π¬π§ Privacy, UK GDPR & Cookie Policy
At iNerd Tech Repair & Console Specialists, we treat your personal information, hardware data, and workshop conversations with strict confidentiality in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Data Controller & Contact Details
iNerd Tech Repair & Console Specialists ("iNerd", "we", "us") is the Data Controller responsible for personal data collected via www.inerd.co.uk and at our Hinckley repair lab:
- Workshop Address: 130 Coventry Road, Hinckley, Leicestershire, LE10 0JU, United Kingdom
- Privacy & Data Requests Email: support@inerd.co.uk
- Telephone: 01455 240075
2. What Data We Collect & Our UK GDPR Lawful Bases (Article 6)
| Activity | Personal Data Processed | UK GDPR Lawful Basis |
|---|---|---|
| Workshop Drop-Off, On-Site Callout & Postal Repairs | Name, email, UK phone/mobile, postal/callout address, device make/model/serial/IMEI, fault notes, diagnostic photos, optional QC test PIN/passcode, encrypted 6-digit Handover Release PIN, and optional Nominated Collector details. | Contract (Art. 6(1)(b)) β to diagnose, quote, repair, verify safe handover/delivery, and honour your 12-month hardware warranty; Consent (Art. 6(1)(a)) for optional visual profile-photo handover verification. |
| Hardware Trade-In / Buy-Back | Contact details, device serial/IMEI, CheckMEND provenance check, proof-of-ownership ID details, and UK BACS payout details (where bank transfer is selected). | Contract (Art. 6(1)(b)) & Legal Obligation (Art. 6(1)(c)) β anti-handling/stolen-goods due diligence and HMRC accounting records. |
| Live Bench Chat & Customer Hub | Profile name, optional profile photo, chat messages, attachments/voice notes, read receipts, and passwordless 6-digit PIN verification tokens. Note: neither staff nor customers can alter or delete messages authored by the other party. | Contract (Art. 6(1)(b)) & Legitimate Interests (Art. 6(1)(f)) β real-time repair updates, quote queries, and accurate customer support records. |
| Web Push, SMS & Email Alerts | Browser Web Push subscription endpoint, notification priority preferences, email, and mobile number for repair status & chat alerts. | Contract (Art. 6(1)(b)) for essential repair status alerts; Consent (Art. 6(1)(a)) for optional browser push notifications (revocable anytime in your Customer Hub or browser). |
| Remote Support Sessions & 24/7 Care Plans | Hostname, hardware health telemetry (CPU, disk SMART, temperatures), attended/authorised remote session ID, technician connection log, and Square subscription or Xero B2B contract billing status. | Contract (Art. 6(1)(b)) & Explicit Authorisation β sessions and agents can be uninstalled and revoked at any time. |
| iNerd Cloud Drive, File Streaming & Encrypted Backups | Encrypted file & folder blobs, filenames, timestamps, version snapshots, and revocable Windows Explorer / macOS Finder / Android WebDAV device tokens. | Contract (Art. 6(1)(b)) β to store, stream, and restore your files on your instruction under per-tenant AES-256-GCM envelope encryption. |
Official iNerd Android App (uk.co.inerd.app) |
First-party HTTPS session cookie, user-initiated camera/file uploads for bench chat or Cloud Backup, and standard app version header. Requests android.permission.INTERNET only β zero third-party ad, tracking, or telemetry SDKs, and Android OS cloud auto-backup is disabled (allowBackup=false) to protect session tokens. |
Contract (Art. 6(1)(b)) β to provide direct mobile access to your repairs, live workshop chat, and encrypted Cloud Drive. |
| Website Analytics Cookies | Aggregated page-visit metrics (Google Analytics 4 with default Consent Mode set to denied until you click "Accept All"). |
Consent (Art. 6(1)(a) & UK PECR Reg. 6) β strictly opt-in; never loaded for "Essential Only" visitors. |
3. Device Passcodes, Personal Files & Workshop Confidentiality
- Optional QC Passcodes: Sharing a screen PIN or login password for post-repair Quality Control testing is completely optional. Passcodes are stored only in our restricted workbench vault for active testing and are redacted automatically upon account erasure.
- Zero Inspection of Personal Files: Our technicians test hardware functions (display, charging, cameras, audio, ports, Wi-Fi, controller sensors) only and never browse personal photos, documents, or private apps.
- iNerd Cloud Drive Zero-Access Privacy Shield: Every Cloud Drive & Backup vault is encrypted at rest using a unique per-tenant AES-256-GCM key stored on our Hinckley vault / UK-EU object storage. Workshop staff are blocked from browsing your Cloud Drive files unless you explicitly turn on time-limited Engineer Assist in your Customer Hub (which revokes automatically when the timer expires or with one click).
- Collection Verification Card, 6-Digit Release PIN & Nominated Collector: To protect high-value hardware at counter collection and local doorstep delivery without ever printing customer photographs or release codes onto physical thermal bench tags, A4 invoices, or parcel labels, every active repair is issued an AES-256-GCM encrypted 6-digit Handover Release PIN visible only on your authenticated Live Repair Pass and Customer Hub. Displaying your Customer Hub profile photo on internal staff handover screens is strictly opt-in and remains blurred until a technician clicks to verify. If you nominate a trusted third party (e.g. partner, family member, or colleague) to collect or accept delivery, any optional collector verification photo is stored encrypted at rest (
AES-256-GCM), restricted exclusively to authenticated workshop staff, and automatically purged from disk immediately upon handover verification (or after 14 days on closed tickets). - Live Chat Integrity & Deletion Markers: To protect both customers and technicians, Live Chat enforces strict authorship integrity β workshop staff cannot edit or delete a customer's messages for everyone, and customers can delete any of their own messages at any time. When a message is deleted for everyone, the message text, media attachment, reactions, and notification history are permanently scrubbed immediately, leaving only a content-free deletion timestamp marker for conversation audit integrity (which is also purged upon full account erasure).
4. Trusted Processors & Data Transfers
We never sell, rent, or trade customer personal data. We share strictly necessary data only with vetted processors bound by UK GDPR Data Processing Agreements:
- Payment Processing: Square UK & UK Faster Payments / Starling Bank (iNerd never stores full payment card numbers or CVV codes on our servers).
- Accounting & VAT Invoicing: Xero (UK statutory bookkeeping and VAT records).
- Transactional SMS & Courier Labels: Vetted UK SMS gateway & Royal Mail Tracked (for mail-in postal repairs and store dispatches).
5. Data Retention Schedule
- Statutory Tax & Invoice Records (6 Years): Under the Taxes Management Act 1970 and VAT Act 1994, accounting totals for completed repairs, trade-ins, and store sales are retained for 6 years plus the current financial year. If you exercise your Right to Erasure during this window, personal identifiers, contact details, addresses, and device passcodes are redacted/anonymised while preserving non-personal financial totals.
- 12-Month Repair Warranty Records: Retained for the duration of your warranty so you can verify cover even if you misplace your paper receipt.
- Customer Hub, Cloud Drive Vault, Live Chat & Push Subscriptions: Retained while your account remains active (with 7, 30, or 60-day version history depending on your Cloud tier), or cryptographically shredded and erased immediately when you use the self-service Delete Account tool in your Customer Hub.
- Security & Anti-Abuse Logs: Minimised IP/rate-limit logs are rotated and pruned automatically.
6. Cookies & Local Storage (UK PECR)
| Cookie Name | Category | Purpose & Expiry |
|---|---|---|
PHPSESSID |
Strictly Necessary | Maintains your active CSRF security token, shopping basket, and live session. Expires when your browser closes. |
inerd_cust_auth |
Strictly Necessary | Encrypted, revocable 30-day Customer Hub authentication token issued only when you sign in via 6-digit security PIN (HttpOnly, SameSite=Lax). |
inerd_cookie_consent |
Strictly Necessary | Remembers your cookie choice (essential or all) for 12 months so you are not prompted on every page. |
_ga, _ga_* |
Analytics (Optional) | Google Analytics 4 traffic measurement. Blocked by default unless you explicitly click "Accept All". Change your choice anytime below. |
7. Your UK GDPR Rights & Instant Self-Service Controls
Under the UK GDPR, you have the right to:
- Right of Access (Art. 15) & Data Portability (Art. 20): Download a complete JSON copy of your profile, repairs, quotes, orders, live chat messages, push devices, and feedback anytime via Customer Hub → Security & Data.
- Right to Rectification (Art. 16): Update your name, contact details, addresses, and notification priorities instantly in Customer Hub → Profile.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Permanently delete your Customer Hub account, chat history, push subscriptions, and personal identifiers directly in Customer Hub → Security & Data, or by emailing support@inerd.co.uk. We respond to all formal requests within 1 calendar month free of charge.
- Right to Restrict Processing, Object & Withdraw Consent: Toggle SMS, Email, and Web Push alerts anytime in your profile, or switch cookies to "Essential Only" above.
- Right to Complain to the UK Regulator: If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.