Privacy Policy

Last updated: 1 July 2026

This Privacy Policy explains how Refinish Limited collects, uses, stores and shares personal data when you visit our website, contact us, request an estimate, upload repair information, book a repair, make a payment, use a payment link, or otherwise use our services, in accordance with the UK GDPR and the Data Protection Act 2018.

In this policy, "we", "us" and "our" means Refinish Limited. "You" means the customer, vehicle owner, authorised representative, payer, third-party payer, website visitor, or person contacting us.

Refinish Limited provides vehicle body repair and refinishing services. We do not operate an online shop through our website or payment links. Payment links are used to collect payment for agreed vehicle repair services, repair deposits, parts deposits, invoices, balances, or payments from third parties who have agreed to pay for damage.

Who we are

Refinish Limited
Unit 7 Kings Court
9 Glen Tye Road
Broadleys Business Park
Stirling
FK7 7LH
United Kingdom

Email: mail@refinish.ltd.uk
Telephone: 01786 446411

Refinish Limited is the data controller for the personal data we collect and use for our business services.

Payment providers, banks, card issuers, PayPal, Apple Pay, Google Pay and similar payment services may also process your personal data under their own privacy terms.

Personal data we collect

Depending on how you deal with us, we may collect and use:

• your name;
• address;
• email address;
• telephone number;
• vehicle make, model, registration number and vehicle details;
• repair enquiry details;
• photographs of vehicle damage;
• estimate, booking, repair and invoice details;
• payment status and payment confirmation details;
• details of third-party payers, insurers, accident circumstances or claim references, where relevant;
• messages, emails, telephone notes and other communications with us;
• information needed to manage complaints, disputes, unpaid invoices, chargebacks or legal issues;
• technical information when you use our website, forms or payment links, such as IP address, browser type, device information and cookie data.

We do not normally need special category data, such as health information. If you choose to provide information of that type, we will only use it where necessary for the specific purpose for which it was provided.

How we collect personal data

We may collect personal data:

• directly from you when you contact us, complete a form, request an estimate, book a repair, upload photos, make a payment, or send us information;
• from a vehicle owner, authorised representative, third-party payer, insurer, broker, engineer, solicitor, accident management company, or other person involved in a repair, claim or payment;
• through our website, online forms, payment links, booking systems, email, telephone, CRM system, estimating software, file upload tools and payment providers;
• from payment providers such as Worldpay or other payment services when a payment is attempted, approved, declined, refunded, disputed or charged back.

Why we use personal data

We use personal data to:

• respond to enquiries;
• prepare repair estimates;
• assess vehicle damage;
• book vehicles in for inspection or repair;
• order parts and materials;
• carry out vehicle repairs;
• manage customer communication;
• send estimate updates, booking updates, repair updates and payment requests;
• issue payment links, invoices, receipts and refunds;
• process deposits, balances and third-party payments;
• confirm payment status;
• manage cancellations, disputes, complaints and chargebacks;
• keep accounting, tax, VAT and business records;
• meet legal, regulatory, insurance and payment provider requirements;
• protect the business from fraud, misuse, unpaid invoices and payment disputes;
• improve our customer service and internal processes;
• send service-related messages about your enquiry, estimate, booking, repair or payment.

We may also send marketing or follow-up communication where we are allowed to do so. You can ask us to stop sending marketing messages at any time.

Lawful basis for using personal data

Under the UK GDPR, we use personal data under the following lawful bases:

Contract

We use personal data where it is necessary to provide an estimate, booking, repair, invoice, payment link, refund, or related service.

Legal obligation

We use personal data where we need to keep records for tax, accounting, VAT, legal, regulatory, insurance or payment compliance reasons.

Legitimate interests

We use personal data where it is necessary for the normal running of our business, including responding to enquiries, managing customer communication, preparing estimates, preventing fraud, protecting against unpaid invoices or chargebacks, maintaining repair records, resolving disputes, improving services, and keeping evidence of repair and payment activity.

Consent

We use consent where we rely on your permission for a specific purpose, such as certain marketing activity or where required by law. You can withdraw consent where consent is the lawful basis.

Payment data

Payment links are processed through Worldpay or other payment providers.

We do not store full card details.

We may receive payment-related information such as your name, payment amount, transaction reference, payment status, refund status, payment method type, fraud check result, or dispute/chargeback information.

Your bank, card issuer, PayPal, Apple Pay, Google Pay, Worldpay or other payment provider may process your data under their own terms and privacy policies.

Who we share personal data with

We may share personal data with:

• payment providers, including Worldpay;
• banks, card issuers, PayPal, Apple Pay, Google Pay or other payment services;
• CRM, booking, form, file upload, email and business software providers;
• estimating, invoicing and accounting software providers;
• insurers, engineers, claims handlers, accident management companies or solicitors, where relevant to a repair or claim;
• parts suppliers, where needed to identify, price or order parts;
• professional advisers such as accountants, legal advisers or IT support;
• debt recovery or legal services where an invoice remains unpaid;
• regulators, public authorities, courts, HMRC, law enforcement or other organisations where required by law.

We only share information where necessary for the relevant purpose.

Business systems we use

We use third-party systems to help manage enquiries, estimates, bookings, payments, files, customer records, accounting and communication.

These may include systems such as Worldpay, Capsule CRM, Jotform or other form providers, Quotient, Appointedd, Dropbox, Microsoft 365/Outlook, Xero, Audatex, GT Motive, telephone answering services, AI receptionist services, and other service providers used in the normal running of the business.

These providers may process personal data on our behalf or under their own terms, depending on the service they provide.

Website forms and file uploads

If you complete a website form, request an estimate, upload photos, or send repair details, we will use that information to assess your enquiry, prepare an estimate, contact you, manage the repair process, and keep appropriate business records.

Photographs of vehicle damage may include number plates, vehicle identifiers, background images, reflections, or other information. Please avoid uploading unnecessary personal information.

Third-party repair payments

Where a third party has agreed to pay for damage they have caused, we may collect or use their contact and payment information to arrange payment.

Unless we have agreed otherwise in writing, the person authorising the repair remains responsible for ensuring the repair is paid for.

We may keep records of third-party payment arrangements, payment links, payment confirmations, disputes and chargebacks where necessary for business, legal or payment protection purposes.

International transfers

Some service providers may process or store data outside the United Kingdom.

Where this happens, we expect appropriate safeguards to be used, such as UK-approved transfer mechanisms, adequacy arrangements, contractual protections, or other lawful safeguards.

How long we keep personal data

We keep personal data only for as long as necessary for the reason it was collected.

As a general guide:

• enquiry information may be kept for as long as needed to respond to the enquiry and manage follow-up;
• repair, estimate, invoice, payment and accounting records are normally kept for at least 6 years where required for business, tax, VAT or accounting purposes;
• repair photos, estimate records and communication history may be kept for as long as reasonably needed for repair records, customer service, warranty queries, disputes, complaints, insurance matters or legal claims;
• payment dispute and chargeback information may be kept for as long as needed to deal with the dispute and maintain proper business records;
• marketing data is kept until you unsubscribe or ask us to stop, unless we have another lawful reason to keep limited records.

We may keep information for longer where required by law, HMRC, a dispute, complaint, unpaid invoice, insurance matter, chargeback, legal claim or regulatory requirement.

Security

We take reasonable steps to protect personal data from loss, misuse, unauthorised access, disclosure or alteration.

However, no system is completely secure. Please avoid sending full card details or highly sensitive information by email, text message, social media message or other unsecured channels.

We will never ask you to send full card details by email, text message or social media message.

Cookies and website data

Our website, online forms, emails and payment links may use cookies or similar technologies.

These may be used to operate the website or payment page, improve performance, understand usage, prevent fraud, support security, or provide functionality.

You can usually control cookies through your browser settings. Blocking cookies may affect how some website, form or payment features work.

Worldpay and other third-party services may also use cookies or similar technologies when you use their payment pages or services.

For more detail, see our Cookie Policy.

Embedded content and third-party links

Our website may include links to third-party websites or embedded content, such as maps, forms, reviews, booking tools, payment pages or file upload tools.

Third-party websites and services may collect information about you under their own privacy policies. We are not responsible for the privacy practices of third-party websites or services that we do not control.

Marketing

We may contact you about services, updates or relevant follow-up information where permitted by law.

You can ask us to stop sending marketing communication at any time by contacting us at mail@refinish.ltd.uk.

We will still send non-marketing messages where necessary, such as messages about estimates, bookings, repairs, payment links, invoices, refunds, cancellations or disputes.

Your rights

Under the UK GDPR and Data Protection Act 2018, depending on the circumstances, you may have the right to:

• request access to your personal data;
• ask us to correct inaccurate personal data;
• ask us to delete personal data;
• ask us to restrict how we use your personal data;
• object to certain uses of your personal data;
• request a copy of your personal data in a portable format;
• withdraw consent where we rely on consent;
• complain to us about how we use your personal data;
• complain to the Information Commissioner's Office.

These rights are not absolute and may depend on the reason we hold the information.

For example, we may need to keep certain records for tax, accounting, legal, payment dispute, chargeback or business record purposes.

Data protection complaints

If you are concerned about how we use your personal data, please contact us first so we can try to resolve the issue.

You can make a data protection complaint by emailing mail@refinish.ltd.uk or writing to us at the address below.

We will acknowledge data protection complaints within 30 days and respond without undue delay.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office, which is the UK data protection regulator.

Contact us

For questions about this Privacy Policy, to exercise your data protection rights, or to make a data protection complaint, contact:

Refinish Limited
Unit 7 Kings Court
9 Glen Tye Road
Broadleys Business Park
Stirling
FK7 7LH
United Kingdom

Email: mail@refinish.ltd.uk
Telephone: 01786 446411