1. Who we are
MV Workshop is operated by MV TECHNOLOGY SYSTEMS LTD. For personal data that MV uses for its own account administration, enquiries, billing, security, support, legal and business purposes, MV is normally the controller. For workshop/customer data hosted on behalf of a maintenance provider, the maintenance provider normally determines why and how the information is used and MV normally acts as processor under the Data Processing Agreement.
The company number, registered office and ICO registration shown in the Legal Centre must be completed before commercial public launch.
2. Information we may use as controller
Business contact information such as name, company, role, email, telephone and address; account identity, role and authentication/security records; enquiry and support communications; subscription, invoice and payment-administration information; website/device information needed for security and service operation; marketing preference/suppression records; complaints and rights-request records; and professional/business information supplied in connection with MV services.
Customer Data stored for a workshop is generally processed on that workshop's instructions rather than for MV's own purposes.
3. How we obtain information
We obtain information directly from you, your organisation, authorised users, service providers, public business sources and communications with MV. Where information is obtained indirectly, privacy information will be provided within the period required by law unless an exception applies.
4. Why we use information and typical lawful bases
Respond to enquiries and prepare proposals: legitimate interests and steps requested before a contract.
Create and administer accounts: contract and legitimate interests.
Provide subscriptions and support: contract and legitimate interests.
Billing, tax and accounting: contract and legal obligation.
Security, fraud prevention and misuse investigation: legitimate interests and legal obligation where applicable.
Maintain and improve the service: legitimate interests, with consent where required for non-essential storage/analytics.
Business marketing: legitimate interests for permitted business marketing and consent where PECR requires it.
Meet legal, regulatory, insurance and claims requirements: legal obligation, legitimate interests and legal claims where applicable.
Handle data-protection complaints and rights requests: legal obligation.
5. Marketing
Marketing is separate from Platform access. The signup marketing box is optional and unticked by default. You can opt out at any time. We may keep a minimal suppression record so an opt-out continues to be respected. We do not sell personal information to advertisers.
6. Workshop Customer Data
Maintenance providers using MV Workshop decide why and how they use information about their staff, mechanics, operator customers and other people recorded in their workshop system. They are responsible for lawful collection, privacy notices, access decisions and retention. MV processes that information to provide and protect the service in accordance with the DPA and documented instructions.
7. Sharing
We may share personal information with cloud/database/authentication/storage and website suppliers listed in the Subprocessor Register; professional advisers, insurers, accountants and auditors subject to appropriate confidentiality; authorities, courts, regulators or law-enforcement bodies where required or permitted by law; a genuine purchaser/successor in a business reorganisation subject to appropriate safeguards; and the relevant Customer where a request concerns Customer Data it controls.
8. International transfers
Some suppliers or support functions may involve processing outside the UK. Where a restricted transfer occurs we use a recognised safeguard such as UK adequacy regulations, the UK IDTA, the UK Addendum to approved Standard Contractual Clauses or another lawful mechanism. Current supplier information is in the Subprocessor Register.
9. Retention
We keep information only as long as needed for the purpose, legal requirements, security and claims. Typical periods: enquiries that do not become business, up to 24 months after last meaningful contact; customer contract/order/legal acceptance records, contract term plus 6 years; invoices/accounting records, normally 6 years or the applicable statutory period; support tickets, normally 2 years after closure unless linked to a contract, security incident or claim; ordinary security/login logs, normally 12 months; marketing preferences and suppression records until opt-out plus a minimal suppression record; data-protection complaints and rights requests, normally 6 years after closure. Customer Data is retained as instructed by the Customer and the DPA/retention schedule.
10. Cookies and device storage
Strictly necessary cookies or similar storage may be used for authentication, security, session continuity and user preferences. Non-essential analytics or marketing technologies will not be activated unless a valid exception applies or the required positive choice has been made. Cookie Settings can be used to change the optional preference.
11. Security
We use proportionate organisational and technical safeguards including access controls, supplier due diligence, encryption in transit, role permissions, tenant separation, logging, backup arrangements and incident procedures. No online service is completely risk-free; customers must also protect their accounts, devices and administrator access.
12. Your rights
Depending on the circumstances, you may have rights to access personal information and supplementary information; correct inaccurate information; request erasure or restriction where legal conditions are met; object to processing based on legitimate interests; object to direct marketing at any time; receive certain information in a portable format where the right applies; withdraw consent where processing relies on consent; and request human intervention where a qualifying solely automated decision has a legal or similarly significant effect. Rights are not absolute and exemptions may apply. We may request proportionate information to verify identity.
13. Data-protection complaints
You can use the route shown on the Data Protection Complaints page or contact the privacy address shown in the Legal Centre. We will provide a clear complaint route, acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed where appropriate and communicate the outcome. You may also complain to the Information Commissioner's Office. Asking MV to address the issue first does not affect your right to contact the ICO.
14. Changes
We may update this notice for legal, supplier or service changes. The current version and effective date will be published. Material changes will be brought to affected users' attention where required.