KERMO
Back to Kermo

Privacy Policy

How we handle your vehicle and personal data under UK GDPR.

1. Data Controller & Contact

Kermo (kermo.co.uk) is operated as an independent digital web service by a self-employed software developer based in the United Kingdom. We act as the Data Controller for personal data processed through this website. For any privacy queries, Subject Access Requests, or data deletion inquiries, please contact us at:

  • Email: privacy@kermo.co.uk
  • Website: https://kermo.co.uk

2. Lawful Basis for Processing (UK GDPR)

In accordance with Article 6 of the UK GDPR, we process your personal data under the following legal bases:

  • Contractual Necessity: To deliver the services you register for, including maintaining your Garage, recording Vehicle Registration Marks (VRMs), delivering MOT/Tax status alerts, and authenticating you when you choose to sign in with Google.
  • Consent: For non-essential analytical cookies (Google Analytics and Microsoft Clarity), which you may grant or revoke at any time.
  • Legitimate Interests: To monitor system integrity, defend against automated abuse, and safeguard server operations.

3. Information We Collect

We collect only minimal necessary information to deliver our vehicle companion services:

  • Account Information: Email address, name, and password hash when signing up directly. If you choose Sign in with Google, we receive your name, email address, and Google account identifier from Google. We do not receive your Google password, contacts, or any other Google data, and we do not store your profile photo.
  • Vehicle Data: UK Vehicle Registration Marks (VRMs) that you look up and save to your Garage.
  • Location Data: Your postcode or approximate home coordinates, used exclusively to find nearby MOT stations, fuel prices, or road closures. This is only stored if you add it to your profile.
  • Telemetry & Feedback: Feedback ratings and bug report details you voluntarily submit.

3a. Sign in with Google

If you choose to sign in with Google, Google LLC (and its UK/EU affiliates) processes your data to authenticate you, under its own privacy policy. When the Google sign-in button loads, your browser connects to Google's servers, so Google may receive your IP address and device information, and may set its own cookies. Kermo only loads Google's sign-in script on the sign-in page. We link your Google account identifier to your Kermo account, so you can sign in either way.

  • Google acts as an independent controller for its own processing. See policies.google.com/privacy.
  • You can stop using Google sign-in at any time by contacting us, and you can revoke Kermo's access in your Google Account settings.
  • Deleting your Kermo account also deletes the stored link to your Google account.

3b. Email Alerts Without an Account

You can ask for monthly car crime alerts by giving only your email address and a postcode. We store the email address, postcode, chosen radius, when you signed up and confirmed, and which month we last emailed you about. We process this on the basis of your consent, which you give by clicking the confirmation link we send. Nothing is emailed until you confirm, and if you never confirm the request simply sits unused.

  • Every alert email includes an unsubscribe link, and supporting email apps show a one-click unsubscribe button. Unsubscribing takes effect immediately.
  • We keep a record of an unsubscribed address so we can honour your choice and prove it was respected; contact us if you'd like it erased entirely.
  • If you later create a Kermo account with the same email address, your alert moves onto your account and you can manage it in your profile.
  • Alert emails may mention what a free Kermo account offers. We never sell or share your email address.

4. Official UK Government & Third-Party APIs

Kermo queries official UK government data sources, including DVSA, DVLA, Department for Transport (DfT), and National Highways APIs, to fetch MOT history, tax expiration dates, MOT testing station locations, and live road closures. This information is processed under the Open Government Licence v3.0. Fuel retail prices are retrieved from published fuel price disclosure feeds. Live traffic data includes National Highways data © Crown copyright.

5. Your Rights Under UK Data Protection Law

Under the UK GDPR and Data Protection Act 2018, you hold statutory rights regarding your personal information:

  • Right of Access: You have the right to request confirmation and copies of your personal data held by Kermo.
  • Right to Rectification: You may ask us to correct inaccurate or incomplete data.
  • Right to Erasure ('Right to be Forgotten'): You may delete your vehicles or request complete account erasure at any time.
  • Right to Restrict or Object: You have the right to object to or restrict processing under certain conditions.
  • Right to Complain: You have the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

6. AI Features & Image Processing

Where you use any AI-powered scanning feature within Kermo, the photograph or image you submit is transmitted securely over HTTPS to an authorised third-party AI provider solely for the purpose of extracting vehicle-related data (such as registration marks, instrument readings, document figures, or component specifications). Kermo does not store your images at any point — images are discarded immediately after a response is received. The scope of AI scanning may expand over time as new features are introduced; any such addition will fall under this same policy.

6a. Third-Party AI Processing & International Transfers

Images are processed by our AI provider under their applicable terms of service. On commercial API tiers, providers contractually commit not to use submitted data to train or improve their models. Where processing occurs outside the UK, it is carried out under appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) in compliance with UK GDPR Article 46. No image data is retained by Kermo or the AI provider beyond the duration of the API request.

7. Data Retention and Security

When you remove a vehicle from your Garage, all associated cached records are expunged. Account deletion requests permanently remove personal information within 30 days. All communication is encrypted via TLS/HTTPS, and passwords, where set, are protected with salted one-way hashing.

Last reviewed: September 2026. Formulated in compliance with UK GDPR, Data Protection Act 2018, and PECR.