Privacy policy
Who we are
Wrap Workx Ltd, trading as Wrap Workx Automotive, operates this website and the vehicle services it describes.
Workshop: Unit 17 Jesmor Farm, St Piers Lane, Lingfield, Surrey RH7 6PN
Contact: hello@wrapworkxautomotive.co.uk
What we collect and why
When you request a quote we collect your name, contact details, details of your vehicle and the work you want, and any photos you choose to attach. We use them to prepare and follow up your quote — the lawful basis is taking steps at your request before entering a contract (UK GDPR Article 6(1)(b)), and our legitimate interest in running the business (Article 6(1)(f)). A member of our team can also add an enquiry on your behalf after a phone call, a WhatsApp message or a visit to the workshop — from that point it is handled exactly as one sent through the website. If you book your car in, we email you a confirmation, a reminder the day before your drop-off, and a note when it is ready to collect.
If we send you a quotation, we keep a copy with your enquiry for the same period and email it to you as a PDF with a private link to view it on this site. Opening that link also asks for the last three characters of your vehicle registration, so the link on its own does not show the quotation; treat both as you would the email. If you accept online we record the name you type and the time, as our evidence of the agreement. We do not take card or bank details from you on this site; a deposit is paid by bank transfer or in the workshop.
Like any website, we also receive technical information you did not type in. When you send the quote or contact form, look up a number plate, attach a photo, or when the visit-counting request described below is sent, that request reaches our servers and your IP address arrives with it. We use it to apply fair-use limits so no single source can flood the forms — and for that we store only a scrambled value, never the address itself; your email address is scrambled the same way, for the same purpose. The address also lands in Google Cloud’s request logs for those requests, which Google deletes after 30 days on the standard setting we use. We do not copy them anywhere else, and use them only to diagnose faults and abuse. Our lawful basis for all of this is our legitimate interest in keeping the site running and protecting it from abuse (Article 6(1)(f)).
If you use the number-plate lookup on the quote form, we send that registration to the DVLA’s vehicle enquiry service to fetch the make, model and colour — the lawful basis is taking steps at your request before entering a contract (Article 6(1)(b)). We keep the registration and the details it returns for up to 30 days, so looking up the same plate again does not make a second call to the DVLA. After that it is deleted automatically, whether or not you finished the form.
Where your data is stored
Quote requests are stored with Google Firebase (Google Cloud). Google may process data outside the UK; transfers are covered by the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses. Photos are stored privately in Firebase Storage, are not publicly accessible, and are used only to assess the work.
Email is the exception. The messages we send — your confirmation, and the alert telling our team an enquiry has arrived — are delivered by Resend, an email provider based in the United States. Your name, email address and the details of your enquiry pass through them for that purpose. That is an international transfer, covered by the UK Extension to the EU–US Data Privacy Framework and the UK Addendum to the standard contractual clauses in Resend’s data processing addendum, published at resend.com/legal/dpa. Under it they may use your details only to deliver our mail, never for their own purposes, and they are not sold on. Copies of sent messages remain in their system for a time under their own retention policy.
Measuring how the site is used
We count visits to see which pages are useful and whether people find us locally. It is our own measurement — nothing is shared with an advertising network, and no cookies are set. The identifier we count with is scrambled using a key that is destroyed every night, so one day’s counts cannot be joined up to the next. Our lawful basis is our legitimate interest in understanding how the site is used (Article 6(1)(f)).
We keep the day-by-day totals, which contain nothing about any individual. The individual visit records behind them are deleted after 30 days; each one holds a scrambled visitor identifier, the page, your country, device type, language, and where you arrived from (the referring site and any campaign tag in the link) — never your IP address. If you would rather not be counted at all, use the switch below, or turn on Global Privacy Control in your browser — either way your browser stops sending the measurement, rather than us receiving it and throwing it away. Because each measurement is a request to our servers, switching it off also keeps your address out of the request logs described above for ordinary page views. A request you make yourself, such as sending the form or looking up a registration, still reaches them, because that is how it reaches us at all.
How long we keep it
Quote requests, and any photos sent with them, are deleted automatically 24 months after you send them. That covers coming back to a previous quote and the warranty conversations that follow a job; after it, the deletion runs weekly on a schedule rather than waiting for anyone to remember. We keep anonymous monthly totals — how many wraps, how many tints — which contain nothing that identifies you.
If you become a customer, invoices and job records are kept as long as your warranty runs and as tax law requires.
When a member of our team opens your contact details, that is recorded — who looked, when, and the network address their browser reported, which we store as reported rather than verified. We keep this so we can tell who has seen your data (Article 6(1)(f)). The record is kept for the same 24 months and then deleted with everything else.
Browser storage
This site sets no advertising or analytics cookies. Your browser stores a draft of your quote request locally on your device so you don’t lose it between steps; it never leaves your browser until you submit. If you tick “Don’t count my visit” above, that choice is stored too, under the key wrapworkx-analytics-optout — written only when you object, and holding nothing but that choice.
Our quote and contact forms are protected by reCAPTCHA Enterprise, a Google service that checks the request comes from a real browser rather than an automated script. It starts the first time a form talks to our servers — including when you look up a registration or attach a photo, not only when you send the form. It loads from Google’s servers, receives your IP address and signals about how you interact with the page, and stores data on your device to do that: it is the one thing on this site that does, and it is there for security, not advertising or measurement. That also means your IP address goes to Google in the United States, under the same transfer safeguards described above. We see only whether the check passed, never the signals behind it. Our lawful basis is our legitimate interest in preventing abuse of our forms (Article 6(1)(f)).
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection over the data we hold about you. Email hello@wrapworkxautomotive.co.uk to exercise them. You can complain to the Information Commissioner’s Office at ico.org.uk.
You can object at any time to anything we do on the basis of legitimate interests — the fair-use limits, the server logs, visit counting, and the anti-abuse check on our forms. Email us and say so; for visit counting you can also use the switch above.
One limit worth being straight about: entries in the server logs cannot be picked out and deleted one at a time — they expire on their own 30-day cycle. If you ask us to erase your data, we delete your quote record and photos straight away, and the log lines go when their 30 days are up.
Updated
Last updated 8 October 2026.