Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data Kerb (“we”, “us”) collects, why, and what rights you have.

Who is the data controller

The controller of your personal data is Ondřej Kaule, a sole trader (OSVČ) registered in the Czech Republic — business registration number IČO 06901786, tax ID DIČ CZ9708043037, registered address Na Hrázi 162/9, 417 41 Krupka, Czech Republic, email ondra.k5566@gmail.com, telephone 735544424. Contact us at that address about anything in this policy.

The law we process your data under

We process personal data under the UK General Data Protection Regulation and the Data Protection Act 2018 for our UK customers, and under the EU General Data Protection Regulation (Regulation (EU) 2016/679), which applies to us as a controller established in the Czech Republic. Where both apply we give you the benefit of whichever is stronger. Electronic marketing and cookies are additionally governed by PECR in the UK and the ePrivacy rules in the EU.

What we collect

• Account details — your name, email address, company name and (optionally) a mobile number for SMS reminders. If you sign in with Google, we receive your name, email address and Google account ID from Google; we never receive your Google password.
• Vehicle details — the registration numbers you add, plus the vehicle and MOT information we retrieve for them from the DVSA (make, model, MOT test dates and history, outstanding recall status), and any insurance or tax renewal dates you enter yourself.
• Phone verification data — if you verify your mobile number, we store the number, the time of verification and a short-lived one-time code.
• Billing data — your plan, subscription status and payment history. Card details are handled entirely by our payment providers; we never see or store your full card number.
• Marketing enquiries — if you submit your email address to one of our sign-up or free vehicle-check forms before you have an account, we store that address so we can follow up.
• Advertising attribution — if you reach us from one of our adverts, the click identifier and campaign name carried in the link are stored against your enquiry or account, so we can tell which advert brought you in. If you accepted marketing cookies, we may also send that click identifier back to Google to record the sign-up.
• Anonymous visit counts — daily totals of visits to our pages (which page, the campaign name in the link, scroll depth, sign-up button presses), kept on our own server with no IP address or identifier and shared with no one. Choosing “Only essential” on the cookie bar turns this off. See the Cookie Policy.
• Usage & technical data — sign-in times, IP address and basic logs needed to run the service securely and to rate-limit abuse.

Why we use it (and our legal basis)

• To provide the service and send you MOT, tax and insurance reminders by email — performance of a contract.
• To send SMS reminders and to verify your mobile number — only where you have consented (you can withdraw consent at any time in Settings).
• To keep the service secure, prevent abuse and enforce rate limits — our legitimate interests.
• To take payment for paid plans and keep the records tax law requires — performance of a contract and legal obligation.
• To follow up on marketing enquiries you submitted to us, and to measure our advertising — consent, which you can withdraw at any time.

Who we share it with

We do not sell your data. We share it only with the providers needed to run Kerb:

Where your data goes

Our servers and our email/SMS provider are in the EU or the UK. Some providers (payments, sign-in, advertising measurement) are US-based and may process your data outside the UK/EEA. Where that happens, the transfer is covered by the standard contractual clauses (with the UK addendum) or an equivalent safeguard in that provider's terms.

How long we keep it

• Account and vehicle data — for as long as your account is active, then deleted within 90 days of you closing it.
• Billing records — kept for as long as accounting and tax law requires us to (up to 10 years), even after your account is closed.
• Reminder logs — up to 24 months, so we can show you what was sent and prove a message went out.
• Security and rate-limit logs — up to 12 months.
• Marketing enquiries — until you ask us to remove you, or 24 months after your last interaction, whichever is sooner.

Automated decisions

Kerb does not make automated decisions with legal or similarly significant effects about you. Reminder timing is a simple date calculation, not profiling.

Security

Access to the service is over HTTPS, passwords are stored hashed (never in plain text), sign-in attempts are rate-limited and locked out after repeated failures, and every query for your vehicles is scoped to your account so other customers can never see them.

Your rights

Under UK GDPR you can ask us to access, correct, delete or export your data, or to restrict or object to how we use it, and to withdraw any consent you have given. To exercise any of these, email ondra.k5566@gmail.com. We answer within one month. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or to the Czech Office for Personal Data Protection (ÚOOÚ) at uoou.gov.cz.

Cookies

See our Cookie Policy for exactly which cookies we set and how to change your choice.

Changes to this policy

If we change this policy materially we will update the date at the top and, where the change affects you, tell you by email.

Contact

Questions about this policy or your data: ondra.k5566@gmail.com.