you contact us, book a service, or use our website. Our contact details are:

• Phone / WhatsApp: 0786 328 1324
• Website: oxfordbreakdownrecovery.co.uk/contact.html
• Service area: Oxfordshire, the M40 corridor and surrounding areas, plus UK-wide and European recovery.

2. What Data We Collect

2.1 We only collect personal information that is necessary to arrange and complete the recovery or transport service you have requested. Depending on the service, we may collect:

Contact & identification data

• Your name;
• Your telephone number and/or WhatsApp number;
• Your email address (if you provide it);
• Your collection and delivery addresses (or the location where the vehicle is stranded).

Vehicle & service data

• Vehicle make, model, registration and colour;
• Vehicle condition, fault or damage information;
• Vehicle identification number (VIN) — for European and long-distance transports;
• Whether the vehicle is drivable, rolling, non-running or accident-damaged;
• Access notes for collection and delivery locations.

Payment & billing data

• Billing name and address (for invoicing);
• Payment reference and amount paid.
• Note: We do not store full card details. Card payments are processed by our payment provider, and only a transaction reference is retained.

Documentation data (for European & international transports)

• Passport or ID details (where required by customs or transport authorities);
• Vehicle registration documents (V5C or equivalent);
• Any authorisation letters, export or import documentation.

Website & communications data

• Messages you send us by telephone, WhatsApp, email, or our contact form;
• Call recordings (see section 3.3);
• Basic website server logs (IP address, browser type, page requested) — held for security and diagnostic purposes only.

2.2 We do not collect special category data (such as health, ethnicity, religion, or sexual orientation) and we do not intentionally collect data from children.

3. How We Use Your Data

3.1 We use your personal data for the following purposes:

• To provide the service you have requested — dispatching a recovery vehicle, contacting you about arrival times, and completing the recovery, transport or roadside assistance;
• To communicate with you — responding to enquiries, confirming bookings, sending updates about your job, and following up after completion;
• To process payment — invoicing, taking payment, and keeping financial records;
• To comply with legal obligations — for example, keeping invoices for HM Revenue & Customs, or providing documentation for customs authorities when transporting a vehicle across borders;
• To resolve disputes and handle insurance claims — including communicating with insurers, brokers and legal representatives where necessary;
• To improve our services — reviewing how we handle jobs so we can improve response times, training and quality.

3.2 We do not use your data for marketing. We do not send marketing emails or SMS messages, and we do not pass your details to third parties for their own marketing.

3.3 Call recordings. We may record telephone calls for quality, training, safety and dispute-resolution purposes. Call recordings are stored securely, retained only as long as necessary, and are never shared except where required by law or in connection with a specific dispute or insurance claim.

4. Lawful Basis for Processing

4.1 Under UK GDPR, we must have a lawful basis for processing your personal data. Depending on the context, we rely on the following bases:

• Contract: Processing is necessary to enter into or perform the contract you have with us — for example, dispatching a recovery vehicle or issuing an invoice;
• Legal obligation: Processing is necessary to comply with our legal duties — for example, tax and accounting requirements, or customs documentation for European transports;
• Legitimate interests: Processing is necessary for our legitimate business interests — for example, preventing fraud, protecting our staff and property, handling disputes, and improving our services. We always balance our interests against your rights;
• Consent: Where we rely on your consent (for example, if you ask us to keep you updated about a future booking), you can withdraw that consent at any time.

5. Who We Share Data With

5.1 We do not sell, rent, trade, or share your personal data for marketing purposes.

5.2 We may share your data with the following categories of recipients, only where necessary to complete the service you have requested or to comply with our legal obligations:

• Recovery operators & sub-contractors: Where we need to use a partner recovery operator, freight forwarder, or transport agent to complete your job (particularly for European transports and long-distance recoveries);
• Payment processors: To securely process your card payment (only transaction references are retained by us);
• Insurance companies: Where you or we make an insurance claim relating to the recovery or transport;
• Legal & professional advisers: Solicitors, accountants, or insurers, where necessary for a specific dispute or compliance matter;
• Government & regulatory authorities: HM Revenue & Customs, DVLA, customs authorities in other countries, police, and other authorities where required by law;
• IT & website service providers: Our web hosting and email providers, who process data on our behalf under strict contractual terms.

5.3 Where we share data with third parties, we ensure they are bound by contracts requiring them to protect your data and only use it for the purposes we have specified.

5.4 We do not transfer your personal data outside the UK unless necessary for a European transport (in which case we only share the minimum information required by customs, transport authorities, or our partner operator in the relevant country).

6. How Long We Keep Your Data

6.1 We retain personal data only for as long as necessary for the purposes for which it was collected. Our standard retention periods are:

• Recovery job records: 6 years from the date of the job — to comply with HMRC record-keeping requirements and to allow us to handle any late dispute or insurance claim;
• Invoices & financial records: 6 years from the end of the relevant financial year — to comply with HMRC requirements;
• Enquiry data (jobs that did not proceed): 12 months from the date of enquiry, then securely deleted;
• Call recordings: 12 months from the date of the recording, unless retained specifically in connection with an ongoing dispute or insurance claim;
• Website server logs: 30 days;
• European transport documentation: 7 years (customs and tax requirements);
• Customer complaints records: 6 years from resolution.

6.2 When retention periods end, we securely delete or anonymise the data. Some data may be retained for longer where required by law or where there is a genuine need (for example, an ongoing legal dispute).

7. Cookies & Website Analytics

7.1 Cookies

Our website uses a minimal number of cookies:

• Essential cookies: Required for the website to function (for example, remembering your preferences). These cannot be disabled without breaking the site.
• No advertising cookies. We do not use Google Ads, Facebook Pixel, or any other advertising or retargeting cookies.
• No cross-site tracking. We do not track you across other websites.

7.2 Google Maps

Our website may embed Google Maps on some pages to help you find our service area. Google may set its own cookies when the map loads. Google's privacy policy is available at policies.google.com/privacy.

7.3 Server Logs

Our web hosting provider automatically records basic server logs (IP address, browser type, pages requested, timestamps). These logs are used solely for security, performance monitoring, and diagnosing technical issues. They are deleted after 30 days.

7.4 Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to:

• See what cookies are stored;
• Delete individual or all cookies;
• Block cookies from specific sites or all sites;
• Block third-party cookies.

Blocking essential cookies may affect how the website functions.

8. Your Rights Under UK GDPR

8.1 You have the following rights in relation to your personal data:

Right of access

You can request a copy of the personal data we hold about you. We will respond within one month of receiving your request.

Right to rectification

You can ask us to correct inaccurate or incomplete data. We will update our records promptly.

Right to erasure ("right to be forgotten")

You can ask us to delete your personal data where we no longer have a legitimate reason to keep it. This right is not absolute — we may need to retain certain data to comply with legal obligations (such as HMRC record-keeping) or to defend legal claims.

Right to restrict processing

You can ask us to limit how we use your data — for example, while we investigate a dispute about accuracy.

Right to data portability

You can ask us to provide your data in a structured, commonly used, machine-readable format, or to transmit it to another organisation. This right applies only to data you provided to us, processed by automated means on the basis of consent or contract.

Right to object

You can object to our processing of your data where we rely on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

Right to complain

See section 11 below.

8.2 How to exercise your rights. Contact us by phone or WhatsApp on 0786 328 1324. We will respond to all requests within one calendar month. If your request is complex or you have made multiple requests, we may extend this by a further two months and will tell you if we do.

8.3 We may need to verify your identity before acting on a request, to prevent unauthorised disclosure.

8.4 Exercising your rights is free of charge. We will only charge a reasonable fee (or refuse to act) if your request is manifestly unfounded or excessive.

9. Data Security

9.1 We take the security of your data seriously. We use a combination of technical and organisational measures to protect it, including:

• Encrypted connections (HTTPS) across our website;
• Password-protected devices, email accounts and booking systems;
• Restricted access — only staff who need your data to complete your job can see it;
• Regular software updates and security patches;
• Secure destruction of paper records containing personal data.

9.2 No method of transmission over the internet or electronic storage is 100% secure. While we do our best to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that affects your rights or freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by UK GDPR.

10. Children's Data

10.1 Our services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe we have inadvertently collected data from a child, please contact us so we can delete it.

11. Complaints & the ICO

11.1 If you have a concern about how we handle your personal data, please contact us first — we will try to resolve the issue quickly.

11.2 You also have the right to lodge a complaint with the UK's data protection regulator:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer the opportunity to resolve your concern directly before you escalate to the ICO.

12. Changes to This Policy

12.1 We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, or the law.

12.2 When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of our website and services after an update confirms your acceptance of the revised policy.

12.3 We recommend checking this page periodically to stay informed about how we protect your data.

13. How to Contact Us

If you have any questions about this Privacy & Cookie Policy, or wish to exercise any of your data protection rights, please contact us:

• Phone / WhatsApp: 0786 328 1324
• Website: oxfordbreakdownrecovery.co.uk/contact.html
• Service area: Oxfordshire, the M40 corridor and surrounding areas — including Abingdon, Banbury, Bicester, Burford, Carterton, Chipping Norton, Didcot, Farringdon, Henley-on-Thames, Islip, Kidlington, Lewknor, Newbury, Princes Risborough, Stokenchurch, Thame, Wallingford, Wantage, Watlington, Weston-on-the-Green, Wheatley, Witney and Woodstock — plus UK-wide and European recovery.