Privacy Policy

Voodoo Nexus is a managed remote vehicle service network operated by Nexus Technologies Ltd. We are the data controller for the personal data described in this policy.

This policy applies to:

• Workshops applying to join or using the network
• Remote specialists (Masters) approved to carry out remote sessions
• Vehicle owners whose vehicles are worked on through the network
• Visitors to this website and anyone who contacts us

Account and application data. Your name, business name, trading address, email address, telephone number, trade qualifications and experience, and the information you give us when you apply to join the network or order hardware.

Vehicle and session data. Vehicle registration, VIN, make, model, year, mileage, fault codes, live sensor readings, ECU identifiers, software and calibration versions, coding and programming logs, and records of what was changed during a session. Where this data is linked to an identifiable person, such as a named vehicle owner, we treat it as personal data.

Device data. Serial numbers, connection and heartbeat logs, firmware versions and diagnostic telemetry from Nexus Slave and Nexus Master units.

Transaction data. Records of subscriptions, per-session charges, hardware orders, delivery addresses and payment status. We do not store full card numbers; card payments are handled entirely by our payment provider.

Technical data. IP address, browser type and version, device type, operating system and how you use this website. We also store a one-way hash of your IP address for a short period to protect our forms and admin sign-in from automated abuse.

Communications. Emails, enquiry and application records, and notes from telephone calls.

Where we rely on legitimate interests, we have considered whether those interests are fair to you, and you can object at any time. See section 9.

We do not sell your personal data, and we do not use it for automated decision-making that has a legal or similarly significant effect on you.

Remote diagnostics, coding and ECU programming change how a vehicle behaves. We keep a technical record of every session, including who performed it, what was read and what was written, because it lets us investigate faults, support warranty questions and resolve disputes about what was done to a vehicle. This is an important part of running the network safely, and we consider it a legitimate interest of ours, of the workshop and of the vehicle owner.

We share personal data with service providers who process it on our behalf, under contract and only on our instructions:

• Payment processing — Stripe, for card payments and payment confirmation
• Website and application hosting — Vercel
• Data storage — Amazon Web Services (DynamoDB), where enquiry, application and order records are held
• Delivery — the courier fulfilling your hardware order

We also share data where we have to: with our accountants and professional advisers, and with regulators, insurers or law enforcement where we are legally required to, or where it is necessary to establish or defend legal claims.

Within the network, a workshop and the assigned remote specialist will both see the vehicle and session data needed to carry out the work.

Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the safeguards applying to a particular transfer.

Where we no longer need data, we delete it or anonymise it.

Under UK data protection law you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Erase data where there is no good reason for us to keep it
• Restrict how we use your data while a concern is investigated
• Object to processing based on legitimate interests, and to direct marketing at any time
• Portability — receive certain data in a machine-readable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these, email accounts@voodoonexus.co.uk. We will respond within one month. There is no charge in normal circumstances, and we may ask you to confirm your identity first.

Some rights are qualified. We may need to keep a session record even after an erasure request, where it is needed for legal claims or statutory record-keeping. We will explain if that applies.

We use access controls, encryption in transit, authentication on the admin and portal surfaces, and role-based permissions so that people only see the data they need. No system is completely secure, but we take steps to protect your data and we will notify you and the Information Commissioner’s Office where we are required to following a personal data breach.

This website uses a small number of cookies. See our Cookie Policy for what we set and how to control it.

Our services are intended for motor trade professionals and vehicle owners aged 18 or over. We do not knowingly collect data from children.

We may update this policy from time to time. The date at the top shows when it was last changed, and we will tell account holders about significant changes.

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or at ico.org.uk.