Privacy Policy

Who we are

Base Cosmetics is a mobile SMART repair business serving Sunderland and the North East. Steven Kibble, trading as Base Cosmetics, is the controller responsible for the personal information described in this notice.

For privacy enquiries or to exercise your rights, email info@basecosmetics.co or telephone 07977 209 526.

Information we collect

When you contact us through WhatsApp, telephone, email or Instagram, we collect the information you provide to assess your enquiry and arrange repairs. This can include contact details, your address, vehicle registration details, repair photographs, correspondence and booking information.

We also keep repair, invoicing and payment-status records relevant to the work we carry out. Dealerships do not supply their customers’ personal information to us.

Why we use your information

• Enquiries, quotations and bookings: to assess damage, discuss suitable work and arrange appointments. Our lawful basis is taking steps at your request before entering into a contract, or performing our contract with you.
• Carrying out repairs: to locate the vehicle, communicate about the work and document the agreed repair. Our lawful basis is performing our contract.
• Accounting and tax records: to issue invoices and meet applicable record-keeping duties. Our lawful basis is legal obligation.
• Repair history, complaints and disputes: to maintain proportionate evidence of work and handle issues fairly. Our lawful basis is our legitimate interest in managing and protecting our business, balanced against your rights.
• Website and social-media photographs: where these contain personal information, we rely on your consent for promotional publication.

If you do not provide the information needed to assess or arrange a repair, we may be unable to provide a quotation or complete the booking.

We do not send promotional messages or newsletters.

Repair photographs

We keep photographs to assess and document repairs. We also ask permission before using repair photographs on our website or social media.

We do not publish customer addresses or vehicle registration plates.

Permission for promotional use is optional and does not affect the repair service. You can withdraw permission by contacting us. We will stop future use and remove the relevant photographs from channels we control. Withdrawal does not affect the lawfulness of use before permission was withdrawn.

Storage, payments and service providers

We use the following services to communicate with customers and operate our business:

• GoDaddy for business email.
• Xero for customer, invoicing and accounting records.
• Apple iCloud to back up our phone photo library.
• WhatsApp and Instagram for customer communications.
• Stripe and Monzo for payment and banking services. We also accept bank transfers.
• ChatGPT Sites and its Cloudflare infrastructure to host and deliver our website.

These services process information relevant to the functions they provide. Payment providers and banks also process information under their own privacy notices and legal obligations.

We have not granted an external accountant or other person outside the business access to our customer invoices or Xero records. This does not exclude processing by the service providers described above.

International processing

Some providers operate internationally and may process information outside the UK. Their published privacy notices describe the applicable arrangements, which may include UK-recognised adequacy arrangements or approved contractual safeguards.

You can contact us for further information about the providers relevant to your information and the applicable safeguards.

How long we keep information

• Unsuccessful enquiries and associated photographs: normally two months after the last contact, unless you request a later follow-up.
• Completed-job records: normally six years after completion, limited to information needed for repair history and potential disputes.
• Invoices and tax records: until the applicable statutory retention periods have expired. This normally means at least six years for VAT records and at least five years after the relevant 31 January Self Assessment filing deadline; where both apply, we use the later date.
• Repair-record photographs: normally two years after completion, unless needed for an unresolved complaint, claim or another documented purpose.
• Selected promotional photographs: reviewed annually and retained while genuinely useful and the relevant permission remains valid.

We may retain relevant records longer where required by law or necessary for an unresolved dispute. Information no longer needed will be deleted or anonymised.

Cookies and website security

We have not enabled website analytics or advertising pixels.

Our website uses Cloudflare security services. A cookie called __cf_bm helps distinguish automated traffic from genuine visitors and protect the website. Cloudflare states that this cookie expires after 30 minutes of inactivity.

Hosting and security services process technical connection information to deliver and protect the website. Our purpose is to operate a reliable, secure website, based on our legitimate interests in protecting the service and its visitors.

Links to WhatsApp, Instagram and Google take you to external services, whose own privacy and cookie notices apply.

Your rights

Depending on the circumstances and our lawful basis, you may have rights to:

• Access your personal information.
• Have inaccurate information corrected.
• Request deletion or restriction of use.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format.
• Withdraw consent where we rely on it.

These rights are not absolute. For example, we may need to retain records to meet tax obligations.

Contact us using the details above to make a request or raise a concern. We may need to verify your identity before disclosing information.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

Changes to this notice

We will update this notice when our practices or relevant requirements change. The published page will show its latest revision date.