Privacy Policy

Last updated: April 2026

1. Introduction

M&M Performance operates mandmautoperformance.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

2. Information We Collect

We collect information in the following ways:

  • Personal Information: Name, email, phone, address, date of birth (for age verification)
  • Driver Information: Licence number, expiry date, driving history (for vehicle rental)
  • Payment Information: Card details (processed securely via Stripe — we never store raw card data)
  • Device Information: IP address, browser type, operating system
  • Usage Data: Pages visited, time spent, actions taken

3. How We Use Your Information

  • Processing rental bookings and payments
  • Verifying your identity and eligibility
  • Communicating with you about bookings
  • Improving our services
  • Marketing (with your consent only)
  • Complying with legal obligations

4. Data Security

  • HTTPS encryption (SSL/TLS) on all connections
  • Secure password hashing via Supabase Auth (bcrypt)
  • PCI DSS compliance for payment processing (Stripe)
  • Regular security audits
  • Limited staff access to sensitive data

5. Driving Licence & DVLA Verification

Because certain vehicles are age- and experience-restricted, we verify your eligibility before hire:

  • We use your date of birth and test-pass date to confirm you meet the minimum age and licence-tenure for the vehicle.
  • Where provided, your driving licence number is checked against your date of birth and (where enabled) verified with DVLA. We do not store the full licence number — only a masked reference and the pass/fail outcome are retained.
  • This processing is necessary for the performance of your hire contract and to meet our insurers' underwriting requirements (UK GDPR Art. 6(1)(b) and (f)).

6. Your Rights (UK GDPR)

  • Access your personal data
  • Correct inaccurate data
  • Request deletion (right to be forgotten)
  • Restrict processing
  • Data portability
  • Object to processing

To exercise these rights, contact: privacy@mandmautoperformance.com

7. Cookies

We use cookies for authentication, preferences, and analytics. See our Cookie Policy for details.

8. Third Parties

  • Stripe: Payment processing
  • Supabase: Data hosting (EU region)
  • Google Gemini: AI concierge (anonymised prompts)
  • DVLA: Driving licence verification (where enabled)

9. Contact

Data Protection Officer: dpo@mandmautoperformance.com
General Inquiries: privacy@mandmautoperformance.com
Address: London, United Kingdom