Privacy Policy

NGC Hybrid & EV Limited ("NGC", "we", "us", "our") is a private limited company registered in England and Wales, company number 15301784. Registered office: Bury Lodge, Bury Road, Stowmarket, Suffolk IP14 1JA. Workshop: Unit 15 Cedars Hill, Brockford, Suffolk IP14 5PQ. VAT number 510829311.

We are the data controller for the personal information described in this policy. We have applied to register with the Information Commissioner's Office (ICO); our registration reference will be published here once issued: ICO ref. ____________.

Contact for anything about your data: contact@ngc-hybrid.co.uk · 01473 561230 · or write to the workshop address. We are not required to appoint a Data Protection Officer; the company director is responsible for data protection.

Use our contact, quote, parts or sell-your-vehicle forms: Name, email, phone, preferred contact method, your message, vehicle make/model/year/registration/mileage, the page you sent it from, browser type (spam detection) — To reply and quote

Book work with us: Name, address, email, phone, vehicle details incl. registration and VIN, fault description, work done, prices, payment status, technician notes — To carry out and record the job

Drop off or collect a vehicle: Digital handover form: mileage, fuel/charge level, keys, visible damage, items left in the vehicle, and your typed name and/or drawn signature — Record of vehicle condition, protecting both parties

Receive a certificate: Vehicle and work details, technician signature and, where applicable, yours — Certificates must be valid and traceable

Order from our online shop: Name, email, phone, delivery address, items ordered. We do not take card payments online — you pay us directly, so we never hold card details — To confirm and fulfil the order

Receive our texts or emails: Number/email, message content, delivery status, any text reply you send — Booking confirmations, reminders, "vehicle ready", invoices, tracking, and a single review request after a job

Visit our website: Strictly-necessary technical data only. We run no analytics or advertising trackers — Site security and function

Visit the workshop: CCTV images of the yard and reception — Security of premises and vehicles

We don't collect special-category data or data about children. Anything given to us in error is deleted.

Contract (Art. 6(1)(b)) — quotes, bookings, repairs, certificates, orders and the messages that go with them.

Legal obligation (Art. 6(1)(c)) — keeping invoices and job records for HMRC; issuing traceable certificates.

Legitimate interests (Art. 6(1)(f)) — spam and abuse prevention; CCTV for security; handover records to resolve condition disputes; one review request after a completed job. You may object at any time (section 8).

Consent (Art. 6(1)(a)) — marketing (we currently send none) and any non-essential cookies (we currently set none). Withdraw at any time by emailing us or replying STOP to a text.

Providers act on our instructions under written contract and cannot use your data for their own purposes.

Supabase: Database and file storage (customer records, jobs, handovers, certificates) — EU – Stockholm, Sweden

Vercel: Website and admin-system hosting — UK/EU edge; origin functions in EU/US*

Resend: Email delivery (confirmations, invoices, review requests) — USA*

ClickSend: SMS delivery and inbound replies — UK carriers; account data on global infrastructure (Australia)*

Google: If you follow our review link, Google processes the review under its own policy — USA

Parts suppliers and couriers: Name, address, phone — only for a specific order — UK

Accountant, insurers, HMRC, IMI/HEVRA (certificate audit): As required by law or professional obligation — UK

* See section 5. We never sell your data and do not share it with marketing companies.

Our own systems and database are in the UK/EU, which the UK recognises as adequate. Two message-delivery providers (Resend, ClickSend) process delivery data outside the UK. For these we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with encryption in transit. Only the minimum needed to deliver a message (address/number, name, message text) leaves the UK; your full customer record does not.

Enquiries not leading to work: 12 months from last contact — To pick up the conversation if you return

Customer, job, invoice and payment records: 6 years after the end of the relevant tax year — HMRC (Finance Act 1998 Sch. 18)

Handover forms and signatures: Same as the related job — Evidence of vehicle condition

Certificates: 10 years from issue — Industry traceability; HV warranty period

SMS/email delivery logs: 24 months — Proof of what was sent and when

Shop orders: 6 years after tax year — HMRC

Form spam metadata (IP, browser): 30 days — Abuse prevention

CCTV: 30 days unless required for an incident — Security

Staff audit log: 2 years — Security and accountability

At the end of each period data is deleted or irreversibly anonymised. This schedule is reviewed annually.

Encryption in transit (TLS) and at rest.

Row-level security on every database table: the public website can only read published content (reviews, blog posts), never customer records.

Individual staff accounts, 12-character minimum passwords, per-person permissions, and an audit log of every change.

Preview/test versions of the website are behind a login.

Automatic daily database backups.

If a breach is likely to put your rights at risk, we notify the ICO within 72 hours and tell you without undue delay.

Access · Rectification · Erasure (except records the law requires us to keep — we'll explain what and why) · Restriction · Objection (e.g. "never send me a review request") · Portability · Withdrawal of consent.

Email contact@ngc-hybrid.co.uk with "Data request" in the subject. We'll verify your identity and respond within one month, free of charge. Complaints: Information Commissioner's Office — ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow SK9 5AF.

None. We do not profile you.

Some messages contain a private link (e.g. to view or sign a handover form). Anyone with the link can open it, so please don't forward those messages. Links stop working when the job is complete.

Changes are posted here with a new date. Significant changes are flagged on the homepage.