Privacy policy

This page explains which personal data The Warehouse uses to service your car at home, why, who it is shared with, how long it is kept and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the Belgian law of 30 July 2018.

1. Data controller

We have not appointed a data protection officer (DPO): it is not mandatory for our activity. For any question, write to [email protected].

2. The data we use

Your customer account

• First name, last name, email address, phone number, address
• Password: never stored in plain text (PBKDF2 encrypted hash)
• Your notification preferences (email, SMS)

Your bookings and jobs

• Job address, date and time slot, services chosen, notes
• Your vehicle: make, model, engine, year, chassis number (VIN), mileage
• The service report: arrival and finish times, work done, parts replaced, the mechanic's observations and recommendations
• Photos taken during the job and the odometer photo
• The invoice and service history (digital service book)

Payment

• Payment is processed by Stripe. We never see your card number. We only keep the amount, date, payment status and Stripe reference.

Live tracking

• The GPS position of the mechanic (not yours) on the way to you, to show the arrival time. It is deleted at the latest 2 hours after its last update.
• Your address is converted into geographic coordinates to calculate the route.

Your reviews

• Your rating, your message and, only if you agree, the publication of your first name, rating and message on our site.

Your messages

• Contact form and business fleet requests: name, email, phone, company, message content.

Security and audience measurement

• A log of our team's actions in the pro area, with approximate city and country and device type. The IP address is truncated.
• In-house audience measurement: for each page viewed, the time, the page, the referring site, the country, region and approximate city and the network operator (worked out by our host at the time of the visit), the type of device and browser, the screen width, any advertising campaign you arrived from and the ad keyword, the exact page of the referring site (without its parameters), the time spent on the page and how far it was read, and the actions taken on the page (click to call, booking steps, services and car category chosen, questions opened, technical errors). No cookie, no identifier, no IP address: it is impossible to recognise you from one day to the next (only pages viewed within the same half hour, from the same device, place and network, can be grouped together approximately).

3. Why, and on what legal basis

• Booking and carrying out your service (account, booking, job, live tracking, report, photos, service book, tracking emails and SMS): performance of the contract (art. 6.1.b GDPR).
• Reminding you of a booking you started but did not pay: a single email, about 40 minutes later, with a link to finish it (no other reminder after that); our team gets a copy so we can help you. Our legitimate interest in completing the booking you started (art. 6.1.f GDPR).
• Invoicing and keeping our accounts: legal obligation (art. 6.1.c GDPR).
• Advising you on upcoming maintenance in your customer area: our legitimate interest in following up on your vehicle (art. 6.1.f GDPR). If we send you a reminder by email, you can refuse it at any time.
• Publishing your review on our site: your consent (art. 6.1.a GDPR), which you can withdraw at any time.
• Securing our tools and preventing fraud (team action log): our legitimate interest (art. 6.1.f GDPR).
• Measuring site audience: our legitimate interest, with no data that can identify you.

We never sell, rent or trade your data. We do no targeted advertising and no profiling.

4. Who receives your data

Only our team (the mechanic doing the job and the manager) and the providers below, each for its own task only and under contract:

• Cloudflare: site hosting, database, photo storage, generation of your vehicle illustration (from make and model only)
• Stripe: online payment and refunds
• Resend: sending emails (confirmation, tracking, invoice, report)
• Twilio: sending tracking SMS, if this service is enabled
• OpenStreetMap (Nominatim): converting the job address into coordinates
• OSRM or Mapbox: calculating the mechanic's route (coordinates only)
• Esri (ArcGIS): map background shown on the tracking page
• Parts suppliers: only the vehicle information (VIN, make, model) needed to order the right part
• Our accountant and, where required by law, the authorities (tax administration, courts)

5. Transfers outside the European Union

Some providers (Cloudflare, Stripe, Resend, Twilio, Esri, Google for icons and, with your consent, audience measurement) are based in the United States or may process data there. These transfers are covered by the EU–US Data Privacy Framework or by the standard contractual clauses adopted by the European Commission.

6. How long we keep it

• Account and service history (vehicles, reports, photos): as long as your account exists. You can delete it yourself at any time from your customer area. An account with no sign-in, booking or job for 3 years is deleted automatically, after a reminder email sent 30 days before (simply signing in keeps it).
• Invoices and accounting records: 7 years, as required by Belgian accounting law, even if you delete your account.
• Mechanic's GPS position: 2 hours maximum.
• Coordinates calculated from an address: 30 days.
• Published reviews: until you ask for their removal.
• Messages and requests without follow-up: 3 years after the last exchange.
• Team action log: the last 500 actions, 12 months maximum.
• Audience statistics: anonymous visit log 30 days, totals 120 days.

7. Your rights

You can at any time:

• access your data and get a copy;
• correct it (most of it can be edited directly in your customer area);
• erase it: “Delete my account” button in your customer area, except for invoices the law requires us to keep;
• restrict its use or object to processing based on our legitimate interest;
• retrieve it in a readable format (portability);
• withdraw your consent, for example so that a review is no longer shown.

Write to [email protected]. We reply within one month at most. We may ask you to prove your identity if we have reasonable doubt.

8. Complaints

If you believe we are not respecting your rights, you can lodge a complaint with the Belgian Data Protection Authority:

9. Cookies

Our site uses no advertising cookies. Google Analytics (traffic measurement) sets cookies only if you accept it in the banner; without consent, it is not loaded. Otherwise, the site only keeps on your device what it needs to work (your login, your language, your cookie choice). Details, and the option to change your mind, are on our Cookies page.

10. Security

The site is served over HTTPS only. Passwords are encrypted, photos are only accessible through signed links, team access is protected by login and role (manager or mechanic), and every team action is logged. No system is infallible: in the event of a data breach that puts you at risk, we will inform you and notify the Data Protection Authority within the legal deadlines.

11. Changes

We may update this policy as our service evolves. The last update date is shown below. For any significant change, we will let you know by email or in your customer area.

Last updated: 30 September 2026