Privacy Policy For Injection Development

This notice explains, in plain language, how we collect and use personal information about customers, prospective customers, website visitors and business contacts, and the choices and rights available to you.

This policy is effective from 9th Novemeber 2026.

Who we are

Injection Development (Canterbury) Limited is the data controller for the personal information described in this notice. This means we decide why and how that information is used.

Company number: 05702294

Trading address: Unit 4, Canterbury Industrial Park, Hersden, Canterbury, Kent, CT3 4HQ

Registered office: 10 Littlebourne Road, Maidstone, England, ME14 5QP

Email: enquiries@injection-development.co.uk

Telephone: 01227 832 300

Please use these details for questions, information-rights requests or data-protection complaints. We have not appointed a statutory data protection officer; responsibility rests with our management team.

Who and what this notice covers

This notice applies when you enquire about, book or use our vehicle servicing, MOT, diagnostic, repair or related services; communicate with us; visit our premises; use our website; apply for finance through a provider we introduce; take part in a survey or loyalty activity; or leave or are invited to leave feedback or a public review.

It covers information about individual customers and contacts at businesses. It does not replace the separate privacy information of independent organisations such as Google, Meta/WhatsApp, finance providers or payment providers when they use information for their own purposes.

Personal information we collect

Depending on your relationship with us, we may collect:

identity and contact details, including your name, address, email address, landline and mobile or WhatsApp number;
vehicle information, including registration number, make, model, mileage, vehicle identification number, MOT and service information, keys and information about the vehicle's condition;
booking, quotation, estimate, invoice, payment and account information;
service, repair, diagnostic and job information, including your instructions, approvals, reported symptoms, technician findings, work completed, parts used, photographs and relevant communications;
warranty, complaint, incident, insurance or claim information;
customer-feedback information, including review-request history, delivery status, opt-out status, public Google review content, star rating, reviewer name and any reply we publish;
website and technical information, including IP address, browser and device information, pages viewed, referring website, cookie identifiers and security logs;
CCTV images where CCTV is operating and signage is displayed at our premises; and
correspondence and records of calls, emails, forms, messages and conversations with us.

Please do not send us unnecessary sensitive information. In particular, free-text job notes or messages should not contain health information, criminal-offence information, financial account credentials or information about children unless it is genuinely necessary and we have asked for it. If such information is provided incidentally, we will restrict and minimise its use.

Where we obtain information

We obtain personal information directly from you when you contact us, make a booking, bring in a vehicle, approve work, pay an invoice, use our website, respond to a message or submit feedback. We may also receive it from:

another driver, vehicle owner, family member, employer, fleet operator or business contact acting with authority in relation to the vehicle or service;
manufacturers, parts suppliers, warranty providers, insurers, roadside-assistance providers or other garages where needed to provide or investigate a service;
payment, accounting or finance providers in connection with transactions you request;
Google and other public review platforms where you publish information;
our website, cookie and analytics technologies; and
public authorities, regulators, law-enforcement bodies or publicly available sources where lawful and relevant.

If you give us information about another person, please make sure you are authorised to do so and, where appropriate, bring this notice to their attention.

How we use information and our lawful bases

UK data-protection law requires us to have a lawful basis for each use of personal information. The main purposes and bases we rely on are set out below. More than one basis may apply to the same information, depending on the circumstances.

Enquiries, bookings and quotations. To respond to you, arrange appointments, identify your vehicle and prepare quotations or estimates. Lawful basis: Steps before entering into a contract; performance of a contract; our legitimate interests in managing enquiries and customer service.
Vehicle servicing, MOTs, diagnostics and repairs. To carry out requested work, record instructions and approvals, order parts, communicate progress, maintain service history and manage collection. Lawful basis: Performance of a contract; legal obligations; our legitimate interests in running a safe, efficient garage and keeping accurate records.
Invoices, payments, accounts and finance. To take and reconcile payment, keep accounting and tax records, recover sums due and, if requested, introduce or pass information to a finance provider. Lawful basis: Performance of a contract; legal obligations; our legitimate interests in financial administration and debt recovery.
Warranties, recalls, complaints and claims. To investigate issues, administer warranties or recalls, resolve complaints, establish facts and protect legal rights. Lawful basis: Performance of a contract; legal obligations; our legitimate interests in resolving disputes, maintaining standards and defending claims.
Customer feedback and Google review requests. To ask recent customers for genuine feedback, send at most one follow-up reminder, match responses or public reviews, monitor satisfaction and, if enabled, prepare or publish a reply to a review. Lawful basis: Our legitimate interests in understanding customer satisfaction, improving our services and maintaining an accurate public reputation. We carry out and keep under review a legitimate interests assessment.
Marketing and loyalty communications. To tell existing or prospective customers about relevant services, offers, events or loyalty benefits where we are permitted to do so. Lawful basis: Consent where required; otherwise our legitimate interests and, for electronic marketing, the applicable PECR rules including the soft opt-in where available.
Website operation, cookies and analytics. To operate and secure the website, remember preferences, understand website use and improve performance. Non-essential cookies are addressed through our cookie controls and Cookie Policy. Lawful basis: Our legitimate interests for essential operation and security; consent for non-essential cookies or similar technologies where required.
Premises and information security. To protect customers, staff, vehicles, equipment, systems and premises; prevent or investigate fraud, theft, misuse or security incidents; and use CCTV where signs indicate it is operating. In locations where audio is in use, relevant signage is on display. Lawful basis: Our legitimate interests in safety, security and crime prevention; legal obligations; recognised legitimate interests or other lawful bases where applicable.
Business management and legal compliance. To manage suppliers, insurers, professional advisers, audits, business continuity, regulatory enquiries and corporate transactions. Lawful basis: Legal obligations; our legitimate interests in administering and protecting the business and complying with recognised industry standards.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect anything lawfully done before withdrawal. Where we rely on legitimate interests, we consider the purpose, necessity and effect on you, apply safeguards and keep that assessment under review.

Customer feedback and Reviews

After we provide a service, we may use your name, mobile or WhatsApp number and limited relevant information about the service - for example the service date, vehicle or work category, invoice reference or a short, non-sensitive description of the work - to invite you to give genuine feedback or leave a Google review. We may send at most one follow-up reminder if you have not responded. We will not send further review requests if you opt out.

We currently use INFUSION AI, trading as Strong Reviews, as a data processor to help prepare, personalise, schedule and deliver those requests, record delivery and opt-out status, match reviews and manage replies. Strong Reviews acts only on our documented instructions and under a data-processing agreement. It may use approved messaging, hosting and technology providers, including Twilio, Meta/WhatsApp, Google and, where enabled for review replies, an AI provider. Some of these providers also act as independent controllers for their own platform operations.

We share only information reasonably needed for the review journey. We do not intentionally provide Strong Reviews with payment-card information, special-category information, criminal-offence information, information about children or unrelated free-text notes. Review requests are intended to seek honest feedback and are not conditional on giving a positive review.

If we enable automated review replies, technology may help draft or publish a response based on the public review, rating, business name and reviewer's first name. We remain responsible for the instructions and settings used. This does not involve a decision that produces legal or similarly significant effects on you.

We display public Google reviews on our website through a Google review widget. This may show the public reviewer name, star rating and review text. This is a separate use of public review information and does not mean that private customer contact details or job records are published.

Our lawful basis is our legitimate interests in measuring satisfaction, improving our service and maintaining an accurate public reputation. We keep a legitimate interests assessment for this activity. Review-request messages are kept separate from promotional offers unless we have another lawful basis and comply with the Privacy and Electronic Communications Regulations 2003.

Opting out: You can stop further review requests at any time by using the opt-out instruction in the message, replying STOP where available, or contacting us. We will keep the minimum suppression information needed to respect your choice.

Marketing communications

We may send information about our own relevant services, offers, events or loyalty benefits where you have consented or where another rule permits it, including the electronic-marketing soft opt-in for existing customers where its conditions are met. We will identify ourselves and provide an easy way to opt out.

You can withdraw consent or object to direct marketing at any time by following the unsubscribe or opt-out instruction or contacting us. We do not sell personal information or allow another business to use our customer list for its own marketing without an appropriate lawful basis and transparency.

Cookies and website analytics

Our website uses essential technologies needed for operation, security and user choices. It may also use analytics, embedded content or similar non-essential technologies. Where consent is required, these should not be activated until you choose to allow them. You can change available cookie choices through the website controls and your browser settings.

Our separate Cookie Policy provides more detail about the technologies in use, their providers, purposes and duration. Third-party websites and services linked from our website have their own privacy information, and we are not responsible for how they operate.

Who we share information with

We share personal information only where reasonably necessary and lawful. Recipients may include:

Strong Reviews and its approved subprocessors for customer-feedback and review management as described above;
website, IT, communications, hosting, cybersecurity, backup and support providers;
accounting, bookkeeping, banking, payment and debt-recovery providers, including systems such as Intuit QuickBooks where used;
finance providers such as PayItMonthly when you ask to use finance; the provider will usually act as an independent controller and will give you its own privacy information;
parts suppliers, vehicle manufacturers, warranty administrators, insurers, recovery providers, subcontractors and specialist repairers where needed for the service;
Google and other review platforms when a review or reply is published, and providers used to display public reviews on our website;
our professional advisers, auditors and insurers;
DVSA, HMRC, courts, regulators, police or other public bodies where the law requires or permits disclosure; and
a prospective buyer, seller or adviser in connection with a genuine business reorganisation, financing or sale, subject to appropriate confidentiality and safeguards.

Service providers acting as our processors must use the information only for authorised purposes, keep it secure and delete or return it in accordance with their contracts. Independent controllers determine their own purposes and must provide their own privacy information.

International transfers

Some technology, messaging, review, payment or support providers may process or make personal information accessible outside the United Kingdom, including in the United States. Where this is a restricted transfer, we require an appropriate transfer mechanism and safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with an appropriate transfer-risk assessment where required.

You may contact us for further information about the safeguards relevant to your information. Platform providers may also make transfers as independent controllers under their own privacy notices.

How we protect information

We use proportionate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures include access controls, staff confidentiality, secure systems, authentication, software and device maintenance, encrypted transmission where appropriate, supplier checks, backups where available, incident procedures and secure disposal.

No system can guarantee absolute security. If a personal-data breach occurs, we will assess the risk, take appropriate action and notify the Information Commissioner's Office and affected people where the law requires it.

How long we keep information

We keep identifiable information only for as long as reasonably necessary for the relevant purpose, including legal, accounting, safety, warranty, complaint and claims requirements. We then delete, anonymise or securely restrict it. Typical periods and criteria are below.

Enquiries and quotations that do not proceed. Usually up to 12 months after the last meaningful contact, unless needed for a complaint, dispute or legal requirement.
Customer, vehicle, booking, estimate, job, invoice, payment, warranty and complaint records. Generally six years after the relevant transaction or the end of the customer relationship. We may keep particular records longer where a warranty, safety issue, dispute, legal claim or statutory obligation requires it.
Customer feedback and review-request data processed through Strong Reviews. Our account uses a 30-day redaction setting. The period starts when the cleanup process first identifies a matched review, an opt-out or do-not-contact instruction, a completed request and follow-up sequence with nothing further scheduled or sending, or manual archiving. At the next scheduled cleanup after 30 days, phone numbers, job notes, AI personalisation text and stored outgoing message wording are removed. Names, limited identifiers and delivery history may remain; these records are not fully anonymous and remain protected as personal data. They are kept only while necessary for the permitted purposes under our data-processing agreement. At the end of the service, customer and campaign data are normally deleted or returned within 30 days, subject to applicable legal exceptions. Minimal suppression records may remain for up to a further 12 months after the related campaign data is deleted. Requests to exercise data-protection rights do not have to wait for automatic redaction.
Public Google reviews and our public replies. Controlled principally by Google and the reviewer under Google's terms. Copies or identifiers held in our systems are kept only while needed for review management, display on our website, customer service, legal claims or reporting.
Marketing records. Until you withdraw consent or object, or until we decide the information is no longer current or useful. A minimal suppression record may be kept to ensure we respect your choice.
CCTV footage. Usually up to 30 days, unless footage is needed for an incident, investigation, insurance matter or legal claim.
Website analytics, cookie data and technical logs. For the period stated in our Cookie Policy or cookie controls. Security logs are retained only for as long as reasonably needed to monitor, investigate and evidence incidents.

These are default periods, not promises that every record will be kept for the full period. A record may be deleted sooner if no longer needed, or retained longer where required for a legal hold, active dispute, safety issue, fraud investigation or statutory obligation. Backup copies may remain temporarily until overwritten, but are protected and not used for ordinary business purposes.

Your data-protection rights

Depending on the circumstances and lawful basis, you may have the right to:

ask for access to your personal information and a copy of it;
ask us to correct inaccurate or incomplete information;
ask us to erase information in certain circumstances;
ask us to restrict how information is used in certain circumstances;
object to processing based on legitimate interests and object at any time to direct marketing;
receive certain information you provided in a portable, machine-readable form or have it sent to another organisation;
withdraw consent at any time where consent is the basis we rely on; and
ask for human intervention where a solely automated decision has legal or similarly significant effects. We do not currently make such decisions about garage customers.

Rights are not absolute and exemptions may apply. We may ask for information to verify your identity and authority. We will normally respond within one month and do not usually charge a fee. If a request is manifestly unfounded or excessive, the law may allow us to charge a reasonable fee or refuse it, and we will explain our decision.

Your right to object

You have the right to object at any time to direct marketing. You may also object to other processing based on our legitimate interests, including customer-feedback and review requests. If you object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. Direct marketing will stop when you object.

Data-protection complaints

If you are concerned about how we have handled your information, please contact us first using the details under Who we are and tell us what you believe has gone wrong and what outcome you are seeking. You do not need to use legal language.

We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate and respond without undue delay, keep you informed where necessary, and tell you the outcome. We will keep a record of the complaint and our response as required for accountability.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. You can contact the ICO at ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the opportunity to address your concern before you approach the ICO, but this does not affect your right to do so.

Children

Our vehicle services and website are not directed at children, and we do not knowingly use children's information for customer-feedback or marketing activity. A parent, guardian or authorised adult should provide and manage information where a service relates to a vehicle used by a young person. If you believe we hold a child's information unnecessarily, please contact us.

Changes to this notice

We may update this notice to reflect changes in law, our services, technology or suppliers. The current version will be published on our website with its effective date. If a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected people where appropriate.

Contact us

For privacy questions, rights requests, objections or complaints, contact:

Injection Development (Canterbury) Limited
Unit 4, Canterbury Industrial Park
Hersden, Canterbury, Kent, CT3 4HQ
enquiries@injection-development.co.uk
01227 832 300