← Back to the garage

Privacy notice

Last updated: 29 October 2026

This notice explains how Greg Leupold trading as GML Garage uses personal information in connection with this website, enquiries and reader contributions. Greg is the data controller for these activities.

Email: gmlgarage80s@gmail.com
Telephone: 07762 570656

What we collect and why

• Enquiries: your name, email address, messages and any details you choose to provide. We use these to answer questions and manage correspondence, relying on our legitimate interests in running the business and responding to people. Where you ask about a purchase, we also process information to take steps at your request before entering a contract.
• Direct orders, if agreed: contact and delivery details, order history and payment confirmation, to perform the contract. Accounting information is also kept to meet legal obligations. Do not email card numbers or sensitive payment credentials.
• Community contributions: the artwork, photos, story, chosen display name and permissions you supply. We use consent to publish identifiable contributions on the website. We will ask separately before using them for advertising or social media. Sending an enquiry does not subscribe you to marketing.
• Website delivery and security: hosting and network providers may process IP addresses, browser/device information, requested pages, timestamps and security logs to deliver and protect the website. Our purpose is secure, reliable operation, relying on legitimate interests.

Information comes from you, your browser, and service providers supporting the activities described above. Providing enquiry and contribution information is optional; we may be unable to respond, publish or fulfil a requested order without the necessary details. We do not use automated decision-making or profiling to make decisions with legal or similarly significant effects.

Who receives information

Service providers supporting website hosting and network delivery (OpenAI Sites and its infrastructure providers), email (Google/Gmail), and, when needed for a direct order, payment services, delivery companies and professional advisers may process relevant information. We may disclose information where required by law or to establish or defend legal claims. We do not sell your personal information.

A published contribution is visible to anyone and may be copied or indexed by others. Your private email address and correspondence are not published with your contribution.

Services outside the UK

Our hosting and email services operate internationally, so information may be processed outside the UK. Applicable provider arrangements may use UK adequacy regulations or approved contractual safeguards, including the UK International Data Transfer Agreement or UK Addendum where required. Contact us for details of the arrangements relevant to your information and how to obtain a copy of applicable safeguards.

How long information is kept

Routine enquiries are kept for up to 12 months after the last meaningful contact, unless an ongoing matter or legal claim requires longer. Direct-order and accounting records are retained for the applicable statutory tax-record period, generally at least five years after the relevant 31 January Self Assessment submission deadline for a sole trader. Relevant records may be kept longer where a legal obligation or dispute requires it.

Identifiable community contributions remain published while we have your permission and the contribution remains relevant. We review these periodically and remove them when consent is withdrawn. A limited record of permission and withdrawal may be retained as necessary to demonstrate how your request was handled. Technical logs are managed under hosting providers’ retention arrangements and retained only as needed for delivery, security and legal requirements.

Your rights and choices

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal information. You can withdraw consent at any time by contacting us; this does not affect processing that was lawful before withdrawal.

You have the right to object to processing based on legitimate interests, and to direct marketing at any time. Email us to exercise this right. We normally respond to rights requests within one month, subject to lawful extensions or exceptions, and may need to verify your identity.

You can complain to us using the contact details above. You also have the right to complain to the Information Commissioner’s Office (ICO).

Children and family contributions

Children should ask a parent or guardian to contact us. An adult must arrange any submission involving a child. Please avoid sending children’s full names, schools, addresses, location details or identifiable photographs unless we have discussed the permissions needed. We will check appropriate permissions before publication.

Other websites and browser storage

Amazon and Facebook operate under their own privacy notices when you follow their links. See our cookies and storage notice for the discovery checklist and website technology.