Privacy Policy
How we collect, use, and protect information at Totalsoft.
1. Who we are
Totalsoft IT Solutions Ltd, a company registered in England and Wales (company number 16162533), registered office 41 Redwood Close, Colchester, CO4 3PA (“Totalsoft”, “we”, “us”, “our”), provides the Totalsoft Garage Manager platform. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB869224.
This Privacy Policy explains how we handle personal data. Who is responsible for your data depends on how you use the Service, which is important to understand:
- We are the data controller for the personal data of our own website visitors and enquirers, and of the people who sign up for and manage a garage account (for example, the garage owner’s name and contact details). We decide how and why that data is used, and this Privacy Policy applies directly.
- We are also the data controller for the sign-in and security records of everyone who uses the platform, including garage staff (see section 2), because we need them to keep the Service secure.
- The garage is the data controller for the records it enters into the Service about its own customers and their vehicles, and about its own staff (“Customer Data”). We process that data only on the garage’s instructions, under our Data Processing Agreement. If you are a garage customer, or a member of garage staff, with a question about that data, please contact the garage directly in the first instance.
2. Information we collect
Depending on how you interact with us, we may collect:
- Account information: name, email address, phone number, garage business details, and login credentials.
- Billing information: billing address and payment details, processed by our payment provider — we do not store full card or bank details ourselves.
- Sign-in and security records: usernames, sign-in times, records of which user created or changed a record in the platform, and the IP address and browser details in our server and security logs.
- Usage data: IP address, browser and device type, pages visited, and how you interact with our website and platform, including via cookies — see our Cookie Policy.
- Communications: records of correspondence if you contact us, including support requests, demo bookings and complaints.
- Agreement records: when you accept our Terms of Service, the version you accepted, when, the email address of the person who accepted, and their IP address and browser — so we can show what was agreed.
We do not knowingly collect special category data (such as health data) about website visitors or account holders through the marketing site or account sign-up process.
3. Where we get your information
Most of the information we hold comes from you directly. We also receive it from:
- Your garage — if you are a member of garage staff, the garage owner or an administrator gives us your name and contact details when they create your login.
- Our payment provider — confirmation of payments and the status of your subscription.
- Our systems — sign-in, security and usage records created automatically as you use the website and platform.
- Government and lookup services — MOT history from the DVSA MOT history service, and address details from our address lookup provider, when a user looks them up in the platform.
4. Why we use your information, and our legal basis
Under UK GDPR we must have a legal basis for each way we use personal data. These are ours:
| What we do | Information used | Legal basis |
|---|---|---|
| Create and manage your garage account and provide the Service | Account information, sign-in records | Contract |
| Take payment and manage your subscription | Account and billing information | Contract |
| Keep billing, invoice and tax records | Billing information | Legal obligation |
| Send service messages, such as account, billing and security notices | Account information | Contract |
| Keep the Service secure, prevent fraud and misuse, and investigate problems | Sign-in and security records, usage data | Legitimate interests (protecting our customers, their data and our platform) |
| Respond to enquiries, demo requests, support requests and complaints | Contact details, communications | Legitimate interests (answering people who contact us); contract, where you are a customer |
| Record which terms you accepted | Agreement records | Legitimate interests (so that either of us can establish, exercise or defend legal claims) |
| Measure and improve our website using analytics | Usage data | Consent, given through our cookie banner |
| Measure whether our Google ads lead to demo requests, free-trial sign-ups and phone calls | Usage data; and, if you send our demo request or free-trial form, your email address and phone number, scrambled (hashed) before they are sent to Google (“enhanced conversions”) | Consent, given through our cookie banner |
| Improve our platform and plan new features | Usage data, sign-in records | Legitimate interests (developing our product) |
| Send marketing emails | Contact details, marketing preferences | Consent; or, for existing customers, legitimate interests for similar services, with an option to opt out in every message |
| Answer requests from the police, regulators or courts | Whatever the request lawfully requires | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against yours, and you can ask us for more detail. We may also combine usage data into statistics that do not identify anyone, which are not personal data.
5. If you do not give us your information
We need your name, email address, garage business details and login credentials to create and run a garage account, and billing information to take payment. Without them we cannot provide the Service. Everything else, such as answering a survey or accepting analytics or advertising cookies, is optional, and saying no does not affect your use of the Service.
6. Automated decisions and AI
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. The AI diagnostic assistant only offers suggestions to garage staff, who decide what to do with them. Our Data Processing Agreement explains what is and is not sent to our AI provider.
7. Who we share information with
We share personal data with service providers who help us run our business, under contractual terms that require them to protect it and use it only for the purposes we specify. Depending on the service, these include providers of:
- Cloud hosting, databases and file storage, located in the UK or the European Economic Area.
- Website delivery, network security and bot protection.
- Transactional email delivery.
- SMS delivery, where SMS reminders are enabled.
- AI services, for the AI diagnostic assistant feature, where used.
- Payment processing, for billing.
- Website analytics, only once you have accepted analytics cookies — see our Cookie Policy.
- Online advertising (Google Ads), to measure our ads, only once you have accepted advertising cookies — see our Cookie Policy.
- Online appointment scheduling, if you book a demo time through our calendar.
- Address and location lookups.
- Accounting software, such as Xero or QuickBooks, only if and when you choose to connect your own account.
- Government vehicle data services (the DVSA MOT history service), to retrieve MOT data you look up within the platform.
Garage customers can see the named list of sub-processors that handle Customer Data in our Data Processing Agreement, which also sets out how we notify them of changes. Anyone else can ask us for the names of the providers we use by emailing support@totalsoft.co.uk. We do not sell personal data to third parties.
We may also disclose information where required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of business assets (in which case we will notify affected users where required).
8. International transfers
We host our platform and its database in the UK. Some of our service providers process personal data outside the UK — in the European Economic Area and the United States — for example to store files, protect our network, send SMS messages, answer AI questions, look up addresses and measure our advertising. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified US providers) or on the ICO’s International Data Transfer Agreement or Addendum, which require them to protect the data to UK standards. Ask us at support@totalsoft.co.uk for more detail.
9. Data retention
We keep personal data only for as long as we need it, and then delete or anonymise it:
- Account information: while your account is open, and for 90 days after it closes so that you can export your data; we then delete it within a further 30 days.
- Billing and invoice records: 6 years after the end of the financial year they relate to, as UK tax law requires.
- Agreement records: 6 years after your account closes, the period in which a contract claim can be brought.
- Enquiries and demo requests that do not lead to an account: 2 years after our last contact.
- Complaints and rights requests: 2 years after we close them, so that we can show how we handled them.
- Marketing preferences: until you opt out; we then keep only what we need to make sure we do not contact you again.
Customer Data that a garage holds in the platform is kept and deleted as set out in our Data Processing Agreement.
10. Data security
Connections to our website and platform are encrypted using TLS. We apply access controls so that personal data is only accessible to personnel and service providers who need it to perform their role. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the risk.
11. Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, where applicable.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Portability — request your data in a portable format, where applicable.
- Object — object to processing based on legitimate interests or for direct marketing.
- Withdraw consent — where processing is based on consent, at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, email us at support@totalsoft.co.uk. There is normally no fee. We may ask you to confirm your identity before we act, so that we do not give your data to someone else. We will reply within one month. If your request is complex, or you have made several, we may need up to two further months; if so, we will tell you why within the first month.
If your request is about Customer Data a garage holds — for example, your details as a customer of a garage, or as a member of its staff — please contact the garage, which decides how that data is used. If you contact us instead, we will pass your request to the garage and help it respond.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell us by emailing support@totalsoft.co.uk with “Data protection complaint” in the subject line, or by writing to the address in section 16. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113. The ICO will usually expect you to have raised your complaint with us first.
13. Cookies
Our website uses cookies, including analytics and advertising cookies that only load once you accept them via our cookie banner. See our Cookie Policy for full detail and how to change your preferences at any time.
14. Children
Our Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.
15. Changes to this policy
We may update this Privacy Policy from time to time. Each version is numbered and dated, and earlier versions stay available on this page. For material changes we will tell account holders by email before the change takes effect.
16. Contact us
For any privacy questions, to exercise your rights, or to make a complaint, contact us at:
Email: support@totalsoft.co.uk
Address: Totalsoft IT Solutions Ltd, 41 Redwood Close, Colchester, CO4 3PA
ICO registration number: ZB869224