Privacy Policy

How Mekavo collects, uses, and protects the personal data of New Zealand workshop operators.

Last updated: 5 March 2026

This Privacy Policy explains how MEKAVO LTD (trading as "Mekavo"), registered in England and Wales (Company No. 16477044), collects, uses, stores, and protects your personal data when you use our website (mekavo.com) and our workshop management software platform (the "Service"). Mekavo is operated from the United Kingdom and serves workshops in New Zealand and other countries.

We are committed to protecting your privacy and ensuring your data is handled in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs), as well as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

MEKAVO LTD is the data controller for the personal data processed through Mekavo. Our registered office is:

MEKAVO LTD
76 Letchworth Rd
Leicester, LE3 6FH
United Kingdom

Email:

2. Data We Collect

We collect the following types of personal data:

2.1 Account Information

  • Full name, email address, phone number
  • Business name and address
  • Country and preferred language
  • Password (encrypted)

2.2 Customer Data You Store

  • Your customers' names, phone numbers, email addresses, and vehicle details
  • Job records, invoices, and payment history
  • :inspection and service reminder data

You are the data controller for your customers' data. Mekavo acts as a data processor on your behalf.

2.3 Usage Data

  • IP address, browser type, device information
  • Pages visited, features used, session duration
  • Referral source and search terms

2.4 Payment Data

  • Billing name and address
  • Payment card details are processed securely by Stripe — we never store your full card number

2.5 Communication Data

  • Support tickets, emails, and contact form messages
  • In-app feedback and feature requests

3. How We Use Your Data

We use your personal data to:

  • Provide, maintain, and improve the Mekavo platform
  • Process subscriptions, payments, and refunds
  • Send transactional emails (account confirmation, password reset, invoices)
  • Send SMS reminders on your behalf to your customers
  • Provide technical support and respond to enquiries
  • Analyse usage patterns to improve the Service
  • Comply with legal obligations (tax records, fraud prevention)
  • Send marketing communications (only with your explicit consent)

4. Lawful Basis for Processing

We process your data under the following legal bases:

  • Contract: Processing necessary to deliver the Service you signed up for
  • Legitimate interest: Improving our platform, preventing fraud, ensuring security
  • Consent: Marketing emails and non-essential cookies (you can withdraw at any time)
  • Legal obligation: Tax compliance, responding to lawful requests from authorities

5. Data Sharing

We do not sell your personal data. We share data only with trusted third parties who help us operate the Service:

  • Stripe — payment processing
  • DigitalOcean — cloud hosting infrastructure
  • Twilio / SMS provider — sending SMS reminders to your customers
  • Email provider — transactional and marketing emails
  • Analytics tools — anonymised usage data for product improvement

All third-party providers are contractually bound to protect your data and process it only on our instructions.

We may also disclose data if required by law, regulation, or legal process.

When you pay for parking

When you pay for parking through Mekavo, the business that runs the car park (the operator) receives your vehicle registration, your email address and — if you provide it — your phone number, plus any message you send through the contact form. The operator needs this to provide the parking service and to deal with any query about your session.

In respect of that data the operator is a data controller in its own right, alongside Mekavo, and the operator is responsible for its own handling of it under applicable data-protection law. Mekavo passes the data to the operator and processes it to run the payment and the site; we do not use it for unrelated marketing.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data: Retained while your account is active, deleted within 90 days of account closure
  • Customer data you stored: Deleted within 90 days of account closure (or upon your request)
  • Invoices and payment records: Retained for 7 years as required by UK tax law
  • Support tickets: Retained for 2 years after resolution
  • Usage/analytics data: Anonymised and aggregated after 26 months

7. Cookies

We use cookies and similar technologies to operate the Service, remember your preferences, and analyse usage. For full details, see our Cookie Policy.

You can manage cookie preferences through your browser settings or our cookie consent banner.

8. Your Rights

Under the New Zealand Privacy Act 2020 and UK GDPR, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you
  • Right to rectification: Ask us to correct inaccurate or incomplete data
  • Right to erasure: Request deletion of your data ("right to be forgotten")
  • Right to restrict processing: Ask us to limit how we use your data
  • Right to data portability: Receive your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interest or direct marketing
  • Right to withdraw consent: Withdraw consent for marketing or non-essential cookies at any time

To exercise any of these rights, email us at . We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

9. International Data Transfers

Our servers are located in the United Kingdom and the European Economic Area (EEA). As a New Zealand user, your data is transferred to and stored in the UK. We ensure appropriate safeguards are in place for international transfers, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • UK International Data Transfer Agreement (IDTA)
  • Adequacy decisions where applicable

10. Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Secure password hashing (bcrypt)
  • Regular security updates and vulnerability monitoring
  • Access controls and role-based permissions
  • Regular backups with encrypted storage

No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours.

11. Children

Mekavo is a business-to-business service and is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or through a notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

MEKAVO LTD (trading as Mekavo)
76 Letchworth Rd, Leicester, LE3 6FH, UK

Privacy enquiries:
General enquiries: