Obsidian Motorcycles Ltd, company number 17416643, registered office 66 Lewis Crescent, Wellington, Telford, TF1 2FR, is the controller of personal information described in this notice. We are registered with the Information Commissioner’s Office under reference ZC229951. Contact our privacy lead at info@obsidianmotorcycles.com or 07709 225 038.

We may collect names, addresses, email addresses, telephone numbers, booking and communication records, motorcycle make, model, year, registration or VIN, ownership or authority evidence, service location, photographs, fault and job details, membership selections, payment and invoice status, Direct Debit references, membership cancellation requests and confirmations, complaints, marketing preferences and website or cookie choices.

Where genuinely necessary to support a stranded or vulnerable customer, we may record limited accessibility, safety or health information provided by that person. We will minimise it and remove it when no longer needed unless an incident, claim or legal obligation requires retention.

We process information to answer enquiries, prepare quotations, make and perform contracts, provide mechanics, diagnostics, recovery, transport and membership services, identify motorcycles, take payment, manage accounts, administer renewals and cancellations, keep safety and service records, prevent fraud, resolve complaints, comply with tax and legal duties, establish or defend legal claims, improve operations and—with a permitted basis—send marketing.

Lawful bases

• Contract: to take requested steps and provide booked or membership services, including renewals and cancellations.
• Legal obligation: for accounting, tax, consumer, company, safety and law-enforcement duties.
• Legitimate interests: to operate safely, keep proportionate records, prevent fraud, manage complaints and improve services, balanced against individual rights.
• Consent: for optional electronic marketing and non-essential cookies where consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing.
• Vital interests: exceptionally, to protect someone’s life where they cannot consent.

Sensitive information

Accessibility or health information is special category data. Where we genuinely need it to provide safe assistance, we will normally rely on explicit consent. In an emergency we may instead rely on vital interests where the person is physically or legally unable to consent. Information needed to establish, exercise or defend legal claims may be retained on that basis. We do not request more sensitive information than is necessary.

Where information comes from

Most information comes directly from customers, members or website visitors. We may also receive information from an authorised representative, motorcycle owner or registered keeper, recovery partner, payment provider, insurer, police or other authority, publicly available vehicle source, or referral partner where lawful.

Who we share it with

Where necessary and subject to suitable protections, information may be shared with Tide and other payment or Direct Debit providers including GoCardless; our accountant and accounting software; website and hosting providers including Netlify; Google Workspace; mailing-list and communications providers; recovery or transport subcontractors; parts suppliers where identification is needed; garages, MOT stations or destinations authorised by the customer; professional advisers and insurers; fraud-prevention services; police, courts, regulators and authorities where required; and a buyer or adviser involved in a lawful business reorganisation.

We do not sell personal information. Payment card and bank details are processed by the payment provider and are not stored by Obsidian unless the provider makes limited reference or status information available to us.

International transfers

Some technology providers may process information outside the UK. Where this occurs, we will use an applicable UK adequacy decision, approved contractual safeguards or another lawful transfer mechanism.

How long we keep information

• Enquiries that do not become jobs: normally up to 12 months after the last contact.
• Job, invoice, payment and accounting records: normally six years after the relevant financial period or contract ends.
• Membership, renewal, cancellation and service-history records: normally six years after membership or the customer relationship ends.
• Complaints, disputes, safety incidents and claims: normally six years after closure, or longer where a live claim or legal requirement applies.
• Vehicle photographs: up to six years where part of a job, transport, damage or dispute record; otherwise normally deleted within 12 months.
• Marketing records: until consent is withdrawn or the information is no longer useful, with a minimal suppression record retained to respect opt-outs.
• Cookie preferences: for the period stated in the Cookie Policy or until reset.

These are normal periods. We may keep information for less time where it is no longer necessary, or longer where required for law, tax, safety, fraud prevention or legal claims.

Marketing choices are separate from service enquiries. We will send electronic marketing only where consent or another lawful PECR basis applies. Consent can be withdrawn at any time by using an unsubscribe option or emailing info@obsidianmotorcycles.com. Service, payment, renewal, cancellation and safety messages are not marketing.

Security

We use proportionate organisational and technical measures to protect information. No internet service is completely secure, but access is restricted to people and providers who need it for legitimate purposes.

Depending on the circumstances, individuals may request access, correction, erasure, restriction, portability or objection; withdraw consent; and ask for review of certain automated decisions. To exercise a right, email info@obsidianmotorcycles.com. We may need to verify identity and normally respond within one month.

Automated decisions

We do not currently make decisions with legal or similarly significant effects about customers or members using solely automated processing. If that changes, we will explain the logic, significance, likely consequences and available safeguards before using it.

Children

People under 18 must ask a parent or guardian to enter a service or membership contract. We do not knowingly market directly to children.

Data protection complaints

Email info@obsidianmotorcycles.com with the subject “Data protection complaint”, or write to our registered office. We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep the complainant informed and explain the outcome. You may also complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or call 0303 123 1113.

Changes

We may update this notice when services, providers or legal requirements change. The latest version and update date will be published here.