Privacy Policy

Last updated: [date]

This Privacy Policy explains how VP&P – Vehicle Protection & Performance ("VP&P", "we", "us") handles personal information when you use this website, email us, or book fitting, diagnostics or related services.

We are a sole-trader business. Details are on our Legal & Business Details page.

Please have this policy checked by a suitable adviser before launch.

1. Who is responsible for your data

Data controller (for VP&P’s own activities): Beau Simpson trading as VP&P – Vehicle Protection & Performance.
Contact: vehiclepp@proton.me
Address: Rochford, Essex

ICO registration: [ICO registration number] — [confirm whether registration applies, or state if an exemption applies].

Meta Trak’s role (to confirm)

When we fit a Meta Trak system, Meta Trak provides the tracking hardware/service, app, subscription and (for relevant systems) 24/7 Secure Operating Centre support. Location data and related account data for the tracker are handled in connection with Meta Trak’s service.

[Meta Trak’s role: confirm whether Meta Trak acts as an independent data controller and/or a processor for tracker location, app account and subscription data after install — VP&P does not invent this; confirm with Meta Trak / your adviser. Until confirmed, treat Meta Trak as a separate organisation with its own privacy notice at metatrak.co.uk.]

We do not control Meta Trak’s systems. You should also read Meta Trak’s privacy information for how they use tracker and app data.

2. What we collect

Depending on how you contact us, we may collect:

• Identity and contact details (name, email, phone)
• Vehicle details (make, model, year, registration if you give it)
• Enquiry and booking details (service required, insurer requirements, preferred fitting location, messages you send)
• Address or postcode for mobile fitting
• Payment and invoice details if you buy from us ([payment provider details if used])
• Complaint correspondence
• Limited technical data from the website (see our Cookie Policy)

We do not run advertising or analytics tracking scripts on this website at present.

3. Location and tracker-related data

Fitting a tracker means the system can process vehicle location and related telemetry (for example movement alerts), according to the product and Meta Trak’s service.

• Before and during fitting: we may use vehicle and contact details you give us to recommend a system, book and carry out the install, and help with insurer paperwork.
• After fitting: ongoing tracking, app access, stolen-vehicle support and subscriptions are provided under Meta Trak’s terms and privacy arrangements. [Confirm with Meta Trak what VP&P can still access after handover, if anything.]

We will not ask you for Meta Trak app passwords. Do not send sensitive login credentials by email.

3A. Fleet portal (fleet customers only)

If your business is a fleet customer, we may give you a login to our fleet portal. The portal shows your fleet's tracker installs and subscriptions. It does not hold or show vehicle locations or live tracking. For live tracking, use the Meta Trak app.

What the portal holds

• Portal account details: the email address of each person we give a login, their role, and a password stored only as a salted one-way hash (we cannot see your password)
• Your fleet or company name
• For each vehicle: registration, make and model, which Meta Trak system is fitted, the tracker install date, and the subscription start and end dates
• Any short notes we add about a vehicle (we never record where a tracker is hidden)
• Security records: sign-in sessions (stored as a one-way hash and deleted when they expire), short-lived counters of sign-in attempts (by IP address and a one-way hash of the email address) used to block password guessing, and a log of sign-ins and changes made in the portal

Why we hold it: to give you one place to see each vehicle's tracker, install date and subscription, to flag renewals that are due, and to keep the portal secure.

Lawful basis: contract, because we provide the portal as part of our service to your business. [Confirm with your adviser: legitimate interests for security logs and sign-in protection.]

Where it is stored: on Cloudflare, which hosts this website and the portal database for us. [Confirm the Cloudflare D1 database location chosen at set-up and the transfer safeguards that apply.]

How long we keep it: [Portal retention — e.g. account and vehicle records while you remain a fleet customer and X months after; security logs X days. Fill in before launch.] Sign-in sessions end after 8 hours, or 2 hours without activity.

Security: the portal is HTTPS only. Each fleet can see only its own vehicles. Only VP&P (and, if enabled, your own fleet admin) can add or change records. Passwords are hashed with a unique salt per user, sign-in attempts are rate-limited, and the sign-in cookie is secure and cannot be read by page scripts.

Cookie: signing in sets one strictly necessary cookie (__Host-vpp_portal) that keeps you signed in. It is not used for tracking or advertising. See our Cookie Policy.

Your rights: you can ask us to see, correct, export or delete your portal data, or to close a portal login, by emailing vehiclepp@proton.me. Closing a portal login does not cancel or change your Meta Trak subscription. Your other rights are set out in section 8.

4. Why we use your information (lawful bases)

We use personal data to:

• Respond to enquiries and provide quotes (legitimate interests / steps before a contract)
• Enter into and perform a contract for fitting or other services (contract)
• Meet legal obligations (e.g. tax, consumer law) (legal obligation)
• Handle complaints and protect our legal position (legitimate interests / legal obligation)
• With your consent where we ask for it (e.g. optional marketing — we do not currently run a marketing list) (consent)

5. Who we share information with

We do not sell your information. We may share what is necessary with:

• Meta Trak — to register/commission a system, subscriptions, certificates and support (see section 1)
• Professional advisers (e.g. accountant, insurer, solicitor) if required
• Police or insurers where you ask us to help, or where we are legally required to do so
• IT / email providers that host our communications ([email/hosting provider names])
• Cloudflare — hosts this website and, for fleet customers, the fleet portal database (see section 3A)

6. International transfers

[Confirm whether any tools you use store data outside the UK, and if so what safeguards apply.] Our public site is static. Email to vehiclepp@proton.me is handled by Proton — see Proton’s documentation for where mail is processed.

7. How long we keep information

We keep enquiry and customer records only as long as needed for the purpose, including legal and accounting needs.

[Retention periods — e.g. enquiries X months if no booking; customer/install records X years; complaint records X years. Fill in before launch.]

8. Your rights

Under UK GDPR you may have the right to access, rectify, erase, restrict or object to certain processing, and to data portability, where applicable. You may withdraw consent where we rely on consent.

To exercise rights, email vehiclepp@proton.me. We may need to verify your identity.

You can complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/ · [ICO registration number].

9. Children

Our services are aimed at adults arranging vehicle work. We do not knowingly collect children’s data.

10. Changes

We may update this policy. The “Last updated” date will change when we do. Material changes will be reflected on this page.

11. Contact

Questions about this policy: vehiclepp@proton.me · Rochford, Essex