Privacy Policy

OWVO respects your privacy. This Privacy Policy explains how OWVO LTD collects, uses, stores, shares and protects personal data when you use the OWVO mobile application, customer service, provider service, account and support features, and related OWVO web pages (together, the Services). It also explains your choices and rights.

Please read this policy before using the Services. If you do not agree with it, do not create or use an OWVO account. Some information is necessary to create an account, arrange or provide a wash, make or receive a payment, protect users, or comply with law. If you do not provide that information, the relevant feature may not work.

Privacy contact: support@owvo.co.uk
Unit 52, Stratford Workshops, Burford Road, London, E15 2SP

1. Who we are

OWVO LTD is the controller of the personal data described in this policy unless we explain otherwise.

• OWVO LTD
• Company number: 16988085
• Registered office: Unit 52, Stratford Workshops, Burford Road, London, England, E15 2SP
• Privacy and support email: support@owvo.co.uk

OWVO operates a marketplace that connects customers seeking mobile vehicle-wash services with independent service providers. A provider receives customer information only where it is needed to consider, accept, perform, support or resolve a booking. Providers must use booking information only for legitimate service and legal purposes.

2. Who and what this policy covers

This policy covers:

• customers who search for, book, pay for or review a wash;
• providers who apply, complete verification, publish availability, accept or perform work, receive payouts or interact with customers;
• people who contact support, report an issue, exercise a privacy right or use an OWVO public web page; and
• account, booking, payment, communication, safety, administration and technical information processed through the Services.

This policy does not control how an external service processes information for its own purposes. For example, Google and Stripe may act under their own privacy terms for parts of their services. We identify the main external services below.

3. Personal data we collect

The data we collect depends on whether you are a customer or provider and which features you use.

3.1 Account and contact data

We may collect:

• your name, email address, telephone number, language and profile photograph;
• your OWVO user ID, account role, account status and account timestamps;
• your password in protected form, authentication tokens, email-verification and password-reset information;
• communications preferences and records of your acceptance of applicable policies or provider agreements; and
• account-security, suspension, enforcement and deletion information.

Passwords are stored as one-way password hashes. We do not store your readable password.

3.2 Address and location data

We may collect or process:

• precise GPS coordinates or approximate device location while you use a location-based feature;
• an address, postcode, place name, Google place ID, map point or route that you search for or select;
• the exact service address and coordinates attached to a booking;
• a customer's residential or service address and a provider's service or driveway address;
• a provider's availability area, approximate location for discovery and, during a relevant accepted booking, the location needed to help the customer and provider meet; and
• the last selected or current location stored on your device for convenience.

OWVO uses location to show relevant providers, calculate distance or routes, confirm where the service will take place, coordinate arrival and performance, and investigate safety, fraud or service disputes. A customer's exact booking location is shared with the provider assigned to that booking. Before booking, provider location should be presented at a reduced level of precision appropriate for discovery.

On Android, the current Services use location while you are using the app and do not use Android background-location permission. A foreground location stream may operate while the relevant screen or booking feature remains active. You can deny or revoke location permission in device settings. Where the app offers manual address selection, you can use that instead, but nearby, mapping or arrival features may be limited.

Address searches, place details, geocoding, map display and routes can send search text, a place identifier, address or coordinates to Google Maps Platform services. Google may process that information under its own privacy terms.

3.3 Vehicle data

We may collect:

• vehicle registration mark;
• make, model, year, size or category;
• a vehicle photograph and default-vehicle selection;
• a vehicle snapshot attached to a booking; and
• service and booking history associated with the vehicle.

When you request registration validation, we may send the registration mark to the UK Driver and Vehicle Licensing Agency Vehicle Enquiry service and receive vehicle details in response.

3.4 Booking and service data

We may collect:

• the customer, provider, vehicle and selected service;
• requested date/time, accepted date/time and status changes;
• service address, location and postcode;
• price, discount, coupon, currency and payment status;
• acceptance, arrival, wash-end, completion and cancellation events;
• cancellation reasons, booking history, receipts and ratings status; and
• operational information such as provider availability, daily capacity, completed work, earnings, balance and tips.

3.5 Payment and payout data

We may collect or receive:

• charge amount, currency, transaction/payment-intent reference, payment method type and status;
• booking, customer and provider references associated with a payment;
• purchase, refund, receipt, tip, payout, withdrawal and balance history;
• for providers, account-holder details, billing/residential address, date of birth, sort code, account number and Stripe Connect account/status information; and
• fraud, reconciliation and payment-support information.

Stripe processes customer payment credentials and provider payout onboarding. When Stripe is used as designed, OWVO does not need to store the customer's full card number or card security code in its own database. We do store the transaction and booking information needed to operate, reconcile, support and account for the payment.

3.6 Provider application and verification data

If you apply to provide services, we may collect:

• date of birth and confirmation that you meet the provider age requirement;
• residential/provider address and service area;
• National Insurance number;
• right-to-work information and declarations;
• identity document type and number;
• passport, driving licence or other requested identity/eligibility files;
• public liability insurance evidence;
• driveway eligibility declarations and photograph;
• provider services, availability, online/busy status and work limits;
• bank/payout details; and
• verification submission, review, decision, reviewer, reason and notes.

Authorised OWVO personnel review this information to assess marketplace eligibility, safety and ongoing compliance. These documents are not customer profile content. We do not use identity photographs to create biometric templates or perform facial recognition, and we do not use them to infer sensitive traits.

3.7 Messages, reviews, reports and support

We may collect:

• booking chat messages, participants and timestamps;
• customer-to-provider and provider-to-customer ratings and review text;
• issue or safety reports, including the booking, reporter, reported person, type, description, optional photograph, assigned reviewer, outcome and notes;
• cancellation reasons and support correspondence;
• data-access, correction or deletion requests and our response; and
• transactional email information for verification codes, password resets, service messages and support.

Do not include unnecessary passport numbers, bank information, medical information or other highly sensitive details in chat, reviews or general support messages. If a safety report contains sensitive or alleged-offence information, we will restrict its use and process it only where permitted and necessary for safety, legal obligations, vital interests or legal claims.

3.8 Technical, device and security data

We may process:

• IP address, user agent, device/platform and network/connectivity information;
• login attempt, token, session and socket connection information;
• request, upload, error, hosting and security logs;
• administrator/staff activity logs, including actor, action, entity, time, IP and user agent;
• permission status and operational events such as online status, booking state and policy acceptance; and
• local device storage used for secure authentication, onboarding state and a saved location.

We do not use the reviewed Services for third-party behavioural advertising, and we do not sell personal or sensitive user data. The reviewed release does not intentionally collect your contacts, calendar, microphone/audio, health data or list of installed apps.

4. How we collect personal data

We collect data:

• directly from you when you register, complete a profile or provider application, add a vehicle, choose a location, book, pay, chat, upload a file, rate, report an issue, contact us or exercise a right;
• automatically from your device and use of the Services, including foreground location where permitted, security/session data and technical requests;
• from the other participant in a booking, including messages, ratings, reviews, cancellations and reports;
• from OWVO authorised personnel who review verification, support, safety, payout, enforcement or privacy requests;
• from Stripe regarding payments and provider payouts;
• from DVLA when a vehicle registration lookup is requested;
• from Google mapping/location services for search suggestions, place details, maps, geocoding and routes; and
• from hosting, database, file-storage, email and security providers that operate the Services for us.

5. Why we use personal data and our lawful bases

Under UK data-protection law, we need a lawful basis for each processing purpose. Depending on the context, we use personal data as follows.

5.1 Contract and steps requested before a contract

We process data necessary to:

• create, authenticate and manage your account;
• show relevant services and providers;
• validate vehicle and booking information;
• form, arrange, accept, perform, update, cancel and support bookings;
• share necessary booking information between the assigned customer and provider;
• provide chat, mapping, routing, ratings, receipts and account features;
• charge customers, refund where appropriate, calculate provider earnings and make payouts; and
• respond to service and account requests.

5.2 Legitimate interests

We process data where necessary for our or another person's legitimate interests and those interests are not overridden by your rights. These interests include:

• operating a reliable, accountable and safe marketplace;
• verifying provider eligibility and protecting customers/providers;
• preventing fraud, payment abuse, account misuse and unauthorised access;
• monitoring service capacity, resolving complaints and enforcing marketplace rules;
• establishing, exercising or defending legal claims;
• maintaining system security, logs, backups and service continuity; and
• improving operational reliability without using your data for unrelated advertising.

We apply necessity, balancing, access limitation, minimisation and retention safeguards when relying on legitimate interests. You can object to this processing as explained below.

5.3 Legal obligations

We process data where needed to comply with tax, accounting, data-protection, court, law-enforcement, sanctions, payment, safety or other applicable legal obligations. A provider check may also be processed to meet a legal requirement where that requirement applies to OWVO's relationship with the provider.

5.4 Consent

We rely on consent only where processing is genuinely optional and consent is the appropriate legal basis. You may withdraw that consent at any time. Withdrawing consent does not affect processing already carried out lawfully. A device permission controls access to a device feature; it is not necessarily the sole UK GDPR basis for processing information required to fulfil a service you request.

6. When we disclose personal data

We disclose only the data reasonably needed for the relevant purpose.

6.1 The customer and provider assigned to a booking

The assigned provider may receive the customer's name, profile/contact information needed for coordination, vehicle, selected service, exact service address/location, booking/payment status, chat, and relevant rating or safety context. The booked customer may receive the provider's name, profile photograph, contact details needed for coordination, services, availability, rating, booking status and location needed for the accepted service.

Before booking, a customer may see a limited provider profile, availability/online state, rating, services and approximate area.

Neither participant may use information received through OWVO for unrelated marketing, harassment, discrimination, surveillance or any purpose unrelated to the booking or applicable law.

6.2 OWVO administrators and authorised staff

Personnel may access data where their duties require it, including account support, provider verification, booking operations, precise service locations, payments/payouts, reports, safety/enforcement, privacy requests, security and audit. We use role and permission controls and expect personnel to follow confidentiality and data-handling rules.

6.3 Vendors and service providers

We use companies that host or provide technical parts of the Services. Depending on the feature and production configuration, these include:

• MongoDB for hosted database services;
• Cloudinary for image and document storage/delivery;
• Stripe and Stripe Connect for customer payments, fraud controls, provider onboarding and payouts;
• Google Maps Platform, Places, Geocoding and Directions for address/location search, maps and routes;
• Google/Gmail email infrastructure for transactional email;
• DVLA Vehicle Enquiry for requested vehicle registration validation;
• Render for backend or dashboard hosting; and
• Netlify where used to host an OWVO administration/public web surface.

These providers receive information needed for their function. Some act as processors on our instructions; some, such as payment, mapping or public-authority services, may also process information under their own legal responsibilities and privacy terms.

6.4 Legal, safety and corporate disclosures

We may disclose information where reasonably necessary to comply with law, court order or valid government request; protect a person's safety or rights; investigate fraud or security incidents; enforce our terms; obtain professional advice; handle an insurance or legal claim; or complete a merger, financing, reorganisation or sale with appropriate confidentiality and notice safeguards. We do not sell personal or sensitive user data.

7. International data transfers

Some vendors operate in multiple countries. Personal data may therefore be stored in or accessed from a country outside the United Kingdom. Where UK law restricts a transfer, we use an applicable adequacy regulation, contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. We also consider the nature of the information, the destination and additional technical or organisational safeguards. You may contact us for more information about the safeguard relevant to your data.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose collected, including service, safety, fraud, dispute, legal, tax and accounting needs. We consider the amount, sensitivity, risk, context, legal limitation periods and whether a less identifiable record is sufficient. Our normal targets are:

• Active account and profile: while your account remains open.
• Abandoned or rejected provider application: normally up to 6 months after final activity or decision, unless a safety, fraud or legal reason requires longer.
• Identity, eligibility, right-to-work, insurance and driveway evidence: while needed for verification or provider eligibility, then normally no more than 6 months after it is no longer required, unless an open complaint, fraud review, legal claim or law requires longer.
• Foreground discovery location: for the request or active feature, unless it becomes part of a booking or necessary security record.
• Location saved on your device: until replaced, cleared, account/logout cleanup where implemented, or app removal.
• Booking, exact service location, chat, ordinary reviews and service-support content: normally for the booking and up to 6 months after completion, cancellation or closure of the matter. Payment/accounting fields are retained longer as described below.
• Issue and safety reports: normally up to 6 months after closure, or for as long as an active safeguarding issue, dispute, investigation or legal claim requires.
• Payments, receipts, payouts and accounting records: normally up to 6 years after the end of the relevant accounting period, or longer where law requires.
• Authentication, security and administrative audit logs: normally up to 12 months, or longer for an active incident, investigation or legal requirement.
• Privacy request material: a full export only for the short period needed to complete the request; a minimised request/decision record normally up to 6 months, or longer where needed to show legal compliance.
• Backups: until overwritten on the applicable protected rolling backup cycle. Backup data is not used for ordinary business and deletion is re-applied where a backup is restored.

We may anonymise information so it can no longer be linked to a person. Properly anonymised information is not personal data and may be kept for service statistics, planning and accountability.

9. How we protect personal data

We use technical and organisational safeguards designed for the nature and risk of the information. These can include:

• HTTPS encryption in transit;
• one-way password hashing;
• authentication tokens and protected endpoints;
• secure mobile storage for authentication material;
• role-based and permission-based access controls;
• restricted provider-verification and administration access;
• rate limiting, login controls, security headers and request limits;
• file type/size controls and protected production storage practices;
• activity/security logging and investigation controls;
• backup and service-continuity measures; and
• contracts and security reviews for relevant service providers.

No online or storage system is completely secure. You should use a strong unique password, protect your device, keep authentication codes private, and contact support@owvo.co.uk promptly if you suspect unauthorised access.

10. Your choices and controls

Depending on your role and device, you can:

• edit profile and vehicle details in the app;
• select a service address and, where available, enter one manually;
• allow precise or approximate location, deny permission or change it in device settings;
• choose whether to upload optional photographs or submit optional reviews/reports;
• control provider online/availability settings;
• request a copy of account data through the in-app Help area;
• delete your account in the app; and
• contact us to exercise a legal right.

If you revoke location, photo or file access, the corresponding feature may not work. Revoking a device permission does not automatically delete data already lawfully stored; use the deletion route or contact us for that.

11. Account and data deletion

Customer and provider accounts can request deletion:

1. Open the OWVO Account or Help area.
2. Choose Delete Account.
3. Review the consequences and complete the confirmation shown in the app.

If you cannot access the app, email support@owvo.co.uk from the email associated with your account with the subject Delete my OWVO account. We may carry out a proportionate identity check before acting to prevent fraudulent deletion.

When deletion is completed, we delete or permanently anonymise personal data that we no longer need, including active profile/contact, vehicle, location, provider verification/document and account-access information. We remove or de-identify message/review/report and booking content where appropriate. We also instruct relevant processors to delete data where required and technically applicable.

We may retain a minimised record where necessary for payment, receipts, payouts, tax, accounting, fraud prevention, safety, dispute resolution, legal claims, court/government requirements or proof that we handled the deletion. Retained records are restricted from ordinary account use and deleted or anonymised when the applicable period ends. Data may remain temporarily in protected rolling backups until overwritten.

Deleting the OWVO app from your device does not by itself delete your OWVO account. Account freezing or logging out is also different from deletion.

12. Your data-protection rights

Subject to UK law and applicable exceptions, you may have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• erase data in qualifying circumstances;
• restrict processing in qualifying circumstances;
• port data you provided in a structured, commonly used, machine-readable format where the legal conditions apply;
• object to processing based on legitimate interests;
• withdraw consent for an optional consent-based activity at any time;
• challenge solely automated decisions that have legal or similarly significant effects; and
• complain to the Information Commissioner's Office.

To exercise a right, use the in-app privacy/help feature or email support@owvo.co.uk. Tell us which right you want to exercise and provide enough information to locate your account. We may request proportionate proof of identity. We normally respond within one month, although UK law may permit more time for a complex or multiple request. We will explain any extension, lawful refusal or partial refusal.

The in-app data copy can include account/profile, vehicles, bookings, payments, reports, messages, ratings and receipts. A formal request may require us to search additional relevant systems. Information about another person may be redacted where necessary to protect their rights.

You can complain to the UK Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the opportunity to address your concern first, but you do not have to contact us before complaining.

13. Children

The Services are not directed to children. Provider accounts are for people aged 18 or over. Children must not create a provider account or submit identity, financial or location information as a provider. If you believe a child has supplied personal data contrary to the Services' rules, contact support@owvo.co.uk. We will investigate and restrict or delete the data where appropriate.

14. Automated processing

OWVO uses operational calculations such as nearby matching, distance filtering, service pricing, availability and daily-capacity checks, payment status and rating averages. These support the service. The reviewed Services do not make a decision based solely on automated processing that produces legal or similarly significant effects. Provider verification, account enforcement, report resolution and privacy-request decisions involve authorised personnel. If this changes, we will update this policy and provide any additional information and rights required by law.

15. Changes to this policy

We may update this policy when the Services, vendors, legal requirements or data practices change. We will publish the revised policy with a new effective date and, where a change materially affects your rights or reasonable expectations, provide an appropriate in-app, email or other notice. We will request consent if a new purpose legally requires it. Previous versions may be requested from support@owvo.co.uk.

16. Contact us

For privacy questions, rights requests, account deletion or complaints, contact:

When contacting us, please do not send a password, full payment-card number or unrequested identity document by ordinary email.

End of policy · Effective 11 August 2026 · Version 1.0