Data Processing Addendum
Last updated 25 October 2026. This addendum forms part of the agreement between the garage ("Controller") and MangyByte Ltd ("Processor") for the GarageByte service.
Roles
When a garage uses GarageByte to process its own customers' personal data, the garage is the data controller and MangyByte Ltd is the data processor. We process that personal data only on the garage's documented instructions, being the provision of the service.
Nature & purpose of processing
Storing and processing garage-customer records, vehicles, bookings, health checks, invoices and communications for the purpose of operating the garage's booking and management workflow.
Categories of data & data subjects
Data subjects are the garage's customers and staff. Data includes contact details, vehicle details, booking and service history, and related communications. We ask garages not to store special-category data in the system.
Our commitments
We keep personal data confidential, apply appropriate technical and organisational security (including per-garage database isolation, access controls, encryption in transit and nightly backups), and require our sub-processors to do the same. We assist the garage with data-subject requests, breach notification and, where relevant, data-protection impact assessments.
Sub-processors
We use these sub-processors. We remain responsible for their performance and will inform garages of material changes.
- Hetzner Online GmbH: hosting and backups. Holds all garage data.
- Twilio: sends text messages and receives the replies. Receives the customer's mobile number and the message text of each text and of each reply.
- ClickSend (part of Sinch): sends text messages. Receives the customer's mobile number, the message text and the sender name.
- Vehicle Data Global: supplies vehicle data. Receives the vehicle registration number only.
- Migadu: delivers email. Receives the customer's email address and the content of each email.
- Cloudflare: protects the website, runs the anti-spam check on forms, and carries vehicle registration checks to the DVLA, which receives the registration number.
- Google Cloud: checks the free text on public booking, callback, contact and car enquiry forms for abusive content. Receives the text of the message.
- Ideal Postcodes: finds an address from a postcode. Receives the postcode.
- Hive: checks the photos that garage staff upload (health check, service sheet and blog photos) for abusive content, for garages that have this check turned on. Receives the photo.
- Stripe: takes the garage's plan payments and credit top-ups. It receives the garage's own billing details only. It does not receive the personal data of the garage's customers.
If a garage connects its own accounting software, we send invoice data to it on the garage's instruction.
International transfers
Personal data is hosted on servers in Helsinki, Finland, in the European Union. Some sub-processors above are based outside the UK and the EU. Where they are, the transfer is made under an appropriate safeguard recognised by UK and EU data-protection law.
Return & deletion
On termination the garage can ask us for an export of its data. We then delete the garage's personal data 60 days after its plan ends, or sooner on request, unless retention is required by law. Copies in our backups are deleted when each backup is deleted, within two years. We do not treat a garage that we suspended for a failed payment as a garage whose plan has ended. We keep its data until the garage starts a new plan or asks us to delete it.