Legal

Privacy Policy

Last updated: September 2026

Marque is operated by Cinolla Software Limited, which is the data controller for the personal data described here. This policy explains what we hold, why we hold it, who else sees it, and who answers for it. It covers the Marque website, the Marque web app, and the Marque apps for iPhone, iPad and Android.

Contacting us about data

We have appointed a Data Protection Officer. Questions about this policy, or any request to exercise the rights set out below, go to Rob Brasington at dataofficer@cinolla.com or 01202 937620. Our registered address is 26 Caledon Road, Lower Parkstone, Poole, Dorset, BH14 9NN. For anything else, support@cinolla.com reaches the people who run the product.

Who is responsible for what

There are two kinds of data here and they are not treated the same.

Your workshop's own data — the people you give logins to, their names and email addresses, your workshop's details, and your subscription. We are the controller for that, and this policy explains it.

Your customers' data — the people whose cars you work on, their contact details, their vehicles, the photographs you take and the condition reports they sign. You are the controller for that and we are your processor. We hold and process it on your instruction, to run the service, and for nothing else. Telling your customers why you hold it, and answering their requests, is yours to do; we will help you find or export whatever you need.

The data we collect

Personal data means information from which a living person can be identified. It does not include data where the identity has been removed.

Identity and contact data. Name, email address, role, and the workshop you belong to. For the workshop itself: trading name, address, telephone number and VAT registration, as you enter them.

Sign-in data. A hashed password — never the password itself — and, for anyone who has switched two-factor sign-in on, a secret used to check the six-digit codes and a set of one-time recovery codes. Sign-in times and active sessions.

Workshop records. Customers, vehicles, jobs, quotes, repairs, sales, parts, payments, suppliers and bodyshops, as you enter them.

Evidence. Photographs of vehicles and items, marks recorded on condition reports, and customer signatures captured on screen. These exist to prove condition at a point in time, which is why a signed report cannot be edited afterwards.

Technical data. IP address, browser or app version, operating system, and server logs. From the phone and tablet apps, the device model and OS version, so a fault report can be placed on a real device.

Subscription data. What plan you are on and what has been paid. Card details are entered on Stripe's own pages and never reach us.

We do not collect special category data — race, ethnicity, religious belief, sex life, sexual orientation, political opinion, trade union membership, health, genetic or biometric data — and we ask you not to put it into free-text fields. We do not collect criminal offence data. Marque is a tool for businesses and is not intended for use by children.

The camera, the photo library and the apps

The Marque apps ask for access to the camera so you can photograph a vehicle before and after work without leaving the job, and to the photo library if you choose to attach a picture you have already taken. Both are asked for at the moment you first use them, both can be refused, and refusing either only removes that way of adding a photograph — the rest of the app works as normal. Photographs you take in the app are uploaded to the job they were taken on and are treated exactly like photographs uploaded from a browser.

Face ID, Touch ID and fingerprint sign-in

You can choose to use your device's biometric unlock as your second factor when signing in on a phone or tablet. If you do, no biometric data of any kind reaches Marque or Cinolla. Your face or fingerprint is held by Apple or Google in secure hardware on your own device, is checked there, and the app is told only whether the check passed. We store a marker saying that this device has been trusted, which you can remove at any time by turning the setting off or signing out. It is optional, and a six-digit authenticator code always works instead.

How your data is collected

Nearly all of it you type in, or your staff do. Technical data is collected automatically as you use the service. We also receive a small amount from third parties you ask us to contact: vehicle details from the DVLA when you look up a registration, delivery status from a courier when you track a parcel, and accounting records from QuickBooks if you connect it.

Cookies and app storage

The Marque web app sets one cookie, to keep you signed in. The phone and tablet apps store the equivalent on the device. Neither is used for tracking or advertising, and there is no analytics cookie to consent to. The marketing site sets no cookies at all.

How we use it, and on what legal basis

We use personal data only where the law allows. In practice that means one of three things.

To perform our contract with you — creating and running your account, providing the service, taking payment, and recovering money owed.

For our legitimate interests, where your rights do not override them — keeping the service secure and available, investigating faults, preventing fraud and abuse, and improving the product. Error reports through Sentry fall here, and are configured not to carry personal data: they identify the workshop and the role of whoever hit the problem, not the person.

To comply with a legal obligation — tax and accounting records, and responding to lawful requests.

Your customers' data is a separate matter: we process it as your processor, on your instruction, to provide the service and for nothing else.

We rely on consent only for optional marketing email, which you can stop at any time using the link in the message or by writing to us. We do not sell data, we do not use it for advertising, we do not share it with anybody else for their own marketing, and we do not use it to train machine learning models. There is no automated decision-making that produces legal or similarly significant effects.

If you do not provide it

Some of what we ask for is needed to run the service or is required by law. Where we cannot provide Marque without it, we may have to close the account, and we will say so at the time rather than afterwards.

Who else sees it

Nobody, other than the services needed to run Marque, each receiving only what its task requires:

Amazon Web Services — hosting, storage and email delivery, in the United Kingdom (eu-west-2). Stripe — your subscription and its payments.Sentry — error reports, scrubbed of personal data.Intuit QuickBooks — if you connect it, and then only the exchange described in our terms. DVLA — a registration number, when you look a vehicle up. Parcel — a tracking number, if you use parcel tracking.Apple and Google — distribution of the apps and crash reporting from their own platforms, on their terms rather than ours.

Each of these acts on our instruction under a contract that holds it to the same standards we are held to, and none of them is permitted to use your data for its own purposes. We also disclose data where we must: to our professional advisers, to regulators and public authorities where the law requires it, and to a buyer if the business is ever sold, who would be bound by this policy.

Bodyshops and subcontractors

A login you issue to a bodyshop can see the pieces you have sent to that company, the vehicle they came off, and what needs doing. It can never see your customers, your prices, or another bodyshop's work. That boundary is enforced by the service rather than by convention.

Where it is held

In the United Kingdom. We do not transfer your data outside the United Kingdom, and we will say so here before that changes. Databases, uploaded photographs and signatures are encrypted at rest, and everything travels over HTTPS.

Security

We take appropriate measures to stop data being lost, altered, disclosed or reached by anybody without a reason to see it. Access inside Cinolla is limited to the people who need it to do their jobs, and everyone with access is under a duty of confidence. We have procedures for handling a suspected breach, and will tell you and the regulator where the law requires it.

How long we keep it

For as long as your account is active. After it closes we keep your workshop's data for a reasonable period so it can be exported if you ask, then delete it. Where we have had a contract with you, customer and supplier records are kept for seven years from the date the contract ends; where a contract was never entered into, for three years from the last contact between us. Records we are legally required to keep — invoices, for tax — are kept for as long as the law requires. Data that has been anonymised, so that it can no longer be connected to anybody, may be kept indefinitely.

Your rights

You can ask us to:

Give you a copy of the personal data we hold about you.Correct anything incomplete or wrong. Delete data where there is no good reason for us to keep it. Stop processing you object to, where we are relying on our legitimate interests. Pause processing while something is checked. Transfer your data to you or another provider in a machine-readable form. Withdraw consent where consent is what we relied on, which does not affect anything done before you withdrew it.

Write to dataofficer@cinolla.com. There is no fee. We may ask you to confirm who you are before we hand over personal data, which is a precaution in your favour rather than an obstacle, and we aim to answer within one month.

If you are a customer of a workshop that uses Marque, rather than a Marque account holder, ask the workshop first — they hold that record and we act on their instruction.

Complaints

You can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so we get the chance to put it right.

Other sites

Marque links out to other companies' sites — a supplier, a courier's tracking page, a video somebody has attached to a job. Those sites have their own privacy policies and we are not responsible for them.

Keeping it accurate

Please tell us if your details change, so what we hold stays correct. Most of it you can change yourself in the app.

Changes

If this policy changes materially we will say so in the app. The date at the top always reflects the last change.

Contact

Cinolla Software Limited, 26 Caledon Road, Lower Parkstone, Poole, Dorset, BH14 9NN. Data protection: dataofficer@cinolla.com. Everything else: support@cinolla.com.