Privacy Policy
This Privacy Policy was last updated on October 11, 2025.
Introduction
The Tyre Connect is committed to protecting the privacy and personal data of our customers. This Privacy Policy outlines how we collect, use, and protect your information when you use our services and visit our website.
Scope
Applies to https://thetyreconnect.co.uk and any pages that load our header or scripts. UK residents targeted. Service is not directed to children, but it is usable by all ages.
What we collect
Order and fulfilment data: name, email, phone, vehicle reg, billing/shipping addresses, order contents, totals, chosen payment method, payment intent/reference, notes.
Any other relevant information necessary for processing orders and providing services (e.g., Jump-Starts, Puncture Repairs, Spare Wheel Fitting).
Operational data: Cloudflare Turnstile token and assessment result, IP address and headers processed transiently at the edge for security; we do not retain them post-use.
Accountancy data: invoice and tax records derived from orders.
Analytics data: GA4 events and identifiers from visitors who consent.
Why we use data and lawful bases
Take and manage orders; customer updates and fitting/dispatch → Contract.
Payments and fraud prevention (Stripe online; myPOS in-person) → Contract + Legitimate interests.
Security, abuse, bot mitigation (Cloudflare Workers/Turnstile) → Legitimate interests. (Cloudflare Docs)
Tax and statutory records → Legal obligation.
Analytics and product improvement (GA4) → Consent under PECR.
No automated decision-making with legal effects.
Recipients and processors
Cloudflare: Workers, D1, R2, and related edge services to run the site and store orders; configured for EU regional processing. (Cloudflare Docs)
Squarespace: website hosting and cookie banner; may set its own functional cookies. (Squarespace Help)
Payments: Stripe for online; myPOS for in-person. We never collect or store card numbers, bank details or any payment related information. Stripe incorporates the UK International Data Transfer Addendum and SCCs. myPOS states GDPR compliance. (Stripe)
Email delivery: Resend for transactional messages.
We do couriering and fitting in-house. No third-party sharing for marketing.
International transfers
Cloudflare is set to EU regional services for Workers/R2/D1. Some metadata and operational routing may still transit Cloudflare’s global network unless you enable all Data Localization controls; we configure EU processing. (Cloudflare Docs)
Stripe and Google Analytics may transfer data outside the UK/EEA. Transfers rely on the UK Addendum and EU SCCs where applicable. (Stripe)
Squarespace may place cookies and process limited data consistent with its policies, which can involve non-UK regions. (Squarespace)
Retention
Orders, invoices, and related records: 6 years from financial year end (HMRC).
D1 order rows: kept in line with the above unless we must keep longer for disputes or fraud.
Turnstile tokens and edge security artifacts: transient; we do not persist beyond operational use.
Server/edge logs under our control: aim for ≤30 days.
GA4 analytics: ≤14 months when consented.
Support emails: 24 months, unless needed longer for complaints or legal claims.
If deletion is requested and we must retain certain records, we will anonymise where possible.
Your rights
You can request access, rectification, erasure, restriction, portability, and to object where we rely on legitimate interests. To do so, contact us at customer-service@thetyreconnect.co.uk.
Security
TLS in transit; principle of least privilege; Cloudflare edge protections including Turnstile; segregated order storage in Cloudflare D1; assets in Cloudflare R2 with EU regional configuration. (Cloudflare Docs)
Changes
We will update this notice as our services or law change. We will date-stamp updates.
Data minimisation statements
We collect order data only at checkout submission. No abandoned-cart tracking.
We do not log IP/headers beyond transient security processing.
We do not sell data or share for third-party advertising.