GDPR Compliance
Last updated: 28 September 2026
Our Commitment to GDPR
Motorworks is committed to helping you comply with the General Data Protection Regulation (GDPR). As an Irish company, we understand the importance of data protection and have built our platform with privacy in mind.
Your Role and Ours
You are the Data Controller. You determine why and how personal data is processed. You're responsible for ensuring you have a lawful basis for processing your customers' data.
We are the Data Processor. We process data on your behalf according to your instructions. We implement technical and organisational measures to protect that data.
Where we are the Data Controller. For the Motorworks sign-in accounts of you and your staff, including passwords, two-step verification, sign-in sessions, alert settings and security logs, we decide how that information is used to run and protect the service, so we are its controller. Our Privacy Policy covers that information, including what the Motorworks mobile apps handle.
How We Help You Comply
Data Minimisation
Motorworks only collects the data necessary for garage operations. We don't require unnecessary personal information.
Data Export (Portability)
Export customer data in standard formats (CSV) to fulfil data portability requests from your customers.
Data Deletion
Contact Motorworks support about a customer data erasure request. Archiving a customer preserves their records and does not erase their data. Some records may need to be retained for legal or accounting purposes.
To delete a staff member's Motorworks sign-in account, follow the steps on our account deletion page.
Data Access
Use customer records and exports to gather information for a subject access request. Contact support if you need help locating additional records.
Security
We use encryption, access controls and security checks to protect customer data.
Data Location
All Motorworks data is stored within the European Union (Ireland, EU-West-1 region). We do not transfer data outside the EEA without appropriate safeguards.
Supplier-invoice reading and the Motorworks mobile apps also rely on providers that process data rather than store it. Supplier-invoice page images are sent to OpenRouter to be read, with a request that the model provider doesn't keep them, and alerts in the Motorworks mobile apps are delivered through Google Firebase Cloud Messaging and the Apple Push Notification service. OpenRouter is based in the United States, and Google and Apple run global networks; Google and Apple take part in the EU-US Data Privacy Framework, and the table below shows where each provider operates.
Sub-Processors
We use the following sub-processors to provide our service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting | EU (Ireland) |
| Vercel | Application hosting | EU |
| Emailit | Transactional email | EU |
| OpenRouter | Supplier-invoice reading | United States |
| Google Firebase Cloud Messaging | Android app alerts | Global (Google) |
| Apple Push Notification service | iPhone app alerts | Global (Apple) |
Data Processing Agreement
We provide a Data Processing Agreement (DPA) to all customers on request. This agreement sets out our obligations as a data processor and your rights as a data controller.
To request a DPA, please contact privacy@motorworks.ie.
Your Obligations
As a garage using Motorworks, you should:
- Have a lawful basis for processing customer data (typically "legitimate interests" for service records)
- Display a privacy notice informing customers how their data is used
- Respond to data subject requests within one month
- Report data breaches to the DPC within 72 hours (if applicable)
- Keep records of processing activities
Breach Notification
In the event of a data breach affecting your data, we will notify you without undue delay and within 72 hours of becoming aware of the breach, providing all information necessary for you to fulfil your own reporting obligations.
Contact Our DPO
For any questions about GDPR or data protection, please contact:
