DRAFT — not approved for production use. Last prepared 11 November 2026. Olly must approve the lawful bases, controller / processor roles, retention and contact details before collecting real data.
Who is responsible
OLLY WATTS AUTOMOTIVE LTD (company 14309762), trading as Watts Automotive. Registered / correspondence address and privacy contact: TO BE CONFIRMED BY OLLY.
What this test portal handles
Business contacts, depot addresses, registrations / trailer identifiers, maintenance dates, job messages, vehicle defects, photographs and drawn signatures. Passwords are stored as salted PBKDF2 hashes, never in plain text. No payment cards are collected.
Purposes and legal basis — to approve
Proposed purposes: supplying vehicle maintenance, managing records, operator roadworthiness evidence and account security. Appropriate UK GDPR lawful bases and whether the operator is a separate controller or Watts is its processor must be documented before use. Do not treat this placeholder as legal advice or consent for marketing.
Storage, access and retention
Proposed host: Cloudflare Pages / D1. Only the client account and authorised Watts administrator can read vehicle records. A driver QR token permits submission for one vehicle, not reading private records. Keep the QR inside the cab and replace it if shared improperly.
Signed vehicle records and defect reports have a minimum 16-month hold in this MVP, exceeding 15 months. Deletion is deliberately disabled; a reviewed retention / disposal and backup process must be agreed. Nil-defect records are retained with the same 16-month policy in this MVP, longer than the usual 3-month recommendation, pending a minimisation review.
Driver drafts (answers, name and signature) use this device’s localStorage; compressed photos use IndexedDB referenced by the draft. They expire / are purged when the app opens after seven days and are cleared after server receipt. The app shell is cached for offline use, not private client records. Browser storage can be cleared or evicted; use a trusted device. Offline checks are not delivered until the page reconnects and confirms a server receipt.
Recipients and transfers
Cloudflare hosting terms, processing agreement, location / transfer safeguards, and any approved email provider must be reviewed. Email delivery is disabled in this test. No marketing integrations or analytics are installed in the portal.
Your rights and security
Document the process for access, correction, restriction, objection and erasure where applicable, breach handling, and complaints to the ICO. Legal retention duties may limit erasure. Use only synthetic data during this test. Contact route, security incident owner and ICO registration / fee status: TO BE CONFIRMED.