Privacy policy

Every enquiry route on this site uses the same form: booking a mechanic, requesting a quote, requesting a part, booking an inspection, roadside assistance, a fleet enquiry and the general contact page. Only a name and one way to reach you are required. The rest of the fields exist to make the first reply useful instead of a list of follow-up questions.

What you can enter, and what it is for

• Your name, phone number and email address. So a person can reply. At least one of the phone number and the email address is needed, or there is no way to answer you.
• A WhatsApp preference. A yes or no recording whether you are happy to be contacted about this enquiry on WhatsApp.
• The service, city or workshop you selected. So the enquiry reaches the right people and the right diary.
• Where the car is, and an area or landmark. To work out whether a doorstep visit is possible and how long it would take. This is a free-text note, not a tracked location, and the site never asks your browser for your position.
• Vehicle make, model, year and registration. To source the correct parts and to identify the vehicle when you call about it. Registration is optional.
• A description of the problem, and a preferred day and time. To diagnose sensibly and to schedule around you.

Please do not put payment card details, identity document numbers or anything else sensitive into the free-text fields. Nothing on this site asks for them, and no legitimate message from us ever will.

Each submitted enquiry is given a short reference code beginning with ICM. That code is shown on screen and is the easiest way to refer to your enquiry later, including when asking for it to be deleted.

Your network address reaches our server with every request, as it does with every website. We never write it to the database. Before anything is stored, the address is combined with a secret salt that is held only on the server, put through a one-way SHA-256 hash, and truncated to 32 characters.

The result cannot be turned back into an address. It can only be compared against another hash made the same way, which is exactly enough to answer the question we need answered, namely whether two requests came from the same place. It is not enough to tell us where you are or who you are.

For analytics the protection goes further. The date is mixed into the hash input as well, so the value changes every day and cannot be used to follow the same visitor from one day to the next. And for an ordinary page view the hash is computed and then deliberately not stored against the record at all.

Two cookies, both first-party. Neither is used for advertising, and no cookie on this site is shared with anyone else.

The attribution cookie

Named icm_attr. It is set once, on your first visit, and only if you do not already have one. It holds the page you landed on, the referring site if there was one, any UTM campaign parameters from the link, and the time it was created. It does not contain your name, your address or an identifier for you.

It is marked HttpOnly, so page scripts cannot read it, uses SameSite Lax, is sent over HTTPS in production, and expires after 30 days. If you send an enquiry while it exists, its contents are copied onto that enquiry so we know which route brought you to us.

The staff session cookie

A session cookie is issued only when a member of staff signs in to the administration area. It keeps that person signed in and is of no relevance to ordinary visitors, who never receive one.

You can clear or block both cookies in your browser. Blocking the attribution cookie does not affect the site or your ability to send an enquiry. It only means we cannot tell where that enquiry came from.

Enquiries. An enquiry is kept while it is live and afterwards as a record of the work, because a repair history is the most useful thing to have when the same car comes back. We have not fixed a deletion schedule for these records yet. When we do, it will be written here. In the meantime, ask and we will delete yours.

Daily analytics totals. These contain no personal data, only counts against a date and a page path, so they are kept as a long-term record of how the site performs.

Conversion and performance records. These hold a day-scoped hash and a broad device type, and are kept for measurement.

The attribution cookie. Expires 30 days after it is set, and is removed the moment you clear cookies in your browser.

You can ask us to:

• tell you what we hold about you;
• correct anything that is wrong;
• delete your enquiry and the contact details attached to it;
• stop contacting you about a particular enquiry;
• stop contacting you on WhatsApp while still replying by phone or email.

Send the request through the contact form. Include the reference code beginning with ICM if you have it, because it makes finding the right record immediate. If you do not have it, the phone number or email address you used is usually enough.

We will act on a deletion request. Two things cannot be reversed: aggregate analytics totals, which never contained anything about you individually, and hashed values, which cannot be traced back to a person to be found and removed. Where an enquiry is tied to work we are still doing or still owed for, we may keep the minimum needed to finish that, and we will tell you exactly what that is.