Privacy policy
Last updated: [date]
1. Who we are
Xentra Inspect Ltd ("Xentra Inspect", "we", "us") makes the Xentra Inspect vehicle inspection app, the Xentra
Inspect web portal and the inspection reports they produce (together, "the Service").
Company number: 17507601 · Registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE · ICO registration number: [number]
Contact for privacy questions: admin@xentrainspect.com
2. Two different roles — which applies to you
- We are the controller for information about our own customers, the people who use the Service (drivers,
inspectors and office staff), and visitors to our website. This policy explains how we handle that information.
- We are a processor for the inspection records our business customers create in the Service, such as the
names, phone numbers, addresses and signatures of the people their vehicles are collected from or delivered
to. Our business customer decides why and how that information is used, and their own privacy notice applies.
We only use it on their instructions and under a data processing agreement with them. If you are one of those
people, please contact the business that arranged the inspection; we will help them answer you.
3. What we collect, and why
Account and contact details — name, work email, phone number, company, job role and login details.
Why: to create and secure your account and provide the Service. Legal basis: performing our contract with your
employer or company, and our legitimate interest in running a secure service.
What happens in the Service — jobs you create, are assigned or complete; the photographs, video clips,
mileage, fuel and condition readings, damage records, notes and signatures captured during an inspection; and
when and by whom each step was done. Why: this is the inspection record the Service exists to produce.
Legal basis: performing our contract; for our business customers' inspection records we act as their processor.
Vehicle information — registration, make, model, colour, fuel type, VIN and MOT history. Some of this is
looked up from official DVSA MOT records when a registration is entered.
Report links and emails — the email addresses reports are sent to, and whether each email was delivered.
Why: to send reports and to show the office when an email fails.
Technical information — device type, app version, log-in times and error logs. Why: security and fixing
faults. Legal basis: legitimate interests.
Location — [only if the photo location stamp is built: the location where a photograph was taken, recorded
at the moment of capture only. We never track drivers continuously.]
Website and enquiries — what you send us when you contact us or book a demo. Legal basis: legitimate
interests in replying and in promoting our Service to businesses. You can opt out of marketing at any time.
We do not sell personal information, and we do not use it for advertising profiles.
4. Who we share it with
Only the providers that run the Service for us, each under a contract that protects your information:
- Supabase — database, logins and file storage (data held in the EU, Ireland)
- Railway — hosting of the report pages and the password reset page (EU, Netherlands)
- Netlify — hosting of this website
- Resend — sending report emails (EU, Ireland)
- [Google — distance and route calculations, once enabled]
- DVSA — only the vehicle registration is sent, to look up MOT records
We also share information when the law requires it, or to protect our rights or someone's safety.
Inspection reports are shared by our business customers with whoever they choose, through a report link.
5. Where it is stored
Our main data is stored in the European Union (Ireland), which the UK recognises as giving adequate protection.
If any provider handles data outside the UK or EU, we use the UK's approved safeguards (such as the
International Data Transfer Agreement or Addendum).
6. How long we keep it
- Account details: while the account is active, then [12 months] after it is closed.
- Inspection records, photographs and videos: for [12 months / the period agreed with the business customer],
then deleted, unless the business customer asks us to keep them longer for a dispute or claim.
- Report links stop working after [30 days] unless the business customer extends them.
- Enquiries and marketing contacts: [24 months] after our last contact, or sooner if you ask.
- Records we must keep by law (for example invoices): as long as the law requires.
7. How we protect it
Encrypted connections, access limited so each company only ever sees its own records, private storage for
signatures, role-based permissions for staff, and reports shared through long random links that expire.
No system is perfectly secure; if a breach affects you, we will tell you and the ICO where the law requires.
8. Your rights
You can ask us to: see the information we hold about you, correct it, delete it, limit how we use it, object to
our use of it, or give you a copy to take elsewhere. Email admin@xentrainspect.com. We reply within one month.
If your information is in a business customer's inspection record, we will pass your request to them.
You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would like the
chance to put things right first.
9. Children
The Service is for businesses and is not intended for anyone under 18.
10. Changes
We will post any changes here and update the date at the top. Significant changes will be emailed to customers.
Data attribution
Vehicle MOT information: contains public sector information licensed under the Open Government Licence v3.0.
[Confirm exact wording against the DVSA MOT history API terms agreed at registration.]