Privacy Policy

1. Introduction and who the controller is

This Privacy Policy explains how we collect, use, and protect your personal information when you use our roadside assistance and recovery marketplace. We are committed to your privacy and to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The data controller is IN A PICKLE BREAKDOWN LTD, a company registered in England and Wales under company number 17456795, whose registered office is 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE. In a Pickle Breakdown is its trading name. Where this policy says “we” or “us”, it means that company.

Suppliers are independent businesses and are separate controllers of the personal data we pass to them in order to carry out your job.

2. Information we collect

• Customer data. We collect your name, contact details (phone number, email), vehicle registration number, vehicle make and model, and live GPS location during the booking process to facilitate assistance.
• Supplier data. We collect your name, business contact details, insurance documents, vehicle information, and banking/payout details (processed via Stripe).
• Technical data. Your IP address, browser and device type, and the pages requested, recorded in our server logs. Your IP address is also stored alongside the record of which policies you accepted and when, because that is what makes the acceptance evidence.
• Payment data. We do not store full credit card numbers. Payments are processed via our third-party provider, Stripe, which tokenises your data.

3. How we use your information

• Service delivery. To connect customers with Suppliers and facilitate the physical recovery or repair service.
• Communication. To send status updates about your booking by email and as messages inside the platform. We do not send marketing, and we do not currently send SMS or app push notifications. If your browser asks whether to show you alerts, that is your own browser’s notification feature, shown only if you switch it on and handled entirely on your device.
• Operations. To process payments, manage disputes, and maintain platform security.
• Compliance. To meet legal obligations, including tax reporting and responding to lawful requests from authorities.

4. Data sharing and third parties

Supplier sharing. We share your location, vehicle details and contact number with the assigned Supplier, only for the purpose of completing your requested service. Your exact coordinates are not released to a Supplier until payment has been authorised and the job is theirs.

The third parties we use.

• Stripe — card payments and Supplier payouts. Card details are entered directly into Stripe and never reach our servers. Supplier bank details and identity verification are collected and held by Stripe, not by us.
• Amazon Web Services (S3) — storage of Supplier verification documents and any photographs attached to a job. Stored in the London (eu-west-2) region, encrypted, with no publicly reachable address.
• OpenRouteService — address search and route calculation. Receives the address text you type and the coordinates involved.
• Google (Geocoding API) — a backup for address lookup, used only if OpenRouteService is unavailable.
• OpenFreeMap — the map tiles themselves. These are fetched by your own browser, so your IP address and the area of the map you are viewing reach that service directly.
• ip-api.com — used once, server-side, to suggest an approximate town from your IP address before you grant precise location. Receives your IP address only.
• DVSA (MOT History API), via Microsoft’s sign-in service — receives a vehicle registration number when a plate is looked up.
• Our email provider — delivers the notification emails described above.

We do not use analytics, advertising or tracking services of any kind.

Transfers outside the UK. Some of these providers process data outside the UK. Where that happens we rely on the safeguards permitted under UK data protection law, including the UK Addendum to the EU Standard Contractual Clauses and adequacy decisions where they apply.

Legal requirements. We may disclose your information if required to do so by law, or in the good-faith belief that it is necessary to comply with legal process.

5. Data security

We implement technical and organisational measures appropriate to the data we hold. In particular: all traffic to the platform is encrypted in transit (HTTPS); passwords are stored only as salted one-way hashes and never in a readable form; uploaded identity and insurance documents are stored encrypted, have no publicly reachable web address at all, and can be retrieved only by the Supplier who uploaded them or by an administrator; access to administrative functions is restricted by role; and consequential administrative actions are written to an append-only audit record.

6. Your rights under UK GDPR

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request that we correct inaccurate or incomplete data.
• Erasure. Ask us to delete your data. We will assess each request against the records we are required to keep — payment and tax records in particular, and anything needed to defend a claim — and tell you what we can and cannot remove.
• Restriction. Request that we limit the processing of your data in certain circumstances.
• Portability. Request that your data be transferred to another service provider.

7. Data retention

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by UK law — for example, keeping financial transaction records for HMRC compliance for up to six years.

In practice, today:

• Messages sent through the platform are deleted automatically after 12 months.
• Accounts, jobs, payment records, uploaded documents and enquiries are retained for as long as the account exists and for as long afterwards as we are required or reasonably need to keep them. We are in the process of setting defined retention periods for each of these and will publish them here.
• Live location is not kept as a history — see section 8a.

8a. Location data

Customers. Your location is taken once, when you press “use my location”, and only if you tick the box consenting to share it. It is stored against that job as a single point so a Supplier can find you. You are not tracked continuously at any point. Before you grant precise location we may also suggest an approximate town from your IP address; that is a single lookup and is not stored as a location history.

Suppliers. A Supplier’s live position is sent to us only while they hold a job that has been accepted and is in progress, at intervals of a few seconds, so that the customer on that job can watch them approach. It is visible to that customer, to the Supplier, and to our administrators. It stops when the job ends or when the Supplier goes offline.

No location history is kept. Each new position replaces the last one; there is no trail of where a Supplier has been. The single exception is the arrival position for a job, which is retained with that job as evidence that the Supplier attended, because payment and any dispute turn on it.

8. Cookies and browser storage

We do not set any cookies of our own, and we use no analytics, advertising or tracking technologies.

The platform stores a small amount of information in your own browser, which never leaves your device except when your browser sends it back to us to keep you signed in:

• Sign-in tokens (local storage). Set only when you sign in, and removed when you sign out. Strictly necessary — without them you would be signed out on every page.
• An unfinished help request (session storage). If you fill in the request form while signed out, what you typed is held for the length of that browser tab so it is not lost while you sign in, and is deleted as soon as it is used.
• An alert preference (local storage). Suppliers only: whether they have muted the new-job sound.

Stripe. When you reach the payment step, Stripe’s own payment form sets cookies used to prevent card fraud. These are set by Stripe, are governed by Stripe’s privacy policy, and are not set on our marketing pages or before you sign in.

You can clear any of this at any time through your browser settings. Clearing it will sign you out.

9. Contact us

For any questions regarding this Privacy Policy, or to exercise your data rights, please contact our privacy contact at:

Email: admin@picklebreakdown.co.uk
IN A PICKLE BREAKDOWN LTD, 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE

10. Automated decisions about Suppliers

Two decisions affecting a Supplier’s account are made automatically by the platform, without a person reviewing them first:

• Suspension after repeated abandoned jobs. A Supplier who accepts jobs and then withdraws from them accrues a record of it, and at the published threshold the account is suspended and taken offline. Withdrawals on safety grounds, and withdrawals because the booking information was materially inaccurate, are not counted.
• Deactivation when insurance expires. A Supplier whose public liability cover reaches its expiry date is taken offline until valid cover is supplied. Advance warnings are sent at intervals beforehand.

Both are reversible. Each is recorded with its reason, and a Supplier may ask us to review the decision and have it looked at by a person — contact us at the address in section 12. Whether a Supplier is offered a particular job is decided only by their distance from it, whether they are available, and whether their approved capabilities cover the work: there is no scoring, ranking or profiling of Suppliers.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Changes to this policy

We may update this Privacy Policy from time to time. Any significant changes will be notified to you on the website or by email. Continued use of our platform after such changes constitutes your acceptance of the updated policy.