Legal
Privacy Policy
How we collect, use and protect your personal information.
Version 2026-09-17 · In effect from 17 September 2026
1. Who we are
IN A PICKLE BREAKDOWN LTD (company number 17456795), registered office 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE, trading as In a Pickle Breakdown, is the controller for the personal information described in this notice where it determines how and why that information is used.
Privacy contact: admin@picklebreakdown.co.uk. We use the term “privacy contact” rather than Data Protection Officer because no formal DPO is appointed for the current platform.
2. Information we collect
- Customer/account information: name, email, telephone number, login/account information and support communications.
- Booking/vehicle information: vehicle registration and details, fault/symptoms, service tier, breakdown location/destination, booking status and information you provide about the circumstances.
- Customer location: a precise location point when you actively choose “Use my location” and give the required browser/platform permission. Customers are not continuously tracked.
- Supplier information: business identity/contact details, public-liability and any capability-specific evidence collected, services/capabilities, recovery-vehicle information where relevant, attending-person details where provided, account status and Stripe connected-account/verification status.
- Supplier live location: during an active accepted job only, normally updated about every 5 seconds. The current position overwrites the previous position; a continuous movement history is not kept. Arrival evidence is retained with the job.
- Payment/transaction information: authorisation, capture, transfer, payout, refund, dispute/chargeback status and Stripe transaction identifiers. Card details are entered into Stripe and do not reach IAP servers; Supplier bank details/Stripe identity information are collected by Stripe.
- Technical/security information: IP address, device/browser information, authentication logs, security/audit records and system events.
- Complaints/disputes: correspondence, comments, optional photographs/evidence and records required to handle safety, fraud, payment or service disputes.
3. How and why we use information
| Purpose | Typical lawful basis |
|---|---|
| Create/manage accounts, receive requests and provide marketplace functionality | Contract / steps requested before contract; legitimate interests where appropriate. |
| Match requests to eligible Suppliers and administer the direct Customer-Supplier service booking | Contract / steps requested before contract; legitimate interests in operating the marketplace. |
| Use customer/Supplier location for matching, active-job tracking, arrival evidence and payment/dispute administration | Contract and legitimate interests, with browser/device permission where required; use is limited and proportionate to the active booking. |
| Supplier verification, capability approval and insurance expiry controls | Contract / legitimate interests in safety, fraud prevention and marketplace standards; legal obligation where applicable. |
| Process customer payments, Supplier transfers, refunds and chargebacks | Contract, legal obligations and legitimate interests in administering transactions; Stripe also processes information under its own applicable terms/roles. |
| Support, complaints, disputes and legal claims | Contract, legitimate interests, legal obligations and establishing/exercising/defending legal claims. |
| Security, abuse/fraud prevention and audit logging | Legitimate interests and legal/security obligations. |
| Accounting, tax and business records | Legal obligation and legitimate interests. |
| Promotional marketing | Not currently used at launch. If introduced, IAP will apply the appropriate consent/soft-opt-in and unsubscribe rules before sending it. |
4. Location information in more detail
4.1 Customers
Precise location is requested only when you actively select “Use my location” and the associated permission/consent requirement is satisfied. It is one reading stored against the job, not continuous browser tracking. If you manually move/correct the map pin, the corrected point and time may be recorded for booking/dispute evidence.
Before precise permission is granted, the platform may use your IP address once to suggest an approximate town. That approximate lookup is not kept as a continuous location history.
Exact customer coordinates are available to the customer, IAP administrators and the Supplier assigned to the job. Before successful payment authorisation/assignment, a Supplier sees only a general area description.
4.2 Suppliers
Supplier live location is transmitted only while the Supplier has accepted an active job. It normally updates every 5 seconds; positions received more frequently than every 2 seconds are discarded. The live position can be viewed by the customer for that job, the Supplier and IAP administrators.
Transmission stops when the job is completed, cancelled, returned to the available-job board, or the Supplier goes offline. Each new point overwrites the previous point. IAP does not retain a journey history. The arrival point, accuracy, distance from the customer and time of arrival are retained with the job because attendance/payment disputes may depend on them.
5. Who receives information
| Recipient / service | Why information is shared |
|---|---|
| Assigned independent Supplier | To perform the direct roadside/recovery service contract. Exact location is disclosed only after assignment as described above. |
| Stripe | Customer card payment processing; Stripe Connect Express Supplier onboarding/identity checks; Supplier bank details, transfers/payouts; refunds/chargebacks. |
| Host Dada | Dedicated server hosting and infrastructure backups in London, UK. |
| Amazon Web Services (S3) | Private encrypted storage of Supplier verification documents and job photographs in the London (eu-west-2) region. |
| OpenRouteService | Primary address search/route calculation; receives address/coordinates needed for the request. |
| Google Geocoding API | Backup address/geocoding service if OpenRouteService is unavailable. |
| OpenFreeMap | Map tiles loaded by the user’s browser; the visitor IP address and map area may reach this service. |
| ip-api.com | One-time approximate town suggestion from visitor IP address before precise location is provided. |
| DVSA / Microsoft authentication | MOT History API processing of vehicle registration number; Microsoft authentication supports the API connection. |
| Transactional email provider | Receives the recipient email address and operational message content required to send platform emails. The provider name is held in IAP’s internal service-provider register once confirmed. |
| Professional advisers / authorities | Where reasonably necessary for legal, accounting, insurance, claims or regulatory purposes, or where disclosure is required by law. |
Suppliers receiving customer information for their direct service contract may have their own controller obligations and must comply with applicable data-protection law.
6. International transfers
Host Dada hosting and the relevant AWS S3 storage are in the UK. Some third-party services, including Stripe, Google, Microsoft, ip-api.com and OpenFreeMap, may process information outside the UK. Where IAP makes a restricted international transfer, it will use a lawful transfer mechanism such as applicable UK adequacy regulations or appropriate safeguards (for example the UK IDTA/Addendum) and carry out any required transfer assessment.
7. Retention
| Record | Normal retention period |
|---|---|
| Customer account/profile | 3 years after last activity. |
| Supplier account | 6 years after the Supplier relationship ends. |
| Unsuccessful Supplier application and associated identity/insurance documents | 6 months. |
| Verification/insurance records for active Suppliers | 6 years after the Supplier leaves. |
| Booking and payment records | 6 years. |
| Platform messages | 12 months. |
| Notifications and emails sent | 12 months. |
| Complaints and disputes | 6 years. |
| Customer location and Supplier arrival evidence | Retained with the relevant job record. No continuous Supplier journey history is stored. |
| Administrative audit records | Retained in line with the underlying record/event to which the audit entry relates. |
Legal hold / dispute exception. Information will not be automatically deleted while it is reasonably required for an ongoing complaint, dispute, chargeback, investigation or legal claim, even if the normal retention period has expired. It will be reviewed when that matter concludes. A customer account/profile may be deleted after its 3-year period while related booking/payment records remain for their separate 6-year period.
8. Security
IAP uses technical and organisational safeguards appropriate to the current platform, including HTTPS/TLS, access controls, password hashing, login throttling, role/record-level authorisation, private encrypted document storage, encrypted stored credentials, audit logging and daily infrastructure backups retained for 30 days. No system is completely secure, and IAP does not claim controls that are not implemented.
9. Automated Supplier decisions
Two operational Supplier decisions are currently automated: (1) suspension after the configured threshold for abandoned accepted jobs (currently three), excluding recorded safety/materially-inaccurate-booking withdrawals; and (2) taking a Supplier/capability offline when required public-liability or capability-specific evidence expires. These decisions are recorded and can be reviewed/reversed by an administrator. Suppliers can request human review by contacting admin@picklebreakdown.co.uk.
Other Supplier application and verification decisions are made by a person. The platform does not currently use performance scores, ratings or profiling to rank Suppliers.
10. Your rights
Subject to applicable conditions/exemptions, you may have rights to access personal information, correct it, request erasure, restrict processing, object to certain processing, and receive certain information in a portable format. Where processing relies on consent, you may withdraw consent without affecting earlier lawful processing.
Requests can be made to admin@picklebreakdown.co.uk. We may request proportionate identity information where necessary. We normally respond without undue delay and within one month; where the law permits an extension for a complex or numerous request, we will tell you within the initial period.
Erasure is not an absolute right. We assess each request and may retain information where there is a lawful reason, including legal/accounting duties or an ongoing dispute/claim. The current platform can process valid erasure requests manually while automated routines are developed.
11. Cookies and browser storage
The platform itself currently sets no first-party cookies and uses no analytics, advertising pixels, session recording or behavioural analytics. It uses limited first-party local/session storage for authentication and requested functionality, and Stripe may set payment-security/fraud-prevention cookies at the payment stage. See the Cookie & Browser Storage Policy.
12. Marketing and communications
IAP currently uses transactional/operational email, not promotional marketing email/SMS. There is currently no SMS service and no third-party push-notification provider. Browser alerts, where enabled by a Supplier, use the browser/device’s built-in notification functionality. If promotional marketing is introduced later, IAP will implement appropriate consent/soft-opt-in, unsubscribe and suppression controls before use.
13. Children
The platform is intended for adults arranging roadside assistance/recovery. If IAP becomes aware that information has been supplied in circumstances requiring additional protections, it will take appropriate steps.
14. Changes and complaints
We may update this notice when the platform or processing changes. Material changes will be communicated appropriately; continued use is not treated as consent where a separate consent is legally required.
Privacy queries: admin@picklebreakdown.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO). Current ICO information is available at ico.org.uk.