Who PAD is

PAD (Pontypridd Auto Diagnostics) is a sole trader business operated by Alex Thomas in Pontypridd, Rhondda Cynon Taf, South Wales. Contact: contact@pontypridddiagnostics.co.uk.

What data is collected

Only the minimum needed to deliver the service:

  • Booking data: Name, email, phone number, vehicle registration, postcode (for the appointment) and, if you give it, your full address
  • Your history with PAD: Past bookings are linked by your email and phone number so PAD can see what was done last time, plus short notes to help next time, such as how you prefer to be contacted
  • Test data: Vehicle technical data collected via Aviloo/OBD to produce your certificate or report
  • Security-related work (keys, immobilisers, module pairing): Your name, address and contact details, how you are connected to the vehicle, the vehicle's registration, VIN and mileage, confirmation that the V5C and your photo ID were checked, the type of ID, its expiry date and the last four characters of its number (never the full number), a signed authorisation form, and photos of the VIN and odometer. This is also recorded when a request is declined.
  • Analytics: Usage statistics via Google Analytics 4, only if you accept cookies

How the data is used

Your data is used exclusively to deliver the service you booked, send your certificate/report, and, if you consent, occasional follow-up on whether you're happy with the outcome. Nothing else.

For security-related work, the extra details above are kept to prove the work was requested by someone entitled to it. PAD holds SERMI approval to access vehicle manufacturers' security systems, and keeping these checks on record is a condition of that approval. It is also how PAD helps prevent vehicle theft.

What isn't done

  • Your data is never sold to third parties
  • You are never added to marketing lists without consent
  • Your data is never shared outside of service providers required to operate, all of whom have their own GDPR-compliant privacy policies:
  • Supabase (EU-hosted database, stores booking records)
  • Resend (transactional email, sends booking confirmations and reminders)
  • Google Calendar (appointment scheduling, calendar invites sent to your email)
  • Square (payment processing, card payments on the day)
  • Netlify (website hosting)
  • Aviloo (battery diagnostics, vehicle data used to produce your certificate)
  • Pushover (internal notifications. PAD only, no customer data shared)
  • Vehicle manufacturers (security-related work only: the manufacturer's own system records which vehicle PAD accessed and when)

Records of security-related work may also be shown to the SERMI scheme's inspectors during an audit, and to the police when they make a lawful request, for example when investigating a stolen vehicle.

How long data is kept

Booking records and test results are kept for 7 years (HMRC requirement). After that, records are deleted. You can request earlier deletion at any time, just email.

Records of security-related work, including declined requests, are also kept for 7 years and cannot be deleted early, because PAD must be able to show who requested each job if it is ever questioned.

Your rights

Under UK GDPR you have the right to access, correct, or delete your data. Email contact@pontypridddiagnostics.co.uk with your request. PAD will respond within 30 days. The one exception is deleting records of security-related work before the 7 years are up, for the reason above; you can still see and correct them.

Cookies

The site uses essential storage for functionality, such as remembering your cookie choice. Google Analytics cookies are only set if you press Accept on the cookie banner, and are used for usage statistics. No marketing or advertising cookies. You can change your choice at any time: cookie settings.

Complaints

If you're unhappy with how PAD handles your data, please email first to let us try and resolve it. You also have the right to complain to the Information Commissioner's Office: ico.org.uk.