This policy explains what personal data TowMate ("TowMate", "we") collects, why, and what you can do about it. TowMate is the data controller for the purposes of the UK GDPR and Data Protection Act 2018. Contact our data team at privacy@towmate-recovery.com.
Data controller
- Trading name
- TowMate
- Registered company name
- Towmate
- Company number
- To be confirmed (registered in England and Wales)
- Registered office
- To be confirmed
- Website
- towmate-recovery.com
- Contact
- privacy@towmate-recovery.com
What we collect
- Account details: name, email, phone number, password hash.
- Vehicle details: registration and description.
- Location data: pickup and drop-off addresses, plus precise live location of your device (and your Partner’s vehicle) while a job is active.
- Payment data: card is tokenised by Stripe; we never see or store card numbers.
- Support conversations, ratings, and in-app diagnostic events.
- Cookies and similar technologies (see Cookies section below).
Why we use it and the legal basis
- Contract: to match you with a Partner, take payment, provide receipts and support the job.
- Legitimate interests: fraud prevention, service safety, product improvement, and business analytics.
- Legal obligation: tax records, incident reporting, and responses to lawful requests.
- Consent: optional marketing emails and non-essential cookies — you can withdraw consent at any time.
Who we share it with
Assigned Partners see your name, phone number, vehicle and live location while the job is active. We use trusted service providers ("subprocessors") to run the platform:
- Stripe Payments Europe — card processing and payouts.
- Google Maps Platform — mapping, geocoding and routing.
- Supabase (Lovable Cloud) — database, authentication and file storage (EU region).
- Email delivery providers — transactional emails and receipts.
We do not sell your personal data. We disclose data to authorities only where legally required.
International transfers
Data is primarily stored in the UK and EU. Where a subprocessor transfers data outside the UK/EEA, we rely on UK/EU Standard Contractual Clauses and the UK Addendum, together with additional safeguards where needed.
Retention
Job and payment records are retained for 7 years to meet UK tax and consumer-law obligations. Account data is deleted within 30 days of a verified deletion request, except where law requires longer. Anonymised analytics may be kept indefinitely.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent at any time. Exercise any of these from Account → Data requests, or email privacy@towmate-recovery.com. We respond within one month.
You can complain to the UK’s Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
We use strictly-necessary cookies to keep you signed in and to secure the app. Optional analytics cookies only load with your consent, which you can change at any time from Settings → Privacy.
Security
Data is encrypted in transit (TLS 1.2+) and at rest. Access to production data is restricted, logged, and reviewed. We have an incident-response process and will notify you and the ICO of any personal-data breach that is likely to result in a risk to your rights, within 72 hours where required.
Children
TowMate is not intended for anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we’ll delete it.
Changes
We’ll notify you in-app or by email of material changes at least 14 days before they take effect.