Sandown Coachworks

Data Protection Policy

October 2026

1. About this policy

Sandown Coachworks is committed to handling personal data lawfully, fairly and securely. This policy explains how we do that and what your rights are.

Sandown Coachworks is a group of accident repair centres in Shepperton, Camberley and Heathrow (Hanworth). Each site is run by one of the following companies, which is the data controller for personal data processed at that site:

Site	Company (data controller)
Shepperton	Sandown Coachworks (Hersham) Limited
Camberley	Sandown Coachworks Camberley Limited (company number 12381123)
Heathrow (Hanworth)	Neate Automotive Limited, trading as Sandown Coachworks (Heathrow)

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy applies to all personal data we handle about customers, insurance claimants, suppliers, business contacts and website visitors, whether it is held on paper, electronically or as recordings.

All staff must follow this policy. Every new member of staff receives data protection training as part of their induction, and refresher training is given regularly.

The principles we follow

When we handle personal data, we make sure it is:

Processed lawfully, fairly and transparently.
Collected for specific, legitimate purposes and not used for anything incompatible with them.
Adequate, relevant and limited to what we need.
Accurate and, where necessary, kept up to date.
Kept no longer than necessary.
Kept secure, including against loss, damage and unauthorised access.

We are also accountable: we keep records that show how we meet these principles.

2. The personal data we hold

We hold only the personal data we need to repair vehicles, manage insurance claims and run our business.

Why we use it	What we hold	Lawful basis
Repairing your vehicle and managing the claim	Name, phone number, email and address; vehicle details; claim and policy references; photographs of the vehicle and damage	Contract, and our legitimate interest in carrying out repairs instructed by insurers and claims managers
Communicating with you, your insurer and claims manager	Emails, letters, messages and notes of conversations	Contract and legitimate interests
Call recording	Recordings of telephone calls to and from our sites	Legitimate interests: training, quality and resolving disputes
Collection, delivery and courtesy vehicles	Addresses, driving licence details where needed	Contract and legal obligation
Invoicing and accounts	Billing details and payment records	Contract and legal obligation
Complaints and legal claims	Correspondence and records relating to the complaint	Legitimate interests and legal obligation
Website enquiries	Details you enter in contact forms	Legitimate interests, or consent where we ask for it

We receive personal data from you directly, and from insurers, claims managers and accident management companies that instruct us.

Who we share it with

We share personal data only where needed for the purposes above:

We never sell personal data. We do not transfer personal data outside the UK.

Insurers, claims managers and accident management companies handling your claim.
Recovery and transport providers collecting or delivering your vehicle.
Parts suppliers and specialist sub-contractors, where needed for the repair.
Our IT, email, telephone, website and bodyshop system providers, under written agreements requiring them to protect your data.
Professional advisers, regulators, the police or courts, where the law requires it.

How long we keep it

Record	How long we keep it
Job records, repair files and photographs	6 years after the job or claim closes
Emails and correspondence	6 years after the job or claim closes
Invoices and accounting records	6 years from the end of the financial year they relate to
Telephone call recordings	6 months
Website enquiries that do not lead to a job	12 months

We keep records longer only where they are needed for an ongoing complaint, claim or legal matter. When the retention period ends, records are securely deleted or destroyed.

3. Keeping data secure

We protect personal data with technical and organisational measures, including:

Access to systems and mailboxes limited to the staff who need it, with individual logins.
Secure, password-protected business systems for email, job records and call recordings.
Paper records kept in locked storage and shredded when no longer needed.
Written agreements with every supplier that handles personal data for us.
Password protection or secure links when we send personal data by email.

If a data breach occurs, it is reported immediately to the Data Protection Lead. Where a breach is likely to put people at risk, we report it to the Information Commissioner's Office (ICO) within 72 hours and tell the people affected without undue delay.

4. Your rights

Under the UK GDPR you have the right to:

Be told how we use your personal data (this policy).
Have a copy of your personal data (a subject access request).
Have inaccurate data corrected.
Have your data erased, in some circumstances.
Restrict how we use your data, in some circumstances.
Receive your data in a portable format, in some circumstances.
Object to how we use your data, including where we rely on legitimate interests.
Not be subject to decisions made solely by automated means. We do not make automated decisions about anyone.

Making a subject access request

You can ask for a copy of the personal data we hold about you by email, letter, phone or in person, to any of our sites. You do not need to use any particular wording or form.

We will respond within one calendar month of receiving your request. If the request is complex, we may extend this by up to two further months, and we will tell you why within the first month.
There is normally no charge.
We may ask you to confirm your identity before we release your data.
We may remove information about other people to protect their privacy.

For staff: any request from a customer for “their file”, “their information” or “what you hold on me” is a subject access request, even if they do not call it one. Never tell a customer they cannot have their own information. Pass the request to the Data Protection Lead the same day, and do not alter or delete any records relating to that person.

5. Our commitments

To meet our obligations, we:

Appoint a Data Protection Lead with overall responsibility for personal data.
Keep a record of the personal data we hold, where it is held and who it is shared with.
Have a lawful basis for everything we do with personal data.
Train all staff at induction and regularly afterwards.
Carry out checks on suppliers and have written data protection agreements with them.
Carry out a data protection impact assessment before starting any new high-risk processing.
Maintain and test our data breach procedure.
Respond to subject access requests and other rights requests within the legal time limits.
Renew our registration with the ICO every year.
Review this policy at least once a year, and whenever the law changes.

6. Contact us

For any question about this policy or your personal data, or to make a request, contact our Data Protection Lead:

Email: info@sandowncoachworks.co.uk, marked “Data Protection”
In writing or in person at any of our sites

7. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office:

Website: ico.org.uk
Phone: 0303 123 1113

8. Version history

Version	Date	Change	Approved by
02	October 2026	Rewritten for the UK GDPR and Data Protection Act 2018; retention periods and subject access procedure added	Hadleigh Rossiter, Managing Director
01	1 February 2018	Initial policy	Hadleigh Rossiter