Privacy policy

1.Who we are, and the two roles we hold

Workbay is a trading name of Jobiit Technologies Limited, a company registered in Ireland (company number 810674) whose registered office is at 79 Berford, Duleek, Co. Meath, A92 E67F, Ireland. We provide workshop-management software to vehicle workshops: the website at https://workbay.ie, the Workbay app for iPhone, iPad and Android, the web portal for administrators at portal.workbay.ie, and the public pages through which a workshop’s customers book, approve estimates and accept invitations (together, the “Service”). Questions about this policy go to hello@workbay.ie; to exercise a right over your own data, write to privacy@workbay.ie.

We hold personal data in two distinct roles, and which role applies depends on who you are:

• We are the controller of the personal data of the people who deal with us directly: the administrators and mechanics who sign in to Workbay (“Users”), the people who visit this website, and the people who correspond with us. Sections 3 to 11 describe that processing.
• We are a processor for the personal data a workshop keeps in Workbay about its own customers, drivers, contacts and vehicles, and about its own staff — their hours, rates, shifts and absences (“Workshop Personal Data”). The workshop is the controller of that data and decides what to record; we process it only on the workshop’s instructions under the data-processing addendum in our terms of service. If you are a workshop’s customer or a member of its staff and wish to exercise your rights over that data, the workshop is the right first port of call; section 11 explains, and we will always help.

2.The short version

• We collect what the Service needs to run and nothing more. No advertising pixels and no tracking cookies. The website uses Google Analytics only if you accept it in the cookie banner; the app carries no analytics.
• Passwords are never seen or stored by us; sign-in is handled by Google’s Firebase Authentication.
• Card numbers go to Stripe, never to us.
• Our systems and database run on Google Cloud in the European Union (Belgium). A small number of named providers process parts of the data, some of them in the United States or the United Kingdom under the safeguards in section 6.
• We do not sell personal data, use it for advertising, or use it to train AI models. One optional feature sends the text of a works description to Google’s Gemini API when a mechanic asks for it to be tidied.
• Workshops own their records and can export them at any time. Closing a workshop deletes them.
• You have the rights listed in section 11, and may complain to the Data Protection Commission.

3.What we collect, and why

Where we are the controller. Most Users are employees or contractors of a workshop, and our contract is with the workshop rather than with them; for those Users our legal basis is our legitimate interest in providing the Service to the workshop that engages them. Where you are the person who contracted with us (for example, a sole trader running your own workshop), the basis is the performance of that contract.

You must provide a name and an email address to hold an account; without them we cannot let you sign in. Everything else in the table is either generated by your use of the Service or optional.

Where we are a processor, the workshop decides what is recorded. Typically that is: customers’ and contacts’ names, business names, addresses, email addresses and telephone numbers; vehicle registrations, VINs and other particulars, which can identify a keeper; photographs and video of vehicles and defects, which can show registrations, locations and occasionally people; signatures on inspection sheets; the names typed by people who approve an estimate or book online; the contents of jobs, inspections, defects, estimates, invoices, statements and bookings; and, about the workshop’s own staff, hourly rates, shift patterns, absences and their kind, and the labour recorded against jobs. We treat all of it as personal data and protect it as such.

Special categories of data. Where a workshop records that a member of staff was absent through sickness, that is health data. We hold it only as the workshop’s processor; the workshop is responsible for its lawful basis (ordinarily employment law, under Article 9(2)(b) of the GDPR and section 46 of the Data Protection Act 2018). The reason for a colleague’s absence is shown only to the workshop’s administrators and to the person concerned, and the rota is read live from our servers rather than copied to devices. We collect no other special-category data, no biometric data (a handwritten signature is an image, not a biometric template), and nothing about children.

Location. We do not collect or store your location. When a workshop takes a Tap to Pay payment, Stripe’s payment software on the device must be allowed to read the device’s location while the payment is taken, as Stripe requires; that reading goes to Stripe under its own privacy policy and is not sent to us.

4.Where it comes from

• You, when you sign up on the website, sign in, or use the app or the portal.
• Your workshop’s administrator, who invites you by name and email address and who records your rate, shifts and absences. The workshop is responsible for having a lawful basis to do so, ordinarily that you work there, and for telling you what it records.
• Address lookup. When a workshop types an address at signup or on a customer record, the characters typed are sent to Autoaddress, which suggests matching Irish and Northern Irish addresses. The address chosen is what we store.
• Vehicle lookup. On Premium, when a workshop looks up a registration, the registration is sent to One Auto API, which obtains the vehicle’s make, model, VIN, engine, colour and test dates from Cartell (for Irish registrations) or UK Vehicle Data (for UK registrations). When a job is opened on a vehicle with a VIN, the VIN is sent to the same provider for the manufacturer’s service schedule. Each provider’s terms limit what we may keep: see section 8.
• Stripe, which tells us the status of the subscription and, on Premium, the outcome of the workshop’s own invoices and payments.
• Apple and Google, which tell us whether a push notification could be delivered and whether an app installation is genuine, and no more.

5.Who processes it for us, and where

We use a small number of providers, each for one job. Each receives only what that job needs, under a written data-processing agreement, and none may use the data for its own purposes. This table is also the list of sub-processors authorised under the data-processing addendum in our terms of service. Where a provider processes data outside the European Economic Area, section 6 says how the transfer is protected.

We update this table before adding or replacing a provider that handles personal data, and email workshop administrators at least thirty days beforehand, as the data-processing addendum promises.

Beyond these providers, we share personal data only: with the workshop you belong to (your name appears on the work you record, on its rota and in its staff list); with the workshop’s customers, where the workshop sends them an estimate, invoice, report or booking confirmation; with our professional advisers under confidentiality; with a buyer or successor of the business, who must honour this policy; and with a public authority, court or regulator where the law requires, in which case we tell the workshop unless the law forbids it.

6.International transfers

Our systems and our database are in the European Union. Some of the providers above process data in the United States or the United Kingdom. For each such transfer we rely on a safeguard the GDPR permits: the European Commission’s adequacy decision for the United Kingdom; the EU-U.S. Data Privacy Framework, for providers certified under it (Google, Stripe, Twilio, Cloudinary, Sentry and Cloudflare are, at the date of this policy); or otherwise the Commission’s Standard Contractual Clauses incorporated in the provider’s data-processing terms, supplemented where needed. We check a provider’s certification before engaging it and on renewal. Copies of the relevant clauses are available on request.

7.Automated decisions and AI

We make no decision about you by automated means that produces legal or similarly significant effects, and nothing in the Service profiles Users or a workshop’s customers.

Two things happen automatically and are worth naming. If a workshop’s subscription lapses, the Service becomes read-only for that workshop after one day; and if a workshop holds more user licences than its plan includes, sign-in narrows to its first administrator after seven days. Both are contractual consequences set out in our terms of service, applied to the workshop rather than to any individual, and notified to the administrators before they take effect. Our internal tools also flag workshops whose trial is ending or whose payment has failed so that we can contact them; that is based on billing status alone.

One feature uses AI. On Premium, a mechanic may ask the app to tidy the spelling and punctuation of a works description. The text of that description is sent to Google’s Gemini API and a suggestion comes back; the mechanic reads both and decides; the original wording is kept when a suggestion is accepted; nothing is sent unless asked, and nothing else is sent with it. The suggestion is not used for any decision about anyone.

The Service also projects an estimated service date for a vehicle from the mileage a workshop records. That is arithmetic on figures the workshop typed in, about a vehicle, and is not profiling.

8.How long we keep it

Where the law requires us to keep something longer, such as a tax record or data subject to a legal hold, we keep only that, and continue to protect it.

9.How we protect it

• Tenant isolation is enforced by the database itself. Every record carries its workshop, and the database refuses to return one workshop’s rows to another workshop’s session; the rule applies to every table and is not left to application code.
• No passwords. Sign-in is delegated to Firebase Authentication; we hold only a verified identity.
• Photographs, video, signatures and documents are never public. They are reachable only through signed links that expire, from storage with public access disabled.
• Encryption in transit (TLS) and at rest, on every provider we use.
• Least privilege. The application connects to the database as a role that cannot bypass isolation; production access is limited to the people who run the Service, and every action they take on a workshop’s account is logged.
• Sensitive staff data stays on the server. The rota, including the reason for an absence, is read live and is not copied to devices; a colleague’s reason is never shown to another mechanic.
• Idempotent, ordered sync. The app’s offline queue is designed so that a lost connection or a force-quit duplicates nothing and loses nothing.
• Backups are taken automatically every day and are subject to the same access controls.

No system is perfectly secure. If you believe an account or the Service has been compromised, email hello@workbay.ie at once.

10.If something goes wrong

If a personal data breach occurs, we will notify the Data Protection Commission within 72 hours where the breach is likely to result in a risk to people’s rights and freedoms, notify affected people without undue delay where that risk is high, and notify any workshop whose Workshop Personal Data is affected without undue delay and in any event within 72 hours of becoming aware, as the data-processing addendum promises. We keep a register of incidents.

11.Your rights

Under the GDPR you may ask us to: give you access to the personal data we hold about you and a copy of it; correct it; erase it; restrict how we use it; give it to you or to another provider in a portable form (portability); and you may object to processing based on our legitimate interests. Where processing is based on consent (push notifications and website analytics) you may withdraw it at any time by changing the setting on your device or in Cookie settings, without affecting what was done before.

To exercise a right, email privacy@workbay.ie from the address you sign in with, or from any address with enough detail for us to identify you. We respond within one month; where a request is complex or there are several, we may extend that by up to two further months and will tell you why. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If you are a workshop’s customer or a member of its staff, your data is in that workshop’s records and the workshop is its controller. We will pass your request to the workshop, tell you we have done so, and help the workshop answer it; the Service lets a workshop view, correct, export and delete a customer’s or staff record itself. If you cannot reach the workshop, we will still help.

Users can do much of this themselves. An administrator can correct your name in the app; Download my data under More gives you a copy of everything recorded about you as a member of your workshop, as CSV files, at any time; your account can be deleted from the same screen; and a workshop administrator can export the workshop’s records at any time.

You may also complain to the Data Protection Commission: www.dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28; +353 1 765 0100. We would rather hear from you first, and will always try to resolve a concern directly.

12.This website, the portal and the public pages

The marketing pages set no cookies and load no third-party scripts unless you accept analytics. There is no advertising pixel and no cross-site tracking. Fonts are served from our own domain. The cookie policy lists every cookie, and “Cookie settings” in the footer changes your answer at any time.

The signup, billing, invitation and account pages, and the portal, use Firebase Authentication to create and sign in to your account. Firebase keeps your signed-in session in your browser’s storage for that site only; it is not a tracking cookie and is not shared with anyone. Those pages also load Google’s reCAPTCHA Enterprise, which Firebase App Check uses to confirm that requests come from a real browser, and the signup form loads Cloudflare’s Turnstile check before an account can be created. Both evaluate technical signals about your browser and neither is used for advertising.

A workshop’s customers reach three kinds of page from email or from the workshop: the online booking page and its booking-management link, the estimate-approval page, and the invitation page for new Users. Each sets no cookies. The details a customer types on the booking page go to that workshop, for which we act as processor. An emailed approval or management link is a one-time credential; please do not forward it.

Our hosting provider keeps ordinary server logs (IP address, page, time, browser) for thirty days, for security and rate limiting.

The website does not respond to browser “Do Not Track” signals; rejecting analytics in the banner switches off everything there is to switch off.

13.Push notifications and email

Push notifications are opt-in through the device’s own prompt, on iOS and on Android. If you allow them, we store a token for your device and use it to tell you about things in your workshop: an estimate answered, a payment received, a booking request, a licence notice. Every notification is also recorded in the app, so the push is a courtesy and the record is not lost if it is missed. Turn notifications off in the device’s settings, or sign out, and the token is deleted.

We email Users about the Service: invitations, verification and password-reset links, billing notices and, occasionally, news about the Service. Billing and account emails are part of the Service and cannot be opted out of while you have an account; news carries an unsubscribe link. We send no marketing to a workshop’s customers; the emails a workshop’s customers receive (estimates, invoices, booking confirmations and reminders) are sent on the workshop’s behalf and reply to the workshop.

14.Card payments and Tap to Pay

When a workshop on Premium takes a card payment, at the counter, by payment link, by Tap to Pay on iPhone or by Tap to Pay on Android, the card is read by Stripe’s software and the card details go directly to Stripe. We never see or store a card number. We receive from Stripe only the outcome (paid, failed, refunded), the amount, the last four digits and card brand for the receipt, and Stripe’s identifiers. Tap to Pay additionally involves Apple or Google, which processes the tap on the device under its own privacy terms and does not learn what was bought, and requires Stripe’s software to read the device’s location while the payment is taken (section 3).

The workshop is the merchant for these payments and appears on its customer’s statement. Stripe’s privacy policy describes what Stripe does with payment data.

15.Children

The Service is for business use. Users must be at least sixteen, the age at which an apprentice may start in a workshop. We do not knowingly collect personal data from anyone younger; if we learn that we have, we delete it.

16.Changes to this policy

When this policy changes, the date at the top moves and we email workshop administrators before a change that affects them takes effect, and at least thirty days before a change that adds a provider or a purpose. The current version is always at https://workbay.ie/legal/privacy.

17.Contact

Controller: Jobiit Technologies Limited, trading as Workbay, 79 Berford, Duleek, Co. Meath, A92 E67F, Ireland. Registered in Ireland, company number 810674.

Data-protection enquiries and all other questions: hello@workbay.ie. We are established in Ireland. We have not appointed a data-protection officer, because Article 37 of the GDPR does not require one of us; the same address reaches the people responsible.