Privacy policy
Version 1.2. Effective date: 09 July 2026. Last updated: 09 July 2026.
This notice describes what personal data Exist Online Ltd (company number 17085581, trading as FixHelp) collects, why we process it, who we share it with, and what your rights are under UK GDPR and the Data Protection Act 2018.
Data protection contact: [email protected].
On this page (tap to expand)
- 1.Who FixHelp is
- 2.Who this notice is for
- 3.What data we collect
- 4.How we collect data
- 5.Why we process data and our lawful basis
- 6.How we use AI in your reports
- 7.Anonymised aggregated repair data
- 8.Who we share data with
- 9.International transfers
- 10.How long we keep data
- 11.Your rights under UK GDPR
- 12.Security
- 13.Cookies
- 14.Children
- 15.Changes to this notice
- 16.Complaints and contact
1. Who FixHelp is
Exist Online Ltd (company number 17085581, registered office 122 Burleigh Avenue, Wigston, LE18 1FL, United Kingdom) is the data controller for the personal data described in this notice. We trade as FixHelp ("FixHelp", "we", "us", "our").
FixHelp supplies the garage and workshop software product FixHelp Pro, together with the customer tracking links and customer reports it produces (together, "the service"). Mechanics sign in to FixHelp Pro; their customers use the tracking link and report without an account. The provider identity, and the branding customers see, remain FixHelp.
Exist Online Ltd is a UK private limited company incorporated on 11 March 2026 and registered for business and domestic software development (SIC 62012) and advertising agencies (SIC 73110). Exist Online Ltd also operates existonline.co.uk as a separate service line covered by its own privacy notice.
For data protection enquiries, contact [email protected] or write to our registered office. Kamil Wozniak is the named point of contact for all data protection matters across Exist Online Ltd. Exist Online Ltd is not required to appoint a statutory Data Protection Officer at its current scale.
2. Who this notice is for
Three groups have personal data processed by FixHelp:
- Mechanics: the professional tradespeople and garages who sign up for FixHelp Pro. We hold mechanic data as their service provider, with Exist Online Ltd as the data controller for that data.
- Customers of mechanics: members of the public whose vehicles are being repaired by a FixHelp Pro mechanic. Mechanics enter their customer's name and phone number into FixHelp Pro as part of running the repair. We hold this data on the mechanic's behalf as the data processor for the mechanic under Article 28 of the UK GDPR. The mechanic remains the data controller for their underlying customer relationship. We are also a data controller for the additional data the customer themselves enters when they use the tracker page (for example, an email address provided to receive the PDF report).
- Visitors: anyone browsing our public website outside an authenticated session.
3. What data we collect
3.1 Mechanic data (when you sign up and use FixHelp Pro)
- Email address (used to send you a magic-link sign-in email; there are no passwords)
- Passkey credential data (the public key and credential identifier for any passkey you register for day-to-day sign-in using your device biometrics or PIN; we never receive or store your biometric data or a private key)
- Business name, address, telephone, contact email, website, VAT number (some optional)
- Business logo
- Brand colour
- Trade memberships (e.g. RMI, IGA, Trust My Garage), if you choose to enter them
- Payment processor customer ID once you become a paying customer after the closed beta
- IP address and user-agent for session and security
- Activity logs within FixHelp Pro (which reports you drafted, which you sent, when)
3.2 Customer data (entered by their mechanic, on the customer's behalf)
- Customer name
- Customer phone number (in E.164 format, used to send the tracking link by SMS)
- Vehicle registration plate
- Vehicle VIN (optional)
- Vehicle mileage at the time of the repair
- Repair history within the customer's account at the mechanic's garage
The mechanic does not enter customer email addresses into FixHelp Pro. Customer email is only ever captured if the customer themselves chooses to enter it on their private tracker page in order to receive the PDF report by email. See section 3.6.
3.3 Vehicle data (looked up via UK government APIs)
When the mechanic enters a vehicle registration plate, FixHelp Pro queries UK government data sources:
- DVLA Vehicle Enquiry Service responses (make, model, year, fuel, engine, colour)
- DVSA MOT History responses (MOT test history keyed by registration plate)
DVLA responses are held briefly in memory to avoid repeat lookups within the same working session. MOT history is stored against the vehicle record so the mechanic can see it during the job, and is refreshed from DVSA when it is more than 7 days old. This stored vehicle data is kept for the life of the vehicle record and is deleted when the mechanic's account is deleted.
3.4 Diagnostic and repair content
- Photographs taken by the mechanic of scanner screens, parts, vehicle conditions and repair evidence
- Typed notes written by the mechanic
- Fault codes entered or scanned
- Diagnostic findings written by the mechanic, optionally aided by AI suggestions the mechanic accepts and edits
- Line items (work performed, parts, labour, prices)
- The generated PDF report and the customer-facing tracker page contents
3.5 Customer tracker activity
Your garage arranges your permission for the tracker link: the garage confirms to us that it has told you your phone number will be used to send a private link and service updates about your repair. Every message we send on the garage's instruction is a service message about your repair, never marketing. If you would rather not receive text updates, tell your garage and they will stop sending them; you can also email [email protected].
When the customer opens the tracker link we send them by SMS, we record:
- The time the link was opened
- The IP address used to open it
- Any actions the customer takes on the page (for example, requesting the PDF by email, approving or declining recommended work)
3.6 Customer-provided email address (optional, self-entered)
If the customer enters their email address on the tracker page in order to receive the PDF report by email, we record that email address against the report, send the PDF, and retain the address for the lifetime of the mechanic's account. This is the only path by which we ever hold a customer's email. The mechanic does not enter customer emails into FixHelp Pro.
The lawful basis for processing this email is the customer's explicit consent under Article 6(1)(a) of the UK GDPR, given by the customer themselves on the tracker page.
3.7 What we do not collect
- Payment card details (when paid plans launch after the beta, card data is handled entirely by our payment processor and we never see card numbers)
- Mechanic passwords (we use magic-link sign-in; there are no passwords)
- Customer payment information (your customer pays you directly; FixHelp Pro does not handle that transaction)
- Any content describing minors, identity documents, or sensitive personal data outside what is needed to identify a vehicle and its keeper
4. How we collect data
- Directly from the mechanic when they sign up, configure their garage, and create reports
- From the customer indirectly, via the mechanic's job-creation workflow, with the mechanic confirming they have authority to record the customer's contact details
- From DVLA Vehicle Enquiry Service and DVSA MOT History API using registration plates the mechanic enters
- From our payment processor (post-beta), for billing events
- Automatically from your browser (session cookies, IP, user-agent) for security
- From the customer themselves when they open the tracker link (we record the open event, IP, and any actions they take, including any email address they choose to enter for a PDF copy)
5. Why we process data and our lawful basis
| Purpose | Whose data | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Providing FixHelp Pro to a mechanic (account, sign-in, reports, customer tracker) | Mechanic | Contract (Art 6(1)(b)) |
| Holding the mechanic's customer name and phone number so the mechanic can deliver the repair | Customer | Legitimate interest (Art 6(1)(f)); the mechanic has the underlying customer relationship and instructs FixHelp to hold the data |
| Sending the customer a tracker link by SMS (when the mechanic taps Approve and send) | Customer | Legitimate interest plus the customer's reasonable expectation given they engaged the mechanic for a repair |
| Sending the customer the PDF report by email (when the customer chooses to enter their email on the tracker) | Customer | Consent (Art 6(1)(a)); the customer themselves enters the email, knowing what it will be used for |
| Looking up vehicle data via DVLA and DVSA APIs | Vehicle keeper (indirect, via registration plate) | Legitimate interest |
| Sending magic-link sign-in emails to mechanics | Mechanic | Contract |
| Sending transactional emails to mechanics (receipts, account notices) | Mechanic | Contract |
| Sending product updates and marketing to mechanics | Mechanic | Consent (Art 6(1)(a)); explicit opt-in at signup, unsubscribe link in every email |
| Fraud prevention, abuse detection, security monitoring | All | Legitimate interest |
| Compliance, audit, defending legal claims | All | Legal obligation (Art 6(1)(c)); legitimate interest |
| Improving FixHelp Pro via anonymised aggregated repair data | Anonymised; no longer personal data | Legitimate interest at the point of anonymisation; not a personal-data processing purpose afterwards |
5.1 Legitimate interest balancing: customer data
We process customer name and phone number on the mechanic's instructions because:
- The mechanic has a direct contractual relationship with the customer for the repair
- Holding the customer's contact details is necessary to send them a tracking link about the work on their vehicle
- The customer's reasonable expectation when engaging a mechanic is that the mechanic will record their contact details to update them on the work
- We do not use customer data for our own marketing
- The customer has all UK GDPR rights against both the mechanic (controller of the underlying repair relationship) and FixHelp (controller or processor depending on the action; described in section 11)
5.2 Legitimate interest balancing: registration plates
A UK registration plate combined with DVLA data can identify a vehicle keeper. We process registration plates because they are the only reliable identifier for a UK vehicle. The mechanic needs them to produce an accurate report. The impact on the keeper is minimal: data stays with the mechanic and FixHelp; the report is shared only with the customer (typically the keeper) via the mechanic; the anonymised knowledge-base entry retains no registration plate.
6. How we use AI in your reports
FixHelp uses AI models from OpenAI to help mechanics work faster and to help customers understand their repair. Specifically:
- A vision model analyses photos the mechanic takes during the inspection and suggests likely diagnostic conclusions
- A text model generates a plain-English customer-facing summary that the mechanic reviews and edits before sending
The mechanic reviews and approves every report before it is sent to a customer. AI suggestions are starting points, not final answers. The mechanic decides what to keep, what to edit, and what to remove. Nothing is auto-sent to a customer.
OpenAI processes this data on our behalf as a processor under Article 28 of the UK GDPR, governed by its Data Processing Agreement and Standard Contractual Clauses. We do not use your data, or your customers' data, to train OpenAI's or anyone else's general models. We send OpenAI only the material needed to produce the diagnostic suggestion or report content: the photos, typed notes, fault codes and vehicle data for the job in hand. We do not send the customer's name, phone number or email address as part of that request. Typed notes and photos can incidentally contain customer-identifying content that we cannot always strip in advance; we run an automated redaction step over free text before it is stored for any later use.
The customer-facing report and tracker page do not include any AI chat surface, and the customer-facing report never mentions AI. The customer interacts only with content the mechanic has written or approved.
7. Anonymised aggregated repair data
When a report reaches "collected" status (the customer has received the work), FixHelp may extract anonymised structured data from it for the FixHelp Pro knowledge base. This means:
- All customer-identifying information is stripped (name, phone number, email address if any, postcode)
- All vehicle-identifying information is stripped (registration plate, VIN, exact mileage)
- Free-text fields are passed through a redaction step that removes names, addresses, and other identifiers
- The remaining structured data (vehicle make, model, year, engine code, fault code, diagnostic finding category, repair outcome) is added to the FixHelp Pro knowledge base
Anonymised aggregated data is no longer personal data under UK GDPR (per Information Commissioner's Office guidance on anonymisation). We retain it perpetually and use it to:
- Improve diagnostic accuracy across FixHelp Pro
- Improve product quality and reliability
- Build the FixHelp Pro anonymised repair knowledge base
- Generate statistical insights about UK vehicle repair patterns
- Support related Exist Online Ltd services
This is the legal basis we rely on to make FixHelp Pro better over time. It is explicitly addressed in the mechanic's Terms of service at clause 6.4.
If a mechanic objects under Article 21 of the UK GDPR, we will exclude future reports originating from that account from the anonymisation pipeline. Already-anonymised entries cannot be linked back to a specific account or customer and are unaffected.
If a customer objects, they may contact either their mechanic or [email protected] directly. If we can identify the relevant report (by registration plate and date) and it has not yet been processed, we will exclude it from anonymisation.
9. International transfers
Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), supported by a transfer-risk assessment for the processor concerned. This is the UK-government-recognised legal mechanism for international data transfers under Article 46 of the UK GDPR.
The transfers that reach the United States are: transactional email through Resend, and AI processing through OpenAI (which operates in Ireland and the United States). Both operate under SCCs. Cloudflare R2 file storage is set to EU jurisdiction so customer-uploaded files (logos, photos, PDFs) are held in the EU at rest. The database is hosted in a UK or EU region.
10. How long we keep data
| Data | Retention |
|---|---|
| Mechanic account data | For the duration of the account; deleted 30 days after account closure (7 days if erasure requested in writing) |
| Customer data within active mechanic accounts | While the mechanic's account is active; deleted with the account |
| Reports and repair history | While the mechanic's account is active; deleted with the account |
| Customer tracker link, final report PDF and job evidence photos | 12 months from the date the job was created. The tracker link expires after 12 months and the job's evidence photos are deleted in routine purges after that period (or earlier, with the account) |
| Photos a mechanic removes from a job | Hidden from the customer tracker, report picker and all customer-facing output immediately; retained as part of the job's evidence record for the same 12-month period, then deleted |
| Vehicle data (DVLA response and DVSA MOT history stored against the vehicle record) | Kept with the vehicle record while the mechanic's account is active; MOT history is refreshed from DVSA when more than 7 days old; deleted with the account |
| Customer-provided email address (entered on the tracker for PDF delivery) | While the mechanic's account is active; deleted with the account or on a specific erasure request |
| Billing records (post-beta) | 6 years (UK tax law) |
| AI interaction history (raw context) | 90 days from creation, then automatically purged |
| AI interaction history (redacted input text for service improvement) | While the mechanic's account is active |
| Anonymised aggregated repair data | Perpetual, no longer personal data |
| Magic-link sign-in tokens | Valid for 24 hours from creation and single-use; marked as consumed on first use |
| Sessions | 30 days from creation, sliding window (each visit extends the window) |
| Audit logs | 6 years |
| Backups | 30 days, overwritten on a rolling basis |
11. Your rights under UK GDPR
Under UK GDPR and the Data Protection Act 2018, you (mechanic or customer) have the right to:
- Access the personal data we hold about you (Article 15)
- Rectification of inaccurate data (Article 16)
- Erasure of your data, also called the right to be forgotten (Article 17), subject to the legal retention obligations in section 10
- Restrict processing in certain circumstances (Article 18)
- Data portability, receiving a copy of your data in a machine-readable format (Article 20)
- Object to processing based on legitimate interest (Article 21)
- Withdraw consent at any time for processing we carry out based on consent, such as marketing emails or your tracker-page email entry
You also have the right not to be subject to a decision based solely on automated processing that significantly affects you (Article 22). FixHelp does not make automated decisions of this kind. Diagnostic suggestions are reviewed by the mechanic before any customer-facing output.
11.1 How to exercise your rights: mechanics
- Account erasure: account settings → delete account
- Data export: account settings → download my data
- Marketing opt-out: unsubscribe link in any marketing email
- Anything else: email [email protected]
11.2 How to exercise your rights: customers of FixHelp Pro mechanics
- For most rights, contacting your mechanic directly is the quickest route. They are the controller of your repair relationship.
- For rights specifically against FixHelp (data we hold on the mechanic's behalf, or the email you entered on the tracker), email [email protected] from the email address held on file, or include enough information to verify your identity (name + phone number + registration plate + mechanic's business name).
- We will identify the relevant report and either action your request or refer you to your mechanic where they are the right controller to deal with it.
We respond to requests within 30 days of receipt. We do not charge a fee unless a request is manifestly unfounded or excessive (Article 12(5) of the UK GDPR).
12. Security
We apply reasonable technical and organisational measures to protect personal data, including:
- All traffic over HTTPS (TLS 1.2 minimum, TLS 1.3 preferred)
- Passwordless authentication: a single-use magic-link email (valid for 24 hours) for invite and recovery, and passkeys (WebAuthn) for day-to-day sign-in. We never hold a password or your biometric data
- Sessions held via HTTP-only, Secure, SameSite=Lax cookies with a 30-day sliding window
- Database encrypted at rest by the Neon platform
- File storage encrypted at rest by Cloudflare R2 (EU jurisdiction)
- Access controls; only named staff (currently Kamil only) can access production systems
- Daily backups to a separate encrypted bucket with 30-day retention
- AI interaction data scrubbed of customer identifiers before any analytical use
- Sentry error-monitoring runs PII scrubbing rules to prevent customer names, phone numbers, registration plates and emails from leaking into error reports
- Incident response plan in place; data breaches that present a risk to the rights and freedoms of individuals are notified to the Information Commissioner's Office within 72 hours of becoming aware of them, as required by Article 33 of the UK GDPR
No system is perfectly secure. If you believe a security incident has affected your data, please email [email protected] as soon as you reasonably can.
14. Children
FixHelp Pro is not intended for use by anyone under 18. We do not knowingly collect data from children. If we become aware that we hold personal data about a child, we will delete it and assess any onward notification obligation.
15. Changes to this notice
Material changes will be notified by email and via an in-app banner at least 30 days before they take effect. Non-material changes (corrections to typos, clarifications) take effect immediately. The current version is always published on this page with a "Last updated" date at the top.
16. Complaints and contact
If you are not happy with how we have handled your data, please contact us first at [email protected] so we can try to resolve the issue directly.
You also have the right to complain to the UK Information Commissioner's Office at any time:
- Website:
ico.org.uk - Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Postal contact for FixHelp
Exist Online Ltd 122 Burleigh Avenue Wigston, LE18 1FL United Kingdom
Company number: 17085581 Not VAT registered.
Data protection point of contact: Kamil Wozniak, [email protected].