1. Who We Are

VM Systems operates this vehicle management platform on behalf of automotive businesses ("tenants"). Each tenant acts as a data controller for their own customer data. VM Systems acts as a data processor on their behalf.

2. What Data We Collect & Why

3. Data Storage & Security

All data is stored on UK-based servers (Krystal Hosting, UK). Data is encrypted in transit via HTTPS/TLS. Passwords are hashed using bcrypt. Database files are protected and not publicly accessible. Session data is stored server-side and expires after 30 days of inactivity.

4. Data Sharing

We do not sell, rent or share personal data with third parties for marketing purposes. Data may be shared with:

• Krystal Hosting Ltd — server infrastructure (UK based)
• Email service providers — for sending invoices and MOT reminders
• HMRC — if legally required

5. MOT Reminder Emails — Consent

MOT reminder emails are only sent when a customer has explicitly consented by agreeing at the time of their vehicle service. The date and time of consent is recorded with every invoice. Customers can withdraw consent at any time by:

• Clicking the Unsubscribe link in any reminder email
• Contacting the garage directly
• The garage unchecking the reminder option on their invoice

6. Your Customers' Rights (Under UK GDPR)

Your customers have the right to:

• Access — request a copy of their data
• Rectification — correct inaccurate data
• Erasure — request deletion ("right to be forgotten")
• Restriction — limit how their data is used
• Portability — receive their data in a portable format
• Object — object to processing based on legitimate interests
• Withdraw consent — for MOT reminders at any time

To exercise these rights, customers should contact you directly. You must respond within 30 days.

7. Your Obligations as a Data Controller

8. Data Breach Procedure

In the unlikely event of a data breach, VM Systems will notify affected tenants within 24 hours. Tenants must then assess whether to notify the ICO (within 72 hours) and affected individuals.

9. Contact

For GDPR enquiries: help@vmsystems.co.uk

Last updated: September 2026

Who we are

This vehicle management system is provided by VM Systems to your garage. The garage is the data controller for its customer and vehicle records. VM Systems processes that data on the garage's behalf and is the controller for the sign-in details of system users.

What we hold and why

• Customer details (name, address, phone, email) to create invoices, keep sales and purchase records and contact customers about their vehicle.
• Vehicle and repair records (registration, VIN, mileage, service history, photos) to manage stock, workshop jobs and warranty.
• Invoices and payments to meet accounting and VAT obligations.
• MOT reminder emails only where the customer has agreed to receive them.
• User accounts (username, role and a securely hashed password) so only authorised staff can sign in.

Where it is stored and who sees it

Data is stored on UK-based servers with Krystal Hosting and is encrypted in transit using HTTPS. We do not sell personal data or use it for advertising. It is shared only with our hosting provider, the email service used to send invoices and reminders, and authorities such as HMRC where the law requires it.

Cookies and browser storage

We use a session cookie that keeps you signed in. Your browser also stores some settings on your device, such as your quick items, daily job list, sign-in convenience and whether you have seen an update message. We do not use advertising or analytics cookies. The page fonts are loaded from Google Fonts, so your IP address is sent to Google when the page loads.

How long we keep it

We keep records only as long as needed for the purpose above. Invoice and payment records are kept for the period required for tax and accounting. Other records are removed or anonymised when they are no longer needed, or when you ask us to delete them and we are able to.

Your rights

Under UK GDPR you can ask to see the personal data we hold about you, correct it, have it erased, restrict how it is used, receive a portable copy, or object to how it is used. You can withdraw consent to reminder emails at any time using the unsubscribe link in any email or by contacting the garage.

Contact and complaints

For any privacy request, contact the garage: please ask at the garage. For help with the system, email help@vmsystems.co.uk. If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.