Privacy Policy

Last updated: 24 April 2026. Applies to mendmate.co.uk and the Mendmate web application.

Showday Tickets Ltd ("Mendmate", "we") provides repair shop software. This policy explains what personal data we collect, why we collect it, and your rights under the UK GDPR and Data Protection Act 2018.

Who we are

Showday Tickets Ltd is registered in England & Wales. Company No. [PENDING]. ICO registration [PENDING]. Registered address: Bristol, UK.

For shop-side personal data entered by our customers (their end-customers), Mendmate acts as a data processor on behalf of the shop. For account holder and prospect data collected directly by Mendmate, Mendmate is the data controller.

Data we collect

  • Account data — name, email address, business name, hashed password, IP address, session tokens.
  • Shop operational data — customer names, phone numbers, email addresses, physical addresses, device IMEIs, ticket details, repair notes, signatures, photos and payment references, entered by the shop and held on the shop's behalf.
  • Payment metadata — last 4 digits, card brand, Stripe charge IDs. Full card numbers are never stored by Mendmate.
  • Technical data — log data, browser metadata, error reports and security events needed to operate and protect the service.

Lawful basis

  • Contract (UK GDPR Art. 6(1)(b)) — to provide the service you have signed up for.
  • Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve the product. You can object to processing based on legitimate interests.
  • Legal obligation (Art. 6(1)(c)) — for accounting, tax and record-keeping requirements.
  • Consent (Art. 6(1)(a)) — where required, for marketing emails or non-essential cookies.

How long we keep data

  • Active account data — for as long as the account is active.
  • Cancelled account data — up to 90 days for export, then deleted or fully anonymised, subject to longer retention where required by law (e.g. invoice records, ~6 years under UK tax rules).
  • Security and access logs — up to 12 months.

Sub-processors

We engage the following third parties to deliver the service. Each is bound by a written data processing agreement.

  • MongoDB Atlas — primary database hosting (EU/UK region).
  • Render — application hosting (EU/UK region).
  • Cloudflare — DNS, CDN and WAF.
  • Brevo — transactional email.
  • Stripe — payment processing and Stripe Connect settlement.
  • Cloudinary — image and signature storage.

International transfers

Where sub-processors process data outside the UK/EEA, transfers rely on Standard Contractual Clauses or the UK International Data Transfer Addendum.

Your rights

Under the UK GDPR you have the right to access, rectify, erase, restrict processing, data portability, and to object. You can also lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise a right, email privacy@mendmate.co.uk. If the data relates to a shop's end-customer, we will route the request to the relevant shop (the data controller).

Cookies

Mendmate uses a small number of strictly necessary cookies (session and CSRF). We do not currently run third-party analytics; if that changes, a consent banner will be added.

Contact & DPO

Privacy queries, data subject requests, and DPO contact: privacy@mendmate.co.uk.

A Data Processing Agreement (DPA) is available on request for Mendmate customers.

Changes

Material changes to this policy will be notified by email to account holders. The "Last updated" date above always reflects the current version.