Who we are
Ashlar Mews (“we”, “us”) provides appointment-only storage for classic, sports and performance cars near Leeds. We are the data controller for the personal data described in this notice. You can contact us about anything in it through the contact page. Our registered company details and ICO registration number will appear here once the reviewed version of this notice is published.
What we collect
- Waiting list and enquiries: your name, email address, phone number, the car’s make, model and year, an approximate value band (never an exact figure), your preferred start month, the package you are interested in, how you heard of us, and whether you consent to marketing.
- Members: contact and billing details, vehicle details including the registration and, where needed, the VIN, insurance and MOT expiry dates, the condition reports and photographs we produce, booking history, messages, invoices and payment status, and the terms you have accepted.
- Website visitors: essential technical data needed to serve the site. If you accept analytics cookies, aggregated, privacy-friendly usage statistics with no advertising trackers. If you arrive from one of our adverts or partners, the link’s reference code is stored with your enquiry so we know where it came from.
- Visitors to the premises: CCTV recordings of the building and its approaches.
Why we use it and our lawful bases
- Contract: to provide storage, collection and delivery, to produce condition reports, to take payment and to communicate with you about your car.
- Legitimate interests: to keep the premises, the cars and the people on site secure (including CCTV), to prevent fraud, to defend legal claims and to improve the service. We balance these interests against your rights.
- Consent: for marketing messages and for analytics cookies. You can withdraw consent at any time.
- Legal obligation: to keep financial records and to comply with the law, including the law on uncollected goods.
Who processes data on our behalf
We use carefully chosen service providers under written contracts. They may only use your data on our instructions.
| Processor | Purpose |
|---|---|
| Supabase | Database, authentication and file storage for the member app and our records |
| Vercel | Hosting and delivery of this website and the member app |
| Stripe | Card payments, including the refundable waiting-list deposit |
| GoCardless | Direct Debit collection of monthly storage fees |
| Resend | Transactional email (confirmations, reports, reminders) |
| Sentry | Error monitoring so we can fix faults; personal data is scrubbed before it is sent |
| Twilio | SMS reminders for bookings and collections, where you have given a mobile number |
Our licensed transport partner receives only the details needed to collect or return your car: your name, the collection address, a contact number and the vehicle details. They are never told what your car is worth, and the address is hidden from them again shortly after the job is complete.
International transfers
Our data is held in the UK and the European Union wherever possible. Where a provider processes data elsewhere, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Condition reports, photographs and contract records: six years after the contract ends.
- Financial records: six years, as required by HMRC.
- Waiting-list enquiries that do not become a contract: twelve months.
- Messages: two years.
- CCTV: a fixed, short retention period unless footage is needed for an incident.
When a retention period ends, personal data is deleted or anonymised by a scheduled process. The counts of records removed are logged, but not their contents.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of your data (members can download it directly from the member app);
- correct data that is wrong;
- erase data we no longer need to keep;
- restrict or object to particular processing, including marketing;
- transfer your data to another provider in a machine-readable form.
We respond within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to put things right first.
Security
Access to member records is limited by role and recorded. Photographs you see have been stripped of location data. Payment card details never touch our systems: they are handled entirely by Stripe. Our premises address is never published and is shared with members only.
Changes to this notice
We will update this notice when our processing changes and show the date of the latest version at the top of the page. Significant changes will be sent to members by email.