Privacy Policy
Last updated: 29 October 2026
This Privacy Policy explains how [Legal name of the business, e.g. Spannr Limited] ("Spannr", "we") collects and uses personal data in connection with the Spannr website and service, and the rights you have under the General Data Protection Regulation ("GDPR") and the Irish Data Protection Act 2018.
1. Who we are
The controller of the personal data described in this policy is [Legal name of the business, e.g. Spannr Limited], [Registered address, Ireland] (company number [CRO company number, or 'sole trader' details]). For any privacy question or request, email privacy@spannr.ie.
2. Whose data this policy covers
This policy covers personal data about:
- people who visit our website;
- people who register a workshop or use a Spannr login (workshop administrators, mechanics and dealer users);
- people who contact us.
Workshops' own customers. When a workshop uses Spannr to record its customers' details (for example a customer's name, phone number, vehicle registration, VIN and job notes and photos), the workshop is the controller of that data and Spannr processes it only on the workshop's behalf, under our Data Processing Agreement. If you are a customer of a workshop, please contact that workshop about your data; we will help them respond to you.
3. What we collect
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored only as a secure hash), language preference, role (administrator, mechanic, dealer), the workshop name, when you accepted our Terms and Privacy Policy. |
| Billing data | Plan, billing period, subscription status and dates, and a customer reference from our payment provider. Card details, billing address and VAT number are collected and held by Stripe, not by us. |
| Usage and technical data | IP address and browser/device information recorded with your login sessions, security and error logs kept by our hosting provider, and records of actions such as sign-ins and changes made by administrators. |
| Communications | Messages you send us and our replies, and service emails we send you (for example account activation). |
| Cookies and local storage | Only what is strictly necessary to log you in and remember your language and theme. See our Cookie Policy. |
We do not use advertising or analytics trackers, and we do not sell personal data.
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, providing the Service, activating your account by email | Performance of a contract (6(1)(b)) |
| Taking payments, managing trials and subscriptions, issuing invoices | Performance of a contract (6(1)(b)); legal obligation for accounting and tax records (6(1)(c)) |
| Keeping the Service secure, preventing fraud and misuse (including repeated free trials), troubleshooting | Legitimate interests (6(1)(f)): protecting our customers, our service and our business |
| Service messages (for example changes to terms or prices, security notices) and answering your enquiries | Performance of a contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Improving the Service using aggregated, non-identifying statistics | Legitimate interests (6(1)(f)) |
| Complying with the law and responding to lawful requests; establishing or defending legal claims | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) |
We will only send you marketing emails if you have agreed to receive them, and every such email will let you opt out. Where we rely on legitimate interests, you can object (see section 9).
6. Transfers outside the EEA
Some providers are based in, or may access data from, countries outside the European Economic Area. Where that happens we make sure the transfer is protected: the United Kingdom benefits from an EU adequacy decision; for the United States we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards where needed. You can ask us for more information about these safeguards.
7. How long we keep it
- Account data: for as long as the account exists. When a workshop is closed, we delete it as described in our Terms (section 14).
- Billing and invoice records: 6 years from the end of the financial year they relate to, as required by Irish tax law (Taxes Consolidation Act 1997, s. 886).
- Login session records: until the session ends or expires (normally within 7 days of last use).
- Hosting security and error logs: a short period set by our hosting provider, normally no more than 30 days.
- Emails with us: up to 2 years after the conversation ends, unless needed longer for a dispute.
- Backups: overwritten on a rolling basis, within 30 days.
8. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, strict separation of each workshop's data, role-based access (for example mechanics cannot see customer phone numbers), limited internal access, and providers with recognised security certifications. No system is perfectly secure; if a personal data breach occurs that is likely to put you at risk, we will tell you and the Data Protection Commission as the law requires.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where there is no good reason for us to keep it;
- restrict how we use it in certain circumstances;
- receive data you gave us in a portable format;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where we rely on consent.
To use these rights, email privacy@spannr.ie. We will reply within one month (this can be extended by two further months for complex requests; we will tell you if so). We may need to confirm your identity first. There is normally no charge.
10. Children, automated decisions and changes
- Spannr is a business service and is not intended for anyone under 18.
- We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
- We may update this policy. We will post the new version here with a new date and, for significant changes, tell account holders by email or in the app.
11. Contact and complaints
Questions or requests: privacy@spannr.ie, or write to [Legal name of the business, e.g. Spannr Limited], [Registered address, Ireland].
You also have the right to complain to the Irish supervisory authority, the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie. We would appreciate the chance to deal with your concerns first.