How Workshop Diary uses personal information

1. Who we are

Workshop Diary is the trading name used for this website and software service.

For privacy questions, data requests or concerns, contact us at hello@workshopdiary.co.uk.

2. What this policy covers

This policy covers personal information processed through:

• The public Workshop Diary website
• Demo, contact and help-widget enquiries
• Customer onboarding and account administration
• The Workshop Diary app and customer portal once live
• Workshop, customer, finance, HR, leave, payroll, parts and document workflows inside the software
• HMRC/API-connected services, including Making Tax Digital and payroll-related submissions where enabled

This policy is written as a broad, site-wide notice. A customer agreement, subscription terms and data processing terms may add more detail for paying customers and their own data controller obligations.

3. Our role: controller and processor

For public website enquiries, commercial communications, billing, account administration and our own business records, we normally act as a data controller because we decide why and how that information is used.

For data that a workshop enters into Workshop Diary about its own customers, suppliers, employees, vehicles, jobs, invoices, HR records, payroll and finance workflows, the workshop will usually be the data controller and Workshop Diary will usually act as a data processor, processing that information on the workshop’s instructions.

Where HMRC-connected services are enabled, HMRC is not our processor. HMRC receives and handles tax information under its own statutory functions. We act as the software provider that helps the customer or authorised agent connect to HMRC and use the relevant API functions.

4. Information we collect from website visitors and prospects

When you contact us, request a demo, use the help widget or enquire about Workshop Diary, we may collect:

• Your name, email address, phone number and business/workshop name
• Team size, current software setup, plan interest and enquiry details
• Messages submitted through the website, help widget or email
• Basic technical information needed for security, session handling and spam prevention
• Information about which page or route your enquiry came from, where available

5. Information processed inside Workshop Diary

Depending on the modules a customer uses, Workshop Diary may process information such as:

• Workshop account users, permissions, departments, roles and audit events
• Customer names, contact details, job requests, approvals and portal messages
• Vehicle, job, task, technician, inspection, service sheet, checklist, image and diagnostic records
• Invoices, payments, supplier bills, AP/OCR review data, VAT details and accounting categories
• Parts, suppliers, stock movements, purchase orders and goods-received records
• Employee HR records, policy acknowledgements, leave, sickness, fit notes and return-to-work records
• Payroll profiles, payroll runs, payslips, tax/NI/pension/payment details and RTI preparation/submission records
• System logs, security records, support records and integration events

Some of this information may relate to customers’ customers, employees, suppliers, accountants, advisers or other authorised users. Customers are responsible for making sure they have appropriate notices and lawful bases for entering and using that information in Workshop Diary.

6. HMRC, tax and developer API services

Where a customer chooses to connect Workshop Diary to HMRC services, we may process HMRC-related information needed to provide that feature. This may include business tax identifiers, VAT registration details, agent/client relationships, HMRC authorisation status, OAuth tokens, authorised scopes, VAT obligations, VAT return information, payroll/RTI data and submission responses.

We use HMRC/API-connected data to:

• Help the customer or authorised agent connect Workshop Diary to HMRC
• Retrieve, prepare, validate or submit tax/payroll information where the relevant module is enabled
• Show HMRC responses, obligations, submission status, errors and audit records inside the app
• Maintain evidence of submissions and integration activity for support, audit and compliance purposes
• Meet HMRC developer/API requirements, including required fraud-prevention and user-audit headers where applicable

We do not use HMRC-sourced data for advertising. We do not sell HMRC-connected data. We only use it for the software, tax, payroll, support, audit and compliance purposes connected to the customer’s use of Workshop Diary.

7. Authorisation tokens and access control

HMRC user-restricted API access uses an authorisation flow where the user signs in with HMRC and grants the application access to specified scopes. Workshop Diary may store access and refresh tokens, expiry information and related authorisation metadata so the selected integration can continue to function.

Customers or authorised users should only connect HMRC accounts they are permitted to manage. If access is revoked, expires or is removed, affected HMRC-connected features may stop working until the user reconnects through the appropriate HMRC authorisation journey.

8. Fraud-prevention and audit data for HMRC APIs

Some HMRC APIs require software providers to send fraud-prevention or user-audit information as part of API requests. Where those APIs are used, Workshop Diary may collect and send relevant technical audit information such as device, connection, user and request-context data required by HMRC’s specification.

This information is used to protect tax services, support auditability and help meet HMRC API obligations. The exact data sent depends on the HMRC API, the device/session context and the technical requirements in force at the time.

9. How we use personal information

We may use personal information to:

• Respond to website enquiries, demo requests and help-widget messages
• Create, manage and support Workshop Diary customer accounts
• Provide the app, customer portal, module features and subscription services
• Send service messages, account notices, support replies and operational emails
• Process invoices, payments, billing records and subscription administration
• Maintain security, permissions, session controls, audit trails and fraud prevention
• Provide OCR, email, SMS, open banking, payment, HMRC and other integrations where enabled
• Improve and troubleshoot the service
• Comply with legal, regulatory, tax, accounting and contractual obligations

10. Lawful bases

Depending on the context, we may rely on:

• Contract: to provide Workshop Diary, onboarding, support, subscriptions and requested services.
• Legitimate interests: to respond to business enquiries, improve the service, secure the platform and keep appropriate business records.
• Legal obligation: where processing is needed for tax, accounting, payroll, regulatory or compliance duties.
• Consent: for optional marketing or non-essential cookies where consent is required.

Special category information may arise in HR or absence workflows, such as sickness, fit note or return-to-work information. Where customers use those features, they are responsible for ensuring an appropriate lawful basis and Article 9 condition applies. Workshop Diary processes that information as part of the configured service and customer instructions.

11. Who we may share information with

We do not sell personal information. We may share information where reasonably needed with:

• Hosting, infrastructure, database, backup and security providers
• Email, SMS and notification providers
• Payment processors and subscription/billing providers
• OCR/document extraction providers where AP or document processing is enabled
• Open banking/account information providers where bank feeds are enabled
• HMRC and government gateways where tax/payroll/API services are enabled
• Professional advisers, accountants, auditors, insurers or legal advisers where necessary
• Law enforcement, regulators or authorities where required by law or necessary to protect rights/security

Where third parties process information for us, we aim to use appropriate contracts and safeguards. Where a customer enables a third-party integration, that integration may also be subject to the third party’s own terms and privacy information.

12. International processing

Some suppliers may process information outside the United Kingdom. Where that happens, we will seek to use appropriate safeguards or transfer mechanisms required for the relevant processing.

13. Retention

We keep personal information only for as long as reasonably needed for the purposes described in this policy. Website enquiries may be kept while we deal with the enquiry and for a reasonable business record period afterwards.

Customer account, app, tax, payroll, HR, accounting, audit and integration records may need to be kept for longer depending on the customer’s subscription, legal requirements, accounting/tax retention needs, support history, dispute handling, backup cycles and agreed deletion/export arrangements.

14. Security

We use technical and organisational measures intended to protect information, including role/permission controls, tenant separation, secure session handling, audit trails, restricted administrative access and supplier controls appropriate to the service being provided.

No online service can be guaranteed to be completely secure. Customers should use strong passwords, protect administrator accounts, keep user access up to date and only connect integrations they are authorised to use.

15. Automated processing and AI-assisted features

Workshop Diary may include automation, OCR extraction, validation, suggested categorisation, summaries or workflow assistance. These features are intended to help users review information and make decisions; they should not be treated as a substitute for human checking where accuracy matters.

We do not currently intend the public website to make solely automated decisions about individuals with legal or similarly significant effects.

16. Marketing

We may respond to enquiries and send service-related communications. We will not treat a demo request as blanket consent for unrelated marketing. Where optional marketing consent is required, we will ask for it separately and provide a way to withdraw it.

17. Cookies and help widget

Our use of cookies, browser storage and similar technology is explained in the Cookie Policy. The first-party public help widget captures a message only when you submit it and does not require a third-party chat provider.

18. Your rights

Depending on the circumstances, you may have rights to request access to personal information, ask for inaccurate information to be corrected, request erasure or restriction, object to certain processing, request portability, withdraw consent where consent is the lawful basis, and complain to the UK Information Commissioner’s Office.

If your information is held inside a workshop’s own Workshop Diary account, we may need to refer the request to that workshop as the data controller. To raise a request with us, email hello@workshopdiary.co.uk.

19. Changes to this policy

We may update this policy as Workshop Diary develops, including when new modules, integrations, subscription flows, HMRC API features or support processes go live. The current version will be published on this page.